[webizen]

Originally Posted by JasonWSInc

Audit logging is enabled, as seen in the screenshots I attached. That's how I know it's not working as expected. These rules are being triggered even though they're suppose to pass.

Sorry for the confusion. Yes, you may put 'log,' in the override rule to update audit log.

tested on ubuntu 11.10 64bit env in our lab. override rules are in effect: when 'pass' is used, no blockage.

btw, are you using lsws native vhost or you have apache vhost in httpd.conf?