title: ModSecurity default installation running on IIS 10.0 with CRS rule set generating a lot of errors
body: <p>I have just installed ModSecurity on IIS 10.0 running on Windows 10. However even a "clean" install generates a lot of errors only by visiting the default IIS site.</p>
  
  <p>By looking at <code>eventvwr</code> and making a single request I get a total of 14 new errors for a GET request to <code>localhost</code>.</p>
  
  <p>Every event has the following description: </p>
  
  <blockquote>
    <p>The description for Event ID 1 from source ModSecurity cannot be
    found. Either the component that raises this event is not installed on
    your local computer or the installation is corrupted. You can install
    or repair the component on the local computer.</p>
    
    <p>If the event originated on another computer, the display information
    had to be saved with the event.</p>
    
    <p>The following information was included with the event:</p>
  </blockquote>
  
  <p>Eventdata:</p>
  
  <pre><code>[client ] ModSecurity: IPmatch: bad IPv4 specification "". [hostname "HOSTNAME"] [uri "/"] [unique_id "18158513704000290822"]
  
  [client ] ModSecurity: Rule processing failed. [hostname "HOSTNAME"] [uri "/"] [unique_id "18158513704000290822"]
  
  [client ] ModSecurity: Rule 15448555590 [id "981172"][file "C:\/Program Files/ModSecurity IIS/owasp_crs/base_rules/modsecurity_crs_41_sql_injection_attacks.conf"][line "157"] - Execution error - PCRE limits exceeded (-8): (null). [hostname "HOSTNAME"] [uri "/"] [unique_id "18158513704000290822"]
  
  [client ] ModSecurity: Rule 154485cd4a0 [id "981243"][file "C:\/Program Files/ModSecurity IIS/owasp_crs/base_rules/modsecurity_crs_41_sql_injection_attacks.conf"][line "245"] - Execution error - PCRE limits exceeded (-8): (null). [hostname "HOSTNAME"] [uri "/"] [unique_id "18158513704000290822"]
  
  [client ] ModSecurity: IPmatch: bad IPv4 specification "". [hostname "HOSTNAME"] [uri "/"] [unique_id "18158513704000290822"]
  
  [client ] ModSecurity: Rule processing failed. [hostname "HOSTNAME"] [uri "/"] [unique_id "18158513704000290822"]
  
  [client ] ModSecurity: Rule 15448555590 [id "981172"][file "C:\/Program Files/ModSecurity IIS/owasp_crs/base_rules/modsecurity_crs_41_sql_injection_attacks.conf"][line "157"] - Execution error - PCRE limits exceeded (-8): (null). [hostname "HOSTNAME"] [uri "/"] [unique_id "18158513704000290822"]
  
  [client ] ModSecurity: Rule 154485cd4a0 [id "981243"][file "C:\/Program Files/ModSecurity IIS/owasp_crs/base_rules/modsecurity_crs_41_sql_injection_attacks.conf"][line "245"] - Execution error - PCRE limits exceeded (-8): (null). [hostname "HOSTNAME"] [uri "/"] [unique_id "18158513704000290822"]
  
  [client ] ModSecurity: Rule 15448555590 [id "981172"][file "C:\/Program Files/ModSecurity IIS/owasp_crs/base_rules/modsecurity_crs_41_sql_injection_attacks.conf"][line "157"] - Execution error - PCRE limits exceeded (-8): (null). [hostname "HOSTNAME"] [uri "/iisstart.htm"] [unique_id "18158513704000290822"]
  
  [client ] ModSecurity: Rule 154485cd4a0 [id "981243"][file "C:\/Program Files/ModSecurity IIS/owasp_crs/base_rules/modsecurity_crs_41_sql_injection_attacks.conf"][line "245"] - Execution error - PCRE limits exceeded (-8): (null). [hostname "HOSTNAME"] [uri "/iisstart.htm"] [unique_id "18158513704000290822"]
  
  [client ] ModSecurity: collections_remove_stale: Failed to access DBM file "C:/inetpub/temp/ip": Access is denied. [hostname "HOSTNAME"] [uri "/iisstart.htm"] [unique_id "18158513704000290822"]
  
