Using 'deprecatevar' on multiple variables in a collection

Hello everyone,

I'm having trouble using the 'deprecatevar' action on multiple variables in
the same collection. If *one* of the variables is constantly being updated
it appears to prevent *all* of the variables from being decremented, even
if every other variable is idle.

The context of this is writing a rule set to rate limit per-IP address
based on several different factors:

* How many GET requests have been made to URL 1;
* How many POST requests have been made to URL 2;
* How many ‘failed login’ responses have been observed from the application
server.

I'm using three variables in the IP collection along with three thresholds
and block flags, which works nicely.

The problem is I can't make the deprecatevar action work to decrement all
three variables over time. For example, if the 'GET request' counter is
busy and being increased several times per second then it prevents all of
the counter variables from decrementing.

Does the deprecatevar action work based on the last time that *anything* in
a given collection was updated? I originally thought it worked per-variable
but now I'm not so sure.

I could try using a separate collection to hold each counter variable, but
that restricts me to a maximum of five counters (for the five predefined
collections). I think I'll need more than five counters per-IP address for
this whole project.

Is there a better solution to this problem? Have I missed or misunderstood
anything?


A big thanks to everyone who is active on this mailing list: it's a treat
to read and learn from your experiences, so thank you all.

Thanks,
Andrew

-- 
Andrew Howe

Loadbalancer.org Ltd.
www.loadbalancer.org <https://www.loadbalancer.org/?gclid=ES2017>

  <https://plus.google.com/+LoadbalancerOrg>
<https://twitter.com/loadbalancerorg>
<http://www.linkedin.com/company/3191352?trk=prof-exp-company-name>
<https://www.loadbalancer.org/?category=company&post-name=overview&?gclid=ES2017>
<https://www.loadbalancer.org/?gclid=ES2017>
+1 888 867 9504 / +44 (0)330 380 1064
[email protected]

LEAVE A REVIEW
<http://collector.reviews.io/loadbalancer-org-inc-/new-review> | DEPLOYMENT
GUIDES
<https://www.loadbalancer.org/?category=resources&post-name=deployment-guides&?gclid=ES2017>
 | BLOG <https://www.loadbalancer.org/blog/?gclid=ES2017>

_______________________________________________
mod-security-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/