Adding upstream version 11.74.upstream/11.74upstream

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

22 files changed, 11966 insertions, 0 deletions

diff --git a/tools/src/Makefile.am b/tools/src/Makefile.am
new file mode 100644
index 0000000..489a69a
--- /dev/null
+++ b/tools/src/Makefile.am
@@ -0,0 +1,49 @@
+# $Id: Makefile.am 2486 2018-09-03 20:22:17Z pbuchbinder $
+
+bin_PROGRAMS=qsfilter2 qslog qspng qsrotate qssign qstail qshead qsgrep qsexec qscheck qsgeo qslogger qsdt qsrespeed qsre
+
+qsfilter2_SOURCES= \
+	qsfilter2.c qs_util.c
+
+qslog_SOURCES= \
+	qslog.c qs_util.c
+
+qspng_SOURCES= \
+	qspng.c qs_util.c
+
+qsrotate_SOURCES= \
+	qsrotate.c qs_util.c
+
+qssign_SOURCES= \
+	qssign.c qs_util.c qs_apo.c
+
+qstail_SOURCES= \
+	qstail.c qs_util.c
+
+qshead_SOURCES= \
+	qshead.c qs_util.c
+
+qsgrep_SOURCES= \
+	qsgrep.c qs_util.c
+
+qsexec_SOURCES= \
+	qsexec.c qs_util.c
+
+qscheck_SOURCES= \
+	qscheck.c qs_util.c
+
+qsgeo_SOURCES= \
+	qsgeo.c qs_util.c
+
+qslogger_SOURCES= \
+	qslogger.c qs_util.c
+
+qsdt_SOURCES= \
+	qsdt.c qs_util.c
+
+qsrespeed_SOURCES= \
+	qsrespeed.c qs_util.c
+
+qsre_SOURCES= \
+	qsre.c qs_util.c
+
diff --git a/tools/src/Makefile.in b/tools/src/Makefile.in
new file mode 100644
index 0000000..18daa12
--- /dev/null
+++ b/tools/src/Makefile.in
@@ -0,0 +1,734 @@
+# Makefile.in generated by automake 1.15 from Makefile.am.
+# @configure_input@
+
+# Copyright (C) 1994-2014 Free Software Foundation, Inc.
+
+# This Makefile.in is free software; the Free Software Foundation
+# gives unlimited permission to copy and/or distribute it,
+# with or without modifications, as long as this notice is preserved.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY, to the extent permitted by law; without
+# even the implied warranty of MERCHANTABILITY or FITNESS FOR A
+# PARTICULAR PURPOSE.
+
+@SET_MAKE@
+
+# $Id: Makefile.am 2486 2018-09-03 20:22:17Z pbuchbinder $
+
+VPATH = @srcdir@
+am__is_gnu_make = { \
+  if test -z '$(MAKELEVEL)'; then \
+    false; \
+  elif test -n '$(MAKE_HOST)'; then \
+    true; \
+  elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \
+    true; \
+  else \
+    false; \
+  fi; \
+}
+am__make_running_with_option = \
+  case $${target_option-} in \
+      ?) ;; \
+      *) echo "am__make_running_with_option: internal error: invalid" \
+              "target option '$${target_option-}' specified" >&2; \
+         exit 1;; \
+  esac; \
+  has_opt=no; \
+  sane_makeflags=$$MAKEFLAGS; \
+  if $(am__is_gnu_make); then \
+    sane_makeflags=$$MFLAGS; \
+  else \
+    case $$MAKEFLAGS in \
+      *\\[\ \	]*) \
+        bs=\\; \
+        sane_makeflags=`printf '%s\n' "$$MAKEFLAGS" \
+          | sed "s/$$bs$$bs[$$bs $$bs	]*//g"`;; \
+    esac; \
+  fi; \
+  skip_next=no; \
+  strip_trailopt () \
+  { \
+    flg=`printf '%s\n' "$$flg" | sed "s/$$1.*$$//"`; \
+  }; \