  [client ] ModSecurity: collections_remove_stale: Failed to access DBM file "C:/inetpub/temp/global": Access is denied. [hostname "HOSTNAME"] [uri "/iisstart.htm"] [unique_id "18158513704000290822"]
  
  [client ] ModSecurity: Rule 15448555590 [id "981172"][file "C:\/Program Files/ModSecurity IIS/owasp_crs/base_rules/modsecurity_crs_41_sql_injection_attacks.conf"][line "157"] - Execution error - PCRE limits exceeded (-8): (null). [hostname "HOSTNAME"] [uri "/iisstart.png"] [unique_id "18158513704000290823"]
  
  [client ] ModSecurity: Rule 154485cd4a0 [id "981243"][file "C:\/Program Files/ModSecurity IIS/owasp_crs/base_rules/modsecurity_crs_41_sql_injection_attacks.conf"][line "245"] - Execution error - PCRE limits exceeded (-8): (null). [hostname "HOSTNAME"] [uri "/iisstart.png"] [unique_id "18158513704000290823"]
  </code></pre>
  
  <p>What I have done:</p>
  
  <p>Installed <a href="https://modsecurity.org/download.html" rel="nofollow noreferrer">ModSecurity v2.9.1 for IIS MSI Installer - 64bits</a> and Visual Studio 2013 Runtime (vcredist). </p>
  
  <p>Downloaded OWASP ModSecurity Core Rule Set (CRS) from <a href="https://github.com/SpiderLabs/owasp-modsecurity-crs" rel="nofollow noreferrer">https://github.com/SpiderLabs/owasp-modsecurity-crs</a> and put the folder in <code>C:\Program Files\ModSecurity IIS</code>. Changed the name <code>crs-setup.conf.example</code> to <code>crs-setup.conf</code>. </p>
  
  <p>Under <code>\rules</code> I changed <code>REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf.example</code> and <code>RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf.example</code> to not contain <code>.example</code>.</p>
  
  <p>Modified <code>modsecurity_iis.conf</code> to the following:</p>
  
  <pre><code>Include modsecurity.conf
  Include modsecurity_crs_10_setup.conf
  Include owasp_crs\base_rules\*.conf
  #OWASP-Rules
  include owasp-modsecurity-crs/crs-setup.conf
  include owasp-modsecurity-crs/rules/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf
  include owasp-modsecurity-crs/rules/REQUEST-901-INITIALIZATION.conf
  include owasp-modsecurity-crs/rules/REQUEST-905-COMMON-EXCEPTIONS.conf
  include owasp-modsecurity-crs/rules/REQUEST-910-IP-REPUTATION.conf
  include owasp-modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf
  include owasp-modsecurity-crs/rules/REQUEST-912-DOS-PROTECTION.conf
  include owasp-modsecurity-crs/rules/REQUEST-913-SCANNER-DETECTION.conf
  include owasp-modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf
  include owasp-modsecurity-crs/rules/REQUEST-921-PROTOCOL-ATTACK.conf
  include owasp-modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf
  include owasp-modsecurity-crs/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf
  include owasp-modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf
  include owasp-modsecurity-crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf
  include owasp-modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf
  include owasp-modsecurity-crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf
  include owasp-modsecurity-crs/rules/REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION.conf
  include owasp-modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf
  include owasp-modsecurity-crs/rules/RESPONSE-950-DATA-LEAKAGES.conf
  include owasp-modsecurity-crs/rules/RESPONSE-951-DATA-LEAKAGES-SQL.conf
  include owasp-modsecurity-crs/rules/RESPONSE-952-DATA-LEAKAGES-JAVA.conf
  include owasp-modsecurity-crs/rules/RESPONSE-953-DATA-LEAKAGES-PHP.conf
  include owasp-modsecurity-crs/rules/RESPONSE-954-DATA-LEAKAGES-IIS.conf
  include owasp-modsecurity-crs/rules/RESPONSE-959-BLOCKING-EVALUATION.conf
  include owasp-modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf
  include owasp-modsecurity-crs/rules/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf
  </code></pre>
  
  <p>Restarted IIS and then checked Event Viewer. What have I missed or is this normal behavior?</p>