How to get mod_security to log all POST data?
Solution 1:
Have a rule which turns on the AuditEngine for POST requests.
Something like this (untested):
SecRule REQUEST_METHOD "POST" "id:1000,phase:2,ctl:auditEngine=On,nolog,pass"
Ctl actions only affect the current request so afterwards it will reset back to RelevantOnly for the next request.
You can also create Sanitise rules to ensure sensitive data like passwords and credit card data is masked before logging. See here: https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#sanitiseArg