+  for flg in $$sane_makeflags; do \
+    test $$skip_next = yes && { skip_next=no; continue; }; \
+    case $$flg in \
+      *=*|--*) continue;; \
+        -*I) strip_trailopt 'I'; skip_next=yes;; \
+      -*I?*) strip_trailopt 'I';; \
+        -*O) strip_trailopt 'O'; skip_next=yes;; \
+      -*O?*) strip_trailopt 'O';; \
+        -*l) strip_trailopt 'l'; skip_next=yes;; \
+      -*l?*) strip_trailopt 'l';; \
+      -[dEDm]) skip_next=yes;; \
+      -[JT]) skip_next=yes;; \
+    esac; \
+    case $$flg in \
+      *$$target_option*) has_opt=yes; break;; \
+    esac; \
+  done; \
+  test $$has_opt = yes
+am__make_dryrun = (target_option=n; $(am__make_running_with_option))
+am__make_keepgoing = (target_option=k; $(am__make_running_with_option))
+pkgdatadir = $(datadir)/@PACKAGE@
+pkgincludedir = $(includedir)/@PACKAGE@
+pkglibdir = $(libdir)/@PACKAGE@
+pkglibexecdir = $(libexecdir)/@PACKAGE@
+am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
+install_sh_DATA = $(install_sh) -c -m 644
+install_sh_PROGRAM = $(install_sh) -c
+install_sh_SCRIPT = $(install_sh) -c
+INSTALL_HEADER = $(INSTALL_DATA)
+transform = $(program_transform_name)
+NORMAL_INSTALL = :
+PRE_INSTALL = :
+POST_INSTALL = :
+NORMAL_UNINSTALL = :
+PRE_UNINSTALL = :
+POST_UNINSTALL = :
+bin_PROGRAMS = qsfilter2$(EXEEXT) qslog$(EXEEXT) qspng$(EXEEXT) \
+	qsrotate$(EXEEXT) qssign$(EXEEXT) qstail$(EXEEXT) \
+	qshead$(EXEEXT) qsgrep$(EXEEXT) qsexec$(EXEEXT) \
+	qscheck$(EXEEXT) qsgeo$(EXEEXT) qslogger$(EXEEXT) \
+	qsdt$(EXEEXT) qsrespeed$(EXEEXT) qsre$(EXEEXT)
+subdir = src
+ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
+am__aclocal_m4_deps = $(top_srcdir)/configure.ac
+am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
+	$(ACLOCAL_M4)
+DIST_COMMON = $(srcdir)/Makefile.am $(am__DIST_COMMON)
+mkinstalldirs = $(install_sh) -d
+CONFIG_HEADER = $(top_builddir)/config.h
+CONFIG_CLEAN_FILES =
+CONFIG_CLEAN_VPATH_FILES =
+am__installdirs = "$(DESTDIR)$(bindir)"
+PROGRAMS = $(bin_PROGRAMS)
+am_qscheck_OBJECTS = qscheck.$(OBJEXT) qs_util.$(OBJEXT)
+qscheck_OBJECTS = $(am_qscheck_OBJECTS)
+qscheck_LDADD = $(LDADD)
+am_qsdt_OBJECTS = qsdt.$(OBJEXT) qs_util.$(OBJEXT)
+qsdt_OBJECTS = $(am_qsdt_OBJECTS)
+qsdt_LDADD = $(LDADD)
+am_qsexec_OBJECTS = qsexec.$(OBJEXT) qs_util.$(OBJEXT)
+qsexec_OBJECTS = $(am_qsexec_OBJECTS)
+qsexec_LDADD = $(LDADD)
+am_qsfilter2_OBJECTS = qsfilter2.$(OBJEXT) qs_util.$(OBJEXT)
+qsfilter2_OBJECTS = $(am_qsfilter2_OBJECTS)
+qsfilter2_LDADD = $(LDADD)
+am_qsgeo_OBJECTS = qsgeo.$(OBJEXT) qs_util.$(OBJEXT)
+qsgeo_OBJECTS = $(am_qsgeo_OBJECTS)
+qsgeo_LDADD = $(LDADD)
+am_qsgrep_OBJECTS = qsgrep.$(OBJEXT) qs_util.$(OBJEXT)
+qsgrep_OBJECTS = $(am_qsgrep_OBJECTS)
+qsgrep_LDADD = $(LDADD)
+am_qshead_OBJECTS = qshead.$(OBJEXT) qs_util.$(OBJEXT)
+qshead_OBJECTS = $(am_qshead_OBJECTS)
+qshead_LDADD = $(LDADD)
+am_qslog_OBJECTS = qslog.$(OBJEXT) qs_util.$(OBJEXT)
