title: mod_sec trigger on CSR rule _23
body: <p>I'm using mod_security with the latest core rules.</p>
  
  <p>It triggers on all my pages whenever I use a querystring.. ie.</p>
  
  <p>www.mypage.com/index.php?querystring=1</p>
  
  <p>I get a warning that it exceeds maximum allowed number of arguements, however the base config defines max_numb_args to = 255 which of course it doesn't exceed.</p>
  
  <p>Any ideas why?</p>
  
  <p>Base conf:</p>
  
  <blockquote>
    <p>SecRuleEngine On<br>
    SecAuditEngine RelevantOnly<br>
    SecAuditLog /var/log/apache2/modsec_audit.log<br>
    SecDebugLog /var/log/apache2/modsec_debug_log<br>
    SecDebugLogLevel 3<br>
    SecDefaultAction "phase:2,pass,log,status:500"<br>
    SecRule REMOTE_ADDR "^127.0.0.1$" nolog,allow<br>
    SecRequestBodyAccess On<br>
    SecResponseBodyAccess On<br>
    SecResponseBodyMimeType (null) text/html text/plain text/xml<br>
    SecResponseBodyLimit 2621440<br>
    SecServerSignature Apache<br>
    SecUploadDir /tmp<br>
    SecUploadKeepFiles Off<br>
    SecAuditLogParts ABIFHZ<br>
    SecArgumentSeparator "&amp;"<br>
    SecCookieFormat 0<br>
    SecRequestBodyInMemoryLimit 131072<br>
    SecDataDir /tmp<br>
    SecTmpDir /tmp<br>
    SecAuditLogStorageDir /var/log/apache2/audit<br>
    SecResponseBodyLimitAction ProcessPartial<br>
    SecAction "phase:1,t:none,nolog,pass,setvar:tx.max_num_args=255"</p>
  </blockquote>
  
  <p>Rule that triggers:  </p>
  
  <pre><code># Maximum number of arguments in request limited  
  SecRule &amp;TX:MAX_NUM_ARGS "@eq 1" "chain,phase:2,t:none,pass,nolog,auditlog,msg:'Maximum number of arguments in request reached',id:'960335',severity:'4',rev:'2.0.7'"
      SecRule &amp;ARGS "@gt %{tx.max_num_args}" "t:none,setvar:'tx.msg=%{rule.msg}',setvar:tx.anomaly_score=+%{tx.notice_anomaly_score},setvar:tx.policy_score=+%{tx.notice_anomaly_score},setvar:tx.%{rule.id}-POLICY/SIZE_LIMIT-%{matched_var_name}=%{matched_var}"
  </code></pre>
  
  <p>And the log ouput:</p>
  
  <blockquote>
    <p>--ad5dc005-C--
    queryString=2
    --ad5dc005-F--
    HTTP/1.1 200 OK<br>
    X-Powered-By: PHP/5.3<br>
    Expires: Thu, 19 Nov 1981 08:52:00 GMT<br>
    Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0<br>
    Pragma: no-cache<br>
    Set-Cookie: SESSION=ak19oq36gpi94rco2qbi6j2k20; path=/<br>
    Vary: Accept-Encoding<br>
    Content-Encoding: gzip<br>
    Content-Length: 1272<br>
    Keep-Alive: timeout=15, max=99<br>
    Connection: Keep-Alive<br>
    Content-Type: text/html; charset=utf-8  </p>
    
    <p>--ad5dc005-H--<br>
    Message: Operator GT matched 0 at ARGS. [file "/etc/apache2/conf/modsecurity_crs/base_rules/modsecurity_crs_23_request_limits.conf"] [line "30"] [id "960335"] [rev "2.0.7"] [msg "Maximum number of arguments in request reached"] [severity "WARNING"]<br>
    Message: Operator GE matched 0 at TX:anomaly_score. [file "/etc/apache2/conf/modsecurity_crs/base_rules/modsecurity_crs_49_inbound_blocking.conf"] [line "18"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5, SQLi=, XSS=): Maximum number of arguments in request reached"]<br>
    Message: Warning. Operator GE matched 0 at TX:inbound_anomaly_score. [file "/etc/apache2/conf/modsecurity_crs/base_rules/modsecurity_crs_60_correlation.conf"] [line "35"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5, SQLi=, XSS=): Maximum number of arguments in request reached"]<br>
    Apache-Handler: application/x-httpd-php<br>
    Stopwatch: 1279667800315092 76979 (1546* 7522 72931)<br>
    Producer: ModSeurity for Apache/2.5.11 (<a href="http://www.modsecurity.org/" rel="nofollow noreferrer">http://www.modsecurity.org/</a>); core ruleset/2.0.7.
    Server: Apache</p>
  </blockquote>