title: ModSecurity not putting some transactions to audit log
body: <p>We are facing a problem when in certain cases ModSecurity is not tracking the blocking in the audit log despite we have set it as a default action and the rule is not having any logging property set. In the error log, we can see only the rule which was triggered due to the anomaly score has been reached but nothing about the rules which actually counted the score. In some other cases, this information is visible.</p>
  <p>In modsecurity.conf we have logging of rules enabled</p>
  <pre><code>SecAuditLogParts ABCIJDFHKZ
  </code></pre>
  <p>In crs-setup.conf we have default logging set to capture everything in both error and audit log.</p>
  <pre><code>SecDefaultAction &quot;phase:1,log,auditlog,pass&quot;
  SecDefaultAction &quot;phase:2,log,auditlog,pass&quot;
  </code></pre>
  <p>We have also tried other combinations like using this setup</p>
  <pre><code>SecDefaultAction &quot;phase:2,pass, nolog,auditlog&quot;
  </code></pre>
  <p>But notning helped.</p>
  <p>The only thing we can see in the log is this part from the error log and when we need more details we need to enable debug and redo the action. In the example below I have changed the IP addresses for security reasons.</p>
  <pre><code>2022/03/09 08:32:25 [error] 1149#1149: *13832 [client 1.1.1.1] ModSecurity: Access denied with code 403 (phase 2). Matched &quot;Operator `Ge' with parameter `5' against variable `TX:ANOMALY_SCORE' (Value: `15' ) [file &quot;/etc/nginx/owasp-modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;139&quot;] [id &quot;949110&quot;] [rev &quot;&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 15)&quot;] [data &quot;&quot;] [severity &quot;2&quot;] [ver &quot;OWASP_CRS/3.4.0-dev&quot;] [maturity &quot;0&quot;] [accuracy &quot;0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;10.1.0.1&quot;] [uri &quot;/favicon.ico&quot;] [unique_id &quot;1646811145&quot;] [ref &quot;&quot;], client: 1.1.1.1, server: example.com, request: &quot;GET /favicon.ico HTTP/1.1&quot;, host: &quot;example.com&quot;, referrer: &quot;http://example.com/?q=%22%3E%3Cscript%3Ealert(1)%3C/script%3E%27&quot;
  </code></pre>
  <p>We need to find a way how to make sure every attempt will be logged into the audit log.</p>
  <p>Thanks in advance for any help.</p>
  <p>Peter</p>