+qslog_OBJECTS = $(am_qslog_OBJECTS)
+qslog_LDADD = $(LDADD)
+am_qslogger_OBJECTS = qslogger.$(OBJEXT) qs_util.$(OBJEXT)
+qslogger_OBJECTS = $(am_qslogger_OBJECTS)
+qslogger_LDADD = $(LDADD)
+am_qspng_OBJECTS = qspng.$(OBJEXT) qs_util.$(OBJEXT)
+qspng_OBJECTS = $(am_qspng_OBJECTS)
+qspng_LDADD = $(LDADD)
+am_qsre_OBJECTS = qsre.$(OBJEXT) qs_util.$(OBJEXT)
+qsre_OBJECTS = $(am_qsre_OBJECTS)
+qsre_LDADD = $(LDADD)
+am_qsrespeed_OBJECTS = qsrespeed.$(OBJEXT) qs_util.$(OBJEXT)
+qsrespeed_OBJECTS = $(am_qsrespeed_OBJECTS)
+qsrespeed_LDADD = $(LDADD)
+am_qsrotate_OBJECTS = qsrotate.$(OBJEXT) qs_util.$(OBJEXT)
+qsrotate_OBJECTS = $(am_qsrotate_OBJECTS)
+qsrotate_LDADD = $(LDADD)
+am_qssign_OBJECTS = qssign.$(OBJEXT) qs_util.$(OBJEXT) \
+	qs_apo.$(OBJEXT)
+qssign_OBJECTS = $(am_qssign_OBJECTS)
+qssign_LDADD = $(LDADD)
+am_qstail_OBJECTS = qstail.$(OBJEXT) qs_util.$(OBJEXT)
+qstail_OBJECTS = $(am_qstail_OBJECTS)
+qstail_LDADD = $(LDADD)
+AM_V_P = $(am__v_P_@AM_V@)
+am__v_P_ = $(am__v_P_@AM_DEFAULT_V@)
+am__v_P_0 = false
+am__v_P_1 = :
+AM_V_GEN = $(am__v_GEN_@AM_V@)
+am__v_GEN_ = $(am__v_GEN_@AM_DEFAULT_V@)
+am__v_GEN_0 = @echo "  GEN     " $@;
+am__v_GEN_1 = 
+AM_V_at = $(am__v_at_@AM_V@)
+am__v_at_ = $(am__v_at_@AM_DEFAULT_V@)
+am__v_at_0 = @
+am__v_at_1 = 
+DEFAULT_INCLUDES = -I.@am__isrc@ -I$(top_builddir)
+depcomp = $(SHELL) $(top_srcdir)/depcomp
+am__depfiles_maybe = depfiles
+am__mv = mv -f
+COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
+	$(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
+AM_V_CC = $(am__v_CC_@AM_V@)
+am__v_CC_ = $(am__v_CC_@AM_DEFAULT_V@)
+am__v_CC_0 = @echo "  CC      " $@;
+am__v_CC_1 = 
+CCLD = $(CC)
+LINK = $(CCLD) $(AM_CFLAGS) $(CFLAGS) $(AM_LDFLAGS) $(LDFLAGS) -o $@
+AM_V_CCLD = $(am__v_CCLD_@AM_V@)
+am__v_CCLD_ = $(am__v_CCLD_@AM_DEFAULT_V@)
+am__v_CCLD_0 = @echo "  CCLD    " $@;
+am__v_CCLD_1 = 
+SOURCES = $(qscheck_SOURCES) $(qsdt_SOURCES) $(qsexec_SOURCES) \
+	$(qsfilter2_SOURCES) $(qsgeo_SOURCES) $(qsgrep_SOURCES) \
+	$(qshead_SOURCES) $(qslog_SOURCES) $(qslogger_SOURCES) \
+	$(qspng_SOURCES) $(qsre_SOURCES) $(qsrespeed_SOURCES) \
+	$(qsrotate_SOURCES) $(qssign_SOURCES) $(qstail_SOURCES)
+DIST_SOURCES = $(qscheck_SOURCES) $(qsdt_SOURCES) $(qsexec_SOURCES) \
+	$(qsfilter2_SOURCES) $(qsgeo_SOURCES) $(qsgrep_SOURCES) \
+	$(qshead_SOURCES) $(qslog_SOURCES) $(qslogger_SOURCES) \
+	$(qspng_SOURCES) $(qsre_SOURCES) $(qsrespeed_SOURCES) \
+	$(qsrotate_SOURCES) $(qssign_SOURCES) $(qstail_SOURCES)
+am__can_run_installinfo = \
+  case $$AM_UPDATE_INFO_DIR in \
+    n|no|NO) false;; \
+    *) (install-info --version) >/dev/null 2>&1;; \
+  esac
+am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP)
+# Read a list of newline-separated strings from the standard input,
+# and print each of them once, without duplicates.  Input order is
+# *not* preserved.
