WPF2B_EVENT_WAF_ERROR

WAF error.

Premium only

Premium listener: WPF2B_EVENT_WAF_ERROR.

Premium emits this event when SQL injection analysis cannot determine whether request input changed the SQL structure. The query continues; this event establishes neither a SQL injection detection nor a clean query.

syslog	Facility	WP_FAIL2BAN_EX_WAF_LOG
	Level	WARNING
	Prefix	`WAF[error]`

WAF messages use WAF[blocked] when enforcing a block, WAF[detected] in logging-only mode, and WAF[error] for diagnostic errors. All use WARNING. The shipped WAF filter matches blocked messages only.

Premium records the available raw request body and HTTP headers with every WAF event, independently of the general extra-field controls; see Privacy and stored data and Using Premium event history.

EventData waf_data contains msg with the analysis error and sql with the full query. The query can contain credentials or other sensitive information.