On this page

OSSEC / HIDS Rule 30117

OSSEC / HIDS rule catalog

  • Rule family: OSSEC / HIDS
  • Rule ID: 30117
  • Definition status: Present in current source
  • Alert message / subject: Apache: Invalid URI, file name too long.
  • Rule level: 10
  • Definition checked: 2026-10-21

Interpretation and response

This event is recorded as “Apache: Invalid URI, file name too long.” Review the originating log and the affected host or service to determine whether the activity was expected.

An OSSEC/HIDS event records or correlates activity. Blocking depends on the originating application and any separately configured Active Response policy; an alert alone does not prove that an attack was blocked.

Documentation

The following guidance was migrated from the historical wiki and reviewed against the rule definition. Legacy ASL product names and interface instructions refer to the versions documented then. Use the current metadata above and your installed configuration when interpreting thresholds, notification settings and response behavior.

Description

This event is not caused by the rules, ASL or modsecurity. This rule simply reports when apache reports a critical error with a request. Specifically, this error is generated by apache when a URI exceeds the limit set in Apache. By default, Apache sets a limit on URIs of 8190 characters. Any request over this limit will be rejected by Apache.

Please see the Tuning Guidance below for assistance with changing this limit in Apache.

This rule does not cause this error, therefore disabling this rule will not prevent apache from rejecting these requests, nor will it prevent apache from reporting these errors. This is just a reporting rule that reports when apache has rejected the request. The rule does not cause this event, it simply reports it.

Troubleshooting

False Positives

None. This rule is not generated by ASL. This is a reporting rule, it simply reports when Apache generates this error.

Tuning Guidance

Please contact your Apache vendor for assistance with increasing URI limits. In general, it is recommended by web server vendors that you use POST requests and HTTP bodies for large requests, and not use large GET request URIs. The information provided below is provide as a courtesy for our customers. If you have issues with increasing the URI limit in Apache, please contact your Apache vendor.

To increase the limit in Apache, you can change the LimitRequestLine variable to a larger number, as documented in the Apache configuration documentation for Apache 2.2 at the URL below:

https://httpd.apache.org/docs/2.2/mod/core.html#limitrequestline

And for Apache 2.4 at the URL below:

https://httpd.apache.org/docs/2.4/mod/core.html#limitrequestline

Source and revision

Migrated from HIDS_30117, wiki page 423, revision 2896 (20121125). Documentation review: 2026-10-21. An archived wiki status of Active is not a current deployment status.

For assistance, provide the rule ID, installed product and rule version, and a sanitized event to Atomicorp support .