+am__uniquify_input = $(AWK) '\
+  BEGIN { nonempty = 0; } \
+  { items[$$0] = 1; nonempty = 1; } \
+  END { if (nonempty) { for (i in items) print i; }; } \
+'
+# Make sure the list of sources is unique.  This is necessary because,
+# e.g., the same source file might be shared among _SOURCES variables
+# for different programs/libraries.
+am__define_uniq_tagged_files = \
+  list='$(am__tagged_files)'; \
+  unique=`for i in $$list; do \
+    if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
+  done | $(am__uniquify_input)`
+ETAGS = etags
+CTAGS = ctags
+am__DIST_COMMON = $(srcdir)/Makefile.in $(top_srcdir)/depcomp
+DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
+ACLOCAL = @ACLOCAL@
+AMTAR = @AMTAR@
+AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@
+AUTOCONF = @AUTOCONF@
+AUTOHEADER = @AUTOHEADER@
+AUTOMAKE = @AUTOMAKE@
+AWK = @AWK@
+CC = @CC@
+CCDEPMODE = @CCDEPMODE@
+CFLAGS = @CFLAGS@
+CPP = @CPP@
+CPPFLAGS = @CPPFLAGS@
+CYGPATH_W = @CYGPATH_W@
+DEFS = @DEFS@
+DEPDIR = @DEPDIR@
+ECHO_C = @ECHO_C@
+ECHO_N = @ECHO_N@
+ECHO_T = @ECHO_T@
+EGREP = @EGREP@
+EXEEXT = @EXEEXT@
+GREP = @GREP@
+INSTALL = @INSTALL@
+INSTALL_DATA = @INSTALL_DATA@
+INSTALL_PROGRAM = @INSTALL_PROGRAM@
+INSTALL_SCRIPT = @INSTALL_SCRIPT@
+INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
+LDFLAGS = @LDFLAGS@
+LIBOBJS = @LIBOBJS@
+LIBS = @LIBS@
+LTLIBOBJS = @LTLIBOBJS@
+MAKEINFO = @MAKEINFO@
+MKDIR_P = @MKDIR_P@
+OBJEXT = @OBJEXT@
+PACKAGE = @PACKAGE@
+PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
+PACKAGE_NAME = @PACKAGE_NAME@
+PACKAGE_STRING = @PACKAGE_STRING@
+PACKAGE_TARNAME = @PACKAGE_TARNAME@
+PACKAGE_URL = @PACKAGE_URL@
+PACKAGE_VERSION = @PACKAGE_VERSION@
+PATH_SEPARATOR = @PATH_SEPARATOR@
+SET_MAKE = @SET_MAKE@
+SHELL = @SHELL@
+STRIP = @STRIP@
+VERSION = @VERSION@
+abs_builddir = @abs_builddir@
+abs_srcdir = @abs_srcdir@
+abs_top_builddir = @abs_top_builddir@
+abs_top_srcdir = @abs_top_srcdir@
+ac_ct_CC = @ac_ct_CC@
+am__include = @am__include@
+am__leading_dot = @am__leading_dot@
+am__quote = @am__quote@
+am__tar = @am__tar@
+am__untar = @am__untar@
+bindir = @bindir@
+build_alias = @build_alias@
+builddir = @builddir@
+datadir = @datadir@
+datarootdir = @datarootdir@
+docdir = @docdir@
+dvidir = @dvidir@
+exec_prefix = @exec_prefix@
+host_alias = @host_alias@
+htmldir = @htmldir@
+includedir = @includedir@
+infodir = @infodir@
+install_sh = @install_sh@
+libdir = @libdir@
+libexecdir = @libexecdir@
+localedir = @localedir@
+localstatedir = @localstatedir@
+mandir = @mandir@
+mkdir_p = @mkdir_p@
+oldincludedir = @oldincludedir@
+pdfdir = @pdfdir@
+prefix = @prefix@
+program_transform_name = @program_transform_name@
+psdir = @psdir@
+runstatedir = @runstatedir@
+sbindir = @sbindir@
+sharedstatedir = @sharedstatedir@
+srcdir = @srcdir@
+sysconfdir = @sysconfdir@
+target_alias = @target_alias@
+top_build_prefix = @top_build_prefix@
+top_builddir = @top_builddir@
+top_srcdir = @top_srcdir@
+qsfilter2_SOURCES = \
+	qsfilter2.c qs_util.c
+
+qslog_SOURCES = \
+	qslog.c qs_util.c
+
+qspng_SOURCES = \
+	qspng.c qs_util.c
+
+qsrotate_SOURCES = \
+	qsrotate.c qs_util.c
+
+qssign_SOURCES = \
+	qssign.c qs_util.c qs_apo.c
+
+qstail_SOURCES = \
+	qstail.c qs_util.c
+
+qshead_SOURCES = \
