Merge pull request #2583 from Tamerz/modsec_log_format

Author: smortex

REFERENCE.md

@@ -6075,6 +6075,7 @@ The following parameters are available in the `apache::mod::security` class:
 * [`audit_log_relevant_status`](#-apache--mod--security--audit_log_relevant_status)
 * [`audit_log_parts`](#-apache--mod--security--audit_log_parts)
 * [`audit_log_type`](#-apache--mod--security--audit_log_type)
+* [`audit_log_format`](#-apache--mod--security--audit_log_format)
 * [`audit_log_storage_dir`](#-apache--mod--security--audit_log_storage_dir)
 * [`secpcrematchlimit`](#-apache--mod--security--secpcrematchlimit)
 * [`secpcrematchlimitrecursion`](#-apache--mod--security--secpcrematchlimitrecursion)
@@ -6194,6 +6195,14 @@ Defines the type of audit logging mechanism to be used.
 
 Default value: `$apache::params::modsec_audit_log_type`
 
+##### <a name="-apache--mod--security--audit_log_format"></a>`audit_log_format`
+
+Data type: `Enum['Native', 'JSON']`
+
+Defines what format the logs should be written in.
+
+Default value: `'Native'`
+
 ##### <a name="-apache--mod--security--audit_log_storage_dir"></a>`audit_log_storage_dir`
 
 Data type: `Optional[Stdlib::Absolutepath]`

manifests/mod/security.pp

@@ -32,6 +32,9 @@
 # 
 # @param audit_log_type
 #   Defines the type of audit logging mechanism to be used.
+#
+# @param audit_log_format
+#   Defines what format the logs should be written in.
 # 
 # @param audit_log_storage_dir
 #   Defines the directory where concurrent audit log entries are to be stored. This directive is only needed when concurrent audit logging is used.
@@ -143,6 +146,7 @@
   String $audit_log_relevant_status                            = '^(?:5|4(?!04))',
   String $audit_log_parts                                      = $apache::params::modsec_audit_log_parts,
   String $audit_log_type                                       = $apache::params::modsec_audit_log_type,
+  Enum['Native', 'JSON'] $audit_log_format                     = 'Native',
   Optional[Stdlib::Absolutepath] $audit_log_storage_dir        = undef,
   Integer $secpcrematchlimit                                   = $apache::params::secpcrematchlimit,
   Integer $secpcrematchlimitrecursion                          = $apache::params::secpcrematchlimitrecursion,
@@ -256,6 +260,7 @@
     'audit_log_relevant_status'   => $audit_log_relevant_status,
     'audit_log_parts'             => $audit_log_parts,
     'audit_log_type'              => $audit_log_type,
+    'audit_log_format'            => $audit_log_format,
     'audit_log_storage_dir'       => $audit_log_storage_dir,
     'logroot'                     => $logroot,
   }

spec/classes/mod/security_spec.rb

@@ -102,6 +102,7 @@
                 audit_log_relevant_status: '^(?:5|4(?!01|04))',
                 audit_log_parts: 'ABCDZ',
                 audit_log_type: 'Concurrent',
+                audit_log_format: 'JSON',
                 audit_log_storage_dir: '/var/log/httpd/audit',
                 secdefaultaction: 'deny,status:406,nolog,auditlog',
                 secrequestbodyaccess: 'Off',
@@ -114,6 +115,7 @@
             it { is_expected.to contain_file('security.conf').with_content %r{^\s+SecAuditLogRelevantStatus "\^\(\?:5\|4\(\?!01\|04\)\)"$} }
             it { is_expected.to contain_file('security.conf').with_content %r{^\s+SecAuditLogParts ABCDZ$} }
             it { is_expected.to contain_file('security.conf').with_content %r{^\s+SecAuditLogType Concurrent$} }
+            it { is_expected.to contain_file('security.conf').with_content %r{^\s+SecAuditLogFormat JSON$} }
             it { is_expected.to contain_file('security.conf').with_content %r{^\s+SecAuditLogStorageDir /var/log/httpd/audit$} }
             it { is_expected.to contain_file('security.conf').with_content %r{^\s+SecRequestBodyAccess Off$} }
             it { is_expected.to contain_file('security.conf').with_content %r{^\s+SecResponseBodyAccess On$} }

templates/mod/security.conf.epp

@@ -49,6 +49,9 @@
     SecAuditLogRelevantStatus "<%= $audit_log_relevant_status %>"
     SecAuditLogParts <%= $audit_log_parts %>
     SecAuditLogType <%= $audit_log_type %>
+    <%- if $audit_log_format == 'JSON' { -%>
+    SecAuditLogFormat JSON
+    <%- } -%>
     <%- if $audit_log_storage_dir { -%>
     SecAuditLogStorageDir <%= $audit_log_storage_dir %>
     <%- } -%>