概述docker-compose.yml中使用了volume好处是首次启动时会自动拷贝容器内挂载内容到卷中并持久化坏处是持续化卷的路径不好找。以下记录查找方式docker-compose.yaml配置docker-compose.yml中定义的卷和挂载路径services:wazuh.manager:volumes:-wazuh_api_configuration:/var/ossec/api/configuration-wazuh_etc:/var/ossec/etc-wazuh_logs:/var/ossec/logs-wazuh_queue:/var/ossec/queue-wazuh_var_multigroups:/var/ossec/var/multigroups-wazuh_integrations:/var/ossec/integrations-wazuh_active_response:/var/ossec/active-response/bin-wazuh_agentless:/var/ossec/agentless-wazuh_wodles:/var/ossec/wodles-filebeat_etc:/etc/filebeat-filebeat_var:/var/lib/filebeatvolumes:wazuh_etc:wazuh_logs:wazuh_queue:wazuh_var_multigroups:wazuh_integrations:wazuh_active_response:wazuh_agentless:wazuh_wodles:filebeat_etc:查看卷全称dockervolumels|grepwazuh_etclocalsingle-node_wazuh_etc查看卷存储路径dockervolume inspect single-node_wazuh_etc--format{{.Mountpoint}}/var/lib/docker/volumes/single-node_wazuh_etc/_datacd/var/lib/docker/volumes/single-node_wazuh_etc/_datalsclient.keys internal_options.conf local_internal_options.conf ossec.conf rules sslmanager.cert decoders lists localtime rootcheck shared sslmanager.key修卷中文件内容编辑文件vimossec.conflogallyes/logall修改为yes开启归档日志logall_jsonyes/logall_json修改为yes开启归档日志ossec_configglobaljsonout_outputyes/jsonout_outputalerts_logyes/alerts_loglogallyes/logalllogall_jsonyes/logall_json进入容器内查看dockerexec-itsingle-node-wazuh.manager-1bashcat/var/ossec/etc/ossec.conf退出容器重启生效dockerrestart single-node-wazuh.manager-1重启后进入容器检查配置已经生效可以记录归档文件dockerexec-itsingle-node-wazuh.manager-1bashbash-5.2# tail -n 20 /var/ossec/logs/archives/archives.json | grep -i modsec\|942100{timestamp:2026-10-10T12:00:18.0480000,rule:{level:2,description:Unknown problem somewhere in the system.,id:1002,firedtimes:1,mail:false,groups:[syslog,errors],gpg13:[4.3]},agent:{id:002,name:waf_172-26-1-7,ip:172.26.1.7},manager:{name:wazuh.manager},id:1791633618.1413009,full_log:{\transaction\:{\client_ip\:\221.217.50.142\,\time_stamp\:\Sat Oct 10 12:00:17 2026\,\server_id\:\37844f4e6fa9765dfd28a21e2715d4a91ecb9906\,\client_port\:62066,\host_ip\:\172.18.0.2\,\host_port\:443,\unique_id\:\179163361754.947795\,\is_interrupted\:false,\request\:{\method\:\GET\,\http_version\:\1.1\,\hostname\:\www.test.com\,\uri\:\/?id1%27OR%271%27%3D%271\,\headers\:{\Host\:\www.test.com\,\User-Agent\:\curl/8.21.0\,\Accept\:\*/*\}},\response\:{\http_code\:200,\headers\:{\Referrer-Policy\:\no-referrer\,\Accept-Ranges\:\bytes\,\ETag\:\\\\6ac98fb7-15ab\\\\,\Last-Modified\:\Sat, 10 Oct 2026 01:07:03 GMT\,\Last-Modified\:\Sat, 10 Oct 2026 01:07:03 GMT\,\Vary\:\Accept-Encoding\,\Connection\:\keep-alive\,\Content-Type\:\text/html; charsetutf-8\,\Content-Length\:\5547\,\Date\:\Sat, 10 Oct 2026 12:00:17 GMT\,\Server\:\nginx\,\Server\:\nginx\}},\producer\:{\modsecurity\:\ModSecurity v3.0.16 (Linux)\,\connector\:\ModSecurity-nginx v1.0.4\,\secrules_engine\:\DetectionOnly\,\components\:[\OWASP_CRS/3.3.10\\\\]},\messages\:[{\message\:\SQL Injection Attack Detected via libinjection\,\details\:{\match\:\detected SQLi using libinjection.