+	qshead.c qs_util.c
+
+qsgrep_SOURCES = \
+	qsgrep.c qs_util.c
+
+qsexec_SOURCES = \
+	qsexec.c qs_util.c
+
+qscheck_SOURCES = \
+	qscheck.c qs_util.c
+
+qsgeo_SOURCES = \
+	qsgeo.c qs_util.c
+
+qslogger_SOURCES = \
+	qslogger.c qs_util.c
+
+qsdt_SOURCES = \
+	qsdt.c qs_util.c
+
+qsrespeed_SOURCES = \
+	qsrespeed.c qs_util.c
+
+qsre_SOURCES = \
+	qsre.c qs_util.c
+
+all: all-am
+
+.SUFFIXES:
+.SUFFIXES: .c .o .obj
+$(srcdir)/Makefile.in:  $(srcdir)/Makefile.am  $(am__configure_deps)
+	@for dep in $?; do \
+	  case '$(am__configure_deps)' in \
+	    *$$dep*) \
+	      ( cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh ) \
+	        && { if test -f $@; then exit 0; else break; fi; }; \
+	      exit 1;; \
+	  esac; \
+	done; \
+	echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu src/Makefile'; \
+	$(am__cd) $(top_srcdir) && \
+	  $(AUTOMAKE) --gnu src/Makefile
+Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
+	@case '$?' in \
+	  *config.status*) \
+	    cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \
+	  *) \
+	    echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \
+	    cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \
+	esac;
+
+$(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES)
+	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+
+$(top_srcdir)/configure:  $(am__configure_deps)
+	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(ACLOCAL_M4):  $(am__aclocal_m4_deps)
+	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(am__aclocal_m4_deps):
+install-binPROGRAMS: $(bin_PROGRAMS)
+	@$(NORMAL_INSTALL)
+	@list='$(bin_PROGRAMS)'; test -n "$(bindir)" || list=; \
+	if test -n "$$list"; then \
+	  echo " $(MKDIR_P) '$(DESTDIR)$(bindir)'"; \
+	  $(MKDIR_P) "$(DESTDIR)$(bindir)" || exit 1; \
+	fi; \
+	for p in $$list; do echo "$$p $$p"; done | \
+	sed 's/$(EXEEXT)$$//' | \
+	while read p p1; do if test -f $$p \
+	  ; then echo "$$p"; echo "$$p"; else :; fi; \
+	done | \
+	sed -e 'p;s,.*/,,;n;h' \
+	    -e 's|.*|.|' \
+	    -e 'p;x;s,.*/,,;s/$(EXEEXT)$$//;$(transform);s/$$/$(EXEEXT)/' | \
+	sed 'N;N;N;s,\n, ,g' | \
+	$(AWK) 'BEGIN { files["."] = ""; dirs["."] = 1 } \
+	  { d=$$3; if (dirs[d] != 1) { print "d", d; dirs[d] = 1 } \
+	    if ($$2 == $$4) files[d] = files[d] " " $$1; \
+	    else { print "f", $$3 "/" $$4, $$1; } } \
+	  END { for (d in files) print "f", d, files[d] }' | \
+	while read type dir files; do \
+	    if test "$$dir" = .; then dir=; else dir=/$$dir; fi; \
+	    test -z "$$files" || { \
+	      echo " $(INSTALL_PROGRAM_ENV) $(INSTALL_PROGRAM) $$files '$(DESTDIR)$(bindir)$$dir'"; \
+	      $(INSTALL_PROGRAM_ENV) $(INSTALL_PROGRAM) $$files "$(DESTDIR)$(bindir)$$dir" || exit $$?; \
+	    } \
+	; done
+
+uninstall-binPROGRAMS:
+	@$(NORMAL_UNINSTALL)
+	@list='$(bin_PROGRAMS)'; test -n "$(bindir)" || list=; \
+	files=`for p in $$list; do echo "$$p"; done | \
+	  sed -e 'h;s,^.*/,,;s/$(EXEEXT)$$//;$(transform)' \
+	      -e 's/$$/$(EXEEXT)/' \
+	`; \
+	test -n "$$list" || exit 0; \
+	echo " ( cd '$(DESTDIR)$(bindir)' && rm -f" $$files ")"; \
+	cd "$(DESTDIR)$(bindir)" && rm -f $$files
+
+clean-binPROGRAMS:
+	-test -z "$(bin_PROGRAMS)" || rm -f $(bin_PROGRAMS)
+
+qscheck$(EXEEXT): $(qscheck_OBJECTS) $(qscheck_DEPENDENCIES) $(EXTRA_qscheck_DEPENDENCIES) 
