{"action":"created","issue":{"url":"https://api.github.com/repos/klaubert/waf-fle/issues/40","labels_url":"https://api.github.com/repos/klaubert/waf-fle/issues/40/labels{/name}","comments_url":"https://api.github.com/repos/klaubert/waf-fle/issues/40/comments","events_url":"https://api.github.com/repos/klaubert/waf-fle/issues/40/events","html_url":"https://github.com/klaubert/waf-fle/issues/40","id":78123799,"number":40,"title":"Waf-fle controller returns http response code 405","user":{"login":"alvarowe","id":12514504,"avatar_url":"https://avatars.githubusercontent.com/u/12514504?v=3","gravatar_id":"","url":"https://api.github.com/users/alvarowe","html_url":"https://github.com/alvarowe","followers_url":"https://api.github.com/users/alvarowe/followers","following_url":"https://api.github.com/users/alvarowe/following{/other_user}","gists_url":"https://api.github.com/users/alvarowe/gists{/gist_id}","starred_url":"https://api.github.com/users/alvarowe/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alvarowe/subscriptions","organizations_url":"https://api.github.com/users/alvarowe/orgs","repos_url":"https://api.github.com/users/alvarowe/repos","events_url":"https://api.github.com/users/alvarowe/events{/privacy}","received_events_url":"https://api.github.com/users/alvarowe/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-05-19T14:58:40Z","updated_at":"2015-05-21T06:39:01Z","closed_at":null,"body":"Hi ! I've spent 2 days trying to get my mlogc  to Waf-fle(Nginx+php-fpm) working but no way :(\r\n\r\nThe farest I've reached, I've met this 405 response code. \r\n\r\nMy config :8ball: \r\n.................................................................................................\r\nClient-sensor side:\r\n.................................................................................................\r\n## Relevant mlogc.conf\r\nCollectorRoot       \"/usr/local/apache/logs/mlogc\"\r\nConsoleURI          \"http://waffle.mydomain.net:81/controller/\"\r\nSensorUsername      \"sensorXX\"\r\nSensorPassword      \"mypasswd\"\r\n\r\n## Relevant modsec conf\r\nSecAuditEngine RelevantOnly\r\nSecAuditLogRelevantStatus \"^(?:5|4(?!04))\"\r\nSecAuditLogParts ABIDEFGHZ\r\nSecAuditLogType Concurrent\r\nSecAuditLogStorageDir /usr/local/apache/logs/mlogc/data\r\nSecDebugLogLevel 3\r\nSecAuditLog logs/modsec_audit.log\r\n\r\n## modsec pushed to mlogc by cron\r\n*/5 * * * * /usr/local/sbin/push-mlogc.sh  > /tmp/mlog.log 2>&1\r\n\r\n.................................................................................................\r\nServer Waf-fle side:\r\n.................................................................................................\r\n\r\nmysql -e \"select * from sensors;\" waffle                                                                                                                                                                                                                                                                                        \r\n+-----------+-------+----------+--------------+-------------+------+---------+---------------+------------------+\r\n| sensor_id | name  | password | IP           | description | type | status  | client_ip_via | client_ip_header |\r\n+-----------+-------+----------+--------------+-------------+------+---------+---------------+------------------+\r\n|         1 | sensorXX | mypasswd | x.y.z.w | cp500       |    1 | Enabled |             1 | x.y.z.w     |\r\n+-----------+-------+----------+--------------+-------------+------+---------+---------------+------------------+\r\n\r\n\r\nThe collecting takes place each 5minutes (as cron shows)\r\n\r\nAnd server wafle shows then multiple :::\r\n\r\n\"PUT /controller/ HTTP/1.1\" 405 172 \"-\" \"-\"\r\n\r\nAnd Sendor-side shows at debug level log :::\r\n\r\n[Tue May 19 16:35:07 2015] [4] [538981/7fbd00000ed0] CURL: HEADER_IN Date: Tue, 19 May 2015 14:35:02 GMT\r\n[Tue May 19 16:35:07 2015] [4] [538981/7fbd00000ed0] CURL: HEADER_IN Content-Type: text/html\r\n[Tue May 19 16:35:07 2015] [4] [538981/7fbd00000ed0] CURL: HEADER_IN Content-Length: 172\r\n[Tue May 19 16:35:07 2015] [4] [538981/7fbd00000ed0] CURL: HEADER_IN Connection: keep-alive\r\n[Tue May 19 16:35:07 2015] [4] [538981/7fbd00000ed0] CURL: HEADER_IN \r\n[Tue May 19 16:35:07 2015] [5] [538981/7fbd00000ed0] CURL: DATA_IN <html>\r\n[Tue May 19 16:35:07 2015] [4] [538981/7fbd00000ed0] CURL: Connection #0 to host waffle.mydomain.net left intact\r\n[Tue May 19 16:35:07 2015] [4] [538981/7fbd00000ed0] Request returned with status \"405 Not Allowed\": VVlAPiU7H6oAClzXTzMAAAAB\r\n[Tue May 19 16:35:07 2015] [2] [538981/7fbd00000ed0] Flagging server as errored after failure to submit entry VVlAPiU7H6oAClzXTzMAAAAB with HTTP response code 405: Not Allowed\r\n[Tue May 19 16:35:07 2015] [4] [538981/7fbd00000ed0] Sleeping for 50 msec.\r\n\r\n........I am completely dumb and unable to get it working :(\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/klaubert/waf-fle/issues/comments/104153914","html_url":"https://github.com/klaubert/waf-fle/issues/40#issuecomment-104153914","issue_url":"https://api.github.com/repos/klaubert/waf-fle/issues/40","id":104153914,"user":{"login":"alvarowe","id":12514504,"avatar_url":"https://avatars.githubusercontent.com/u/12514504?v=3","gravatar_id":"","url":"https://api.github.com/users/alvarowe","html_url":"https://github.com/alvarowe","followers_url":"https://api.github.com/users/alvarowe/followers","following_url":"https://api.github.com/users/alvarowe/following{/other_user}","gists_url":"https://api.github.com/users/alvarowe/gists{/gist_id}","starred_url":"https://api.github.com/users/alvarowe/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alvarowe/subscriptions","organizations_url":"https://api.github.com/users/alvarowe/orgs","repos_url":"https://api.github.com/users/alvarowe/repos","events_url":"https://api.github.com/users/alvarowe/events{/privacy}","received_events_url":"https://api.github.com/users/alvarowe/received_events","type":"User","site_admin":false},"created_at":"2015-05-21T06:39:01Z","updated_at":"2015-05-21T06:39:01Z","body":":(\r\nSo the 405 Waf-fle response code ir right that ? What is exactly the reason if you know? I mean, the code does not seem quite difficult to hack .... I'll try and have a look at it to see If I could do something\r\n\r\nAnyway  I'll try Apache and wait for the php-fpm "}}