ModSecurity: StatusEngine call failed

[un99known99]

Hi,
I am getting this kind of error message in my /var/log/apache2/error.log:

...
[Fri Apr 15 18:32:16.151541 2022] [mpm_event:notice] [pid 3265:tid 1995772352] AH00489: Apache/2.4.53 (Raspbian) OpenSSL/1.1.1n
[Fri Apr 15 18:32:16.151867 2022] [core:notice] [pid 3265:tid 1995772352] AH00094: Command line: '/usr/sbin/apache2'
[Fri Apr 15 18:37:59.449854 2022] [mpm_event:notice] [pid 3265:tid 1995772352] AH00492: caught SIGWINCH, shutting down gracefully
[Fri Apr 15 18:38:00.473588 2022] [:notice] [pid 3803:tid 1995579840] ModSecurity for Apache/2.9.3 (http://www.modsecurity.org/) configured.
[Fri Apr 15 18:38:00.476451 2022] [:notice] [pid 3803:tid 1995579840] ModSecurity: APR compiled version="1.7.0"; loaded version="1.7.0"
[Fri Apr 15 18:38:00.476542 2022] [:notice] [pid 3803:tid 1995579840] ModSecurity: PCRE compiled version="8.39 "; loaded version="8.39 2016-06-14"
[Fri Apr 15 18:38:00.476580 2022] [:notice] [pid 3803:tid 1995579840] ModSecurity: LUA compiled version="Lua 5.1"
[Fri Apr 15 18:38:00.476609 2022] [:notice] [pid 3803:tid 1995579840] ModSecurity: YAJL compiled version="2.1.0"
[Fri Apr 15 18:38:00.476638 2022] [:notice] [pid 3803:tid 1995579840] ModSecurity: LIBXML compiled version="2.9.10"
[Fri Apr 15 18:38:00.476668 2022] [:notice] [pid 3803:tid 1995579840] ModSecurity: Original server signature: Apache
[Fri Apr 15 18:38:00.476935 2022] [:notice] [pid 3803:tid 1995579840] ModSecurity: StatusEngine call: "2.9.3,Apache,1.7.0/1.7.0,8.39/8.39 2016-06-14,Lua 5.1,2.9.10,90"
[Fri Apr 15 18:38:05.487574 2022] [:notice] [pid 3803:tid 1995579840] ModSecurity: StatusEngine call failed. Query: GIXDSSDFDSFSDFDSFSDFSDFSDFSDFSDFSDFSDFSDFLZR.FY3S4MBMSDFSDFSDFSDFSDFSDFSDfRN.GA3C2MJsdfsdfsdfsdfsdfsdfsdfsdfLBSFY4S4MJQ.FQ4TA.1650040680.status.modsecurity.org

...

What am I missing here or what needs to be changed so that StatusEngine call does NOT fail?

[martinhsv]

Hi @un99known99 ,

The status engine's purpose is to send limited information about the deployment (e.g. which ModSecurity version are you using) to a central server for statistical purposes.

The failure you are seeing is because the name resolution is not successful. This is expected, since the use case for collecting that information is no longer valued and the receiver no longer exists.

The failure should not cause any functionality problems beyond the message in error.log at startup; you could opt to just ignore it.

However, you may want to turn off the status engine ('SecStatusEngine Off') instead.

I will go ahead and make that change to the modsecurity.conf-recommended files in github.

[martinhsv]

The setting has been updated to 'Off' in v2/master modsecurity.conf-recommended as of 7334271

[un99known99]

@martinhsv many thanks!