+	@rm -f qscheck$(EXEEXT)
+	$(AM_V_CCLD)$(LINK) $(qscheck_OBJECTS) $(qscheck_LDADD) $(LIBS)
+
+qsdt$(EXEEXT): $(qsdt_OBJECTS) $(qsdt_DEPENDENCIES) $(EXTRA_qsdt_DEPENDENCIES) 
+	@rm -f qsdt$(EXEEXT)
+	$(AM_V_CCLD)$(LINK) $(qsdt_OBJECTS) $(qsdt_LDADD) $(LIBS)
+
+qsexec$(EXEEXT): $(qsexec_OBJECTS) $(qsexec_DEPENDENCIES) $(EXTRA_qsexec_DEPENDENCIES) 
+	@rm -f qsexec$(EXEEXT)
+	$(AM_V_CCLD)$(LINK) $(qsexec_OBJECTS) $(qsexec_LDADD) $(LIBS)
+
+qsfilter2$(EXEEXT): $(qsfilter2_OBJECTS) $(qsfilter2_DEPENDENCIES) $(EXTRA_qsfilter2_DEPENDENCIES) 
+	@rm -f qsfilter2$(EXEEXT)
+	$(AM_V_CCLD)$(LINK) $(qsfilter2_OBJECTS) $(qsfilter2_LDADD) $(LIBS)
+
+qsgeo$(EXEEXT): $(qsgeo_OBJECTS) $(qsgeo_DEPENDENCIES) $(EXTRA_qsgeo_DEPENDENCIES) 
+	@rm -f qsgeo$(EXEEXT)
+	$(AM_V_CCLD)$(LINK) $(qsgeo_OBJECTS) $(qsgeo_LDADD) $(LIBS)
+
+qsgrep$(EXEEXT): $(qsgrep_OBJECTS) $(qsgrep_DEPENDENCIES) $(EXTRA_qsgrep_DEPENDENCIES) 
+	@rm -f qsgrep$(EXEEXT)
+	$(AM_V_CCLD)$(LINK) $(qsgrep_OBJECTS) $(qsgrep_LDADD) $(LIBS)
+
+qshead$(EXEEXT): $(qshead_OBJECTS) $(qshead_DEPENDENCIES) $(EXTRA_qshead_DEPENDENCIES) 
+	@rm -f qshead$(EXEEXT)
+	$(AM_V_CCLD)$(LINK) $(qshead_OBJECTS) $(qshead_LDADD) $(LIBS)
+
+qslog$(EXEEXT): $(qslog_OBJECTS) $(qslog_DEPENDENCIES) $(EXTRA_qslog_DEPENDENCIES) 
+	@rm -f qslog$(EXEEXT)
+	$(AM_V_CCLD)$(LINK) $(qslog_OBJECTS) $(qslog_LDADD) $(LIBS)
+
+qslogger$(EXEEXT): $(qslogger_OBJECTS) $(qslogger_DEPENDENCIES) $(EXTRA_qslogger_DEPENDENCIES) 
+	@rm -f qslogger$(EXEEXT)
+	$(AM_V_CCLD)$(LINK) $(qslogger_OBJECTS) $(qslogger_LDADD) $(LIBS)
+
+qspng$(EXEEXT): $(qspng_OBJECTS) $(qspng_DEPENDENCIES) $(EXTRA_qspng_DEPENDENCIES) 
+	@rm -f qspng$(EXEEXT)
+	$(AM_V_CCLD)$(LINK) $(qspng_OBJECTS) $(qspng_LDADD) $(LIBS)
+
+qsre$(EXEEXT): $(qsre_OBJECTS) $(qsre_DEPENDENCIES) $(EXTRA_qsre_DEPENDENCIES) 
+	@rm -f qsre$(EXEEXT)
+	$(AM_V_CCLD)$(LINK) $(qsre_OBJECTS) $(qsre_LDADD) $(LIBS)
+
+qsrespeed$(EXEEXT): $(qsrespeed_OBJECTS) $(qsrespeed_DEPENDENCIES) $(EXTRA_qsrespeed_DEPENDENCIES) 
+	@rm -f qsrespeed$(EXEEXT)
+	$(AM_V_CCLD)$(LINK) $(qsrespeed_OBJECTS) $(qsrespeed_LDADD) $(LIBS)
+
+qsrotate$(EXEEXT): $(qsrotate_OBJECTS) $(qsrotate_DEPENDENCIES) $(EXTRA_qsrotate_DEPENDENCIES) 
+	@rm -f qsrotate$(EXEEXT)
+	$(AM_V_CCLD)$(LINK) $(qsrotate_OBJECTS) $(qsrotate_LDADD) $(LIBS)
+
+qssign$(EXEEXT): $(qssign_OBJECTS) $(qssign_DEPENDENCIES) $(EXTRA_qssign_DEPENDENCIES) 
+	@rm -f qssign$(EXEEXT)
+	$(AM_V_CCLD)$(LINK) $(qssign_OBJECTS) $(qssign_LDADD) $(LIBS)
+
+qstail$(EXEEXT): $(qstail_OBJECTS) $(qstail_DEPENDENCIES) $(EXTRA_qstail_DEPENDENCIES) 
+	@rm -f qstail$(EXEEXT)
+	$(AM_V_CCLD)$(LINK) $(qstail_OBJECTS) $(qstail_LDADD) $(LIBS)
+
+mostlyclean-compile:
+	-rm -f *.$(OBJEXT)
+
+distclean-compile:
+	-rm -f *.tab.c
+
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/qs_apo.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/qs_util.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/qscheck.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/qsdt.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/qsexec.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/qsfilter2.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/qsgeo.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/qsgrep.