# Modsecurity parser failures

**URL:** <https://discourse.crowdsec.net/t/modsecurity-parser-failures/2154>\
**Category:** crowdsec\
**Created:** [November 26, 2024, 10:50am UTC](https://discourse.crowdsec.net/t/modsecurity-parser-failures/2154 "2024-11-26T10:50:30Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![moloch](https://avatars.discourse-cdn.com/v4/letter/m/2bfe46/32.png) [@moloch](https://discourse.crowdsec.net/u/moloch)\
**Post date:** [November 26, 2024, 10:50am UTC](https://discourse.crowdsec.net/t/modsecurity-parser-failures/2154/1 "2024-11-26T10:50:30Z")

</div>

Hi, I have some problems with the modsecurity parser.  
My setup seems ok but I always get zero parsed lines from log analysis even with modsecurity critical notification.  
My acquis.yaml file:

```auto
filenames:
  - /var/log/apache2/error.log
labels:
  type: modsecurity
---

```

```auto
Parser metrics:
Parsers │ Hits │ Parsed │ Unparsed │
├──────────────────────────────────┼────────┼────────┼──────────┤
│ child-crowdsecurity/apache2-logs │ 8.54k │ 7.04k │ 1.50k │
│ child-crowdsecurity/http-logs │ 21.12k │ 16.88k │ 4.24k │
│ child-crowdsecurity/modsecurity │ 3.00k │ - │ 3.00k │
│ child-crowdsecurity/syslog-logs │ 9.96k │ 9.96k │ - │
│ crowdsecurity/apache2-logs │ 7.04k │ 7.04k │ - │
│ crowdsecurity/cdn-whitelist │ 1 │ 1 │ - │
│ crowdsecurity/dateparse-enrich │ 7.04k │ 7.04k │ - │
│ crowdsecurity/geoip-enrich │ 7.04k │ 7.04k │ - │
│ crowdsecurity/http-logs │ 7.04k │ 5.48k │ 1.56k │
│ crowdsecurity/modsecurity │ 1.50k │ - │ 1.50k │
│ crowdsecurity/non-syslog │ 8.54k │ 8.54k │ - │
│ crowdsecurity/rdns │ 1 │ 1 │ - │
│ crowdsecurity/seo-bots-whitelist │ 1 │ 1 │ - │
│ crowdsecurity/syslog-logs │ 9.96k │ 9.96k │ - │
│ crowdsecurity/whitelists │ 7.04k │ 7.04k │ - │

```

What am I doing wrong?  
Thank you

---

<div class="post-metadata">

**Author:** ![moloch](https://avatars.discourse-cdn.com/v4/letter/m/2bfe46/32.png) [@moloch](https://discourse.crowdsec.net/u/moloch)\
**Post date:** [December 2, 2024, 11:20am UTC](https://discourse.crowdsec.net/t/modsecurity-parser-failures/2154/2 "2024-12-02T11:20:28Z")

</div>

Does anyone use the parser for modsecurity?