modsec debug output

[Private]

Hi,

We have some debug info in logs like below:

[SECURITY] Pattern: '@pmFromFile blacklist.txt', len: 20, String 'xxxxxxx@xxxx.com', result: 6041, reverse: 0

What does '6041' here refer to? line 6041? We checked line 6041 but it's not 'xxxxxxx@xxxx.com'.

We need to know this because we are debugging a modsec rule. Litespeed is blocking one string which is not in our blacklist file.

 

[mistwang]

6041 is an internal state of out "Pattern Matching" code, it indicates a match (non-zero return indicates a match).

If the blacklist.txt does not contain a substring of "xxxxxxx@xxxx.com", it could be a bug in our pattern match engine.