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/qshead.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/qslog.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/qslogger.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/qspng.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/qsre.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/qsrespeed.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/qsrotate.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/qssign.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/qstail.Po@am__quote@
+
+.c.o:
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(COMPILE) -c -o $@ $<
+
+.c.obj:
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(COMPILE) -c -o $@ `$(CYGPATH_W) '$<'`
+
+ID: $(am__tagged_files)
+	$(am__define_uniq_tagged_files); mkid -fID $$unique
+tags: tags-am
+TAGS: tags
+
+tags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files)
+	set x; \
+	here=`pwd`; \
+	$(am__define_uniq_tagged_files); \
+	shift; \
+	if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \
+	  test -n "$$unique" || unique=$$empty_fix; \
+	  if test $$# -gt 0; then \
+	    $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+	      "$$@" $$unique; \
+	  else \
+	    $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+	      $$unique; \
+	  fi; \
+	fi
+ctags: ctags-am
+
+CTAGS: ctags
+ctags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files)
+	$(am__define_uniq_tagged_files); \
+	test -z "$(CTAGS_ARGS)$$unique" \
+	  || $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \
+	     $$unique
+
+GTAGS:
+	here=`$(am__cd) $(top_builddir) && pwd` \
+	  && $(am__cd) $(top_srcdir) \
+	  && gtags -i $(GTAGS_ARGS) "$$here"
+cscopelist: cscopelist-am
+
+cscopelist-am: $(am__tagged_files)
+	list='$(am__tagged_files)'; \
+	case "$(srcdir)" in \
+	  [\\/]* | ?:[\\/]*) sdir="$(srcdir)" ;; \
+	  *) sdir=$(subdir)/$(srcdir) ;; \
+	esac; \
+	for i in $$list; do \
+	  if test -f "$$i"; then \
+	    echo "$(subdir)/$$i"; \
+	  else \
+	    echo "$$sdir/$$i"; \
+	  fi; \
+	done >> $(top_builddir)/cscope.files
+
+distclean-tags:
+	-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
+
+distdir: $(DISTFILES)
+	@srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
+	topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
+	list='$(DISTFILES)'; \
+	  dist_files=`for file in $$list; do echo $$file; done | \
+	  sed -e "s|^$$srcdirstrip/||;t" \
+	      -e "s|^$$topsrcdirstrip/|$(top_builddir)/|;t"`; \
+	case $$dist_files in \
+	  */*) $(MKDIR_P) `echo "$$dist_files" | \
+			   sed '/\//!d;s|^|$(distdir)/|;s,/[^/]*$$,,' | \
+			   sort -u` ;; \
+	esac; \
+	for file in $$dist_files; do \
+	  if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
+	  if test -d $$d/$$file; then \
+	    dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \
+	    if test -d "$(distdir)/$$file"; then \
+	      find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+	    fi; \
+	    if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
+	      cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \
+	      find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+	    fi; \
+	    cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \
+	  else \
+	    test -f "$(distdir)/$$file" \