\,\reference\:\v9,12\,\ruleId\:\942100\,\file\:\/etc/modsecurity.d/owasp-crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf\,\lineNumber\:\46\,\data\:\Matched Data: ssos found within ARGS:id: 1 OR 11\,\severity\:\2\,\ver\:\OWASP_CRS/3.3.10\,\rev\:\\,\tags\:[\application-multi\,\language-multi\,\platform-multi\,\attack-sqli\,\paranoia-level/1\,\OWASP_CRS\,\capec/1000/152/248/66\,\PCI/6.5.2\],\maturity\:\0\,\accuracy\:\0\}},{\message\:\Inbound Anomaly Score Exceeded (Total Score: 5)\,\details\:{\match\:\Matched\\\OperatorGe with parameter5 against variableTX:ANOMALY_SCORE(Value:5 )\,\reference\:\\,\ruleId\:\949110\,\file\:\/etc/modsecurity.d/owasp-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf\,\lineNumber\:\81\,\data\:\\,\severity\:\2\,\ver\:\OWASP_CRS/3.3.10\,\rev\:\\,\tags\:[\modsecurity\,\application-multi\,\language-multi\,\platform-multi\,\attack-generic\],\maturity\:\0\,\accuracy\:\0\}}]}},decoder:{name:json},data:{transaction:{client_ip:221.217.50.142,time_stamp:Sat Oct 10 12:00:17 2026,server_id:37844f4e6fa9765dfd28a21e2715d4a91ecb9906,client_port:62066,host_ip:172.18.0.2,host_port:443,unique_id:179163361754.947795,is_interrupted:false,request:{method:GET,http_version:1.1,hostname:www.test.com,uri:/?id1%27OR%271%27%3D%271,headers:{Host:www.test.com,User-Agent:curl/8.21.0,Accept:*/*}},response:{http_code:200,headers:{Referrer-Policy:no-referrer,Accept-Ranges:bytes,ETag:\6ac98fb7-15ab\,Last-Modified:Sat, 10 Oct 2026 01:07:03 GMT,Vary:Accept-Encoding,Connection:keep-alive,Content-Type:text/html; charsetutf-8,Content-Length:5547,Date:Sat, 10 Oct 2026 12:00:17 GMT,Server:nginx}},producer:{modsecurity:ModSecurity v3.0.16 (Linux),connector:ModSecurity-nginx v1.0.4,secrules_engine:DetectionOnly,components:[OWASP_CRS/3.3.10\]},messages:[{message:SQL Injection Attack Detected via libinjection,details:{match:detected SQLi using libinjection.,reference:v9,12,ruleId:942100,file:/etc/modsecurity.d/owasp-crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf,lineNumber:46,data:Matched Data: ssos found within ARGS:id: 1 OR 11,severity:2,ver:OWASP_CRS/3.3.10,rev:,tags:[application-multi,language-multi,platform-multi,attack-sqli,paranoia-level/1,OWASP_CRS,capec/1000/152/248/66,PCI/6.5.2],maturity:0,accuracy:0}},{message:Inbound Anomaly Score Exceeded (Total Score: 5),details:{match:Matched\OperatorGe with parameter5 against variableTX:ANOMALY_SCORE(Value:5 ),reference:,ruleId:949110,file:/etc/modsecurity.d/owasp-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf,lineNumber:81,data:,severity:2,ver:OWASP_CRS/3.3.10,rev:,tags:[modsecurity,application-multi,language-multi,platform-multi,attack-generic],maturity:0,accuracy:0}}]}},location:/var/log/nginx/modsec_audit.log}