+	    || cp -p $$d/$$file "$(distdir)/$$file" \
+	    || exit 1; \
+	  fi; \
+	done
+check-am: all-am
+check: check-am
+all-am: Makefile $(PROGRAMS)
+installdirs:
+	for dir in "$(DESTDIR)$(bindir)"; do \
+	  test -z "$$dir" || $(MKDIR_P) "$$dir"; \
+	done
+install: install-am
+install-exec: install-exec-am
+install-data: install-data-am
+uninstall: uninstall-am
+
+install-am: all-am
+	@$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am
+
+installcheck: installcheck-am
+install-strip:
+	if test -z '$(STRIP)'; then \
+	  $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
+	    install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
+	      install; \
+	else \
+	  $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
+	    install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
+	    "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'" install; \
+	fi
+mostlyclean-generic:
+
+clean-generic:
+
+distclean-generic:
+	-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
+	-test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
+
+maintainer-clean-generic:
+	@echo "This command is intended for maintainers to use"
+	@echo "it deletes files that may require special tools to rebuild."
+clean: clean-am
+
+clean-am: clean-binPROGRAMS clean-generic mostlyclean-am
+
+distclean: distclean-am
+	-rm -rf ./$(DEPDIR)
+	-rm -f Makefile
+distclean-am: clean-am distclean-compile distclean-generic \
+	distclean-tags
+
+dvi: dvi-am
+
+dvi-am:
+
+html: html-am
+
+html-am:
+
+info: info-am
+
+info-am:
+
+install-data-am:
+
+install-dvi: install-dvi-am
+
+install-dvi-am:
+
+install-exec-am: install-binPROGRAMS
+
+install-html: install-html-am
+
+install-html-am:
+
+install-info: install-info-am
+
+install-info-am:
+
+install-man:
+
+install-pdf: install-pdf-am
+
+install-pdf-am:
+
+install-ps: install-ps-am
+
+install-ps-am:
+
+installcheck-am:
+
+maintainer-clean: maintainer-clean-am
+	-rm -rf ./$(DEPDIR)
+	-rm -f Makefile
+maintainer-clean-am: distclean-am maintainer-clean-generic
+
+mostlyclean: mostlyclean-am
+
+mostlyclean-am: mostlyclean-compile mostlyclean-generic
+
+pdf: pdf-am
+
+pdf-am:
+
+ps: ps-am
+
+ps-am:
+
+uninstall-am: uninstall-binPROGRAMS
+
+.MAKE: install-am install-strip
+
+.PHONY: CTAGS GTAGS TAGS all all-am check check-am clean \
+	clean-binPROGRAMS clean-generic cscopelist-am ctags ctags-am \
+	distclean distclean-compile distclean-generic distclean-tags \
+	distdir dvi dvi-am html html-am info info-am install \
+	install-am install-binPROGRAMS install-data install-data-am \
+	install-dvi install-dvi-am install-exec install-exec-am \
+	install-html install-html-am install-info install-info-am \
+	install-man install-pdf install-pdf-am install-ps \
+	install-ps-am install-strip installcheck installcheck-am \
+	installdirs maintainer-clean maintainer-clean-generic \
+	mostlyclean mostlyclean-compile mostlyclean-generic pdf pdf-am \
+	ps ps-am tags tags-am uninstall uninstall-am \
+	uninstall-binPROGRAMS
+
+.PRECIOUS: Makefile
+
+
+# Tell versions [3.59,3.63) of GNU make to not export all variables.
+# Otherwise a system limit (for SysV at least) may be exceeded.
+.NOEXPORT:
diff --git a/tools/src/char.h b/tools/src/char.h
new file mode 100644
index 0000000..a703691
--- /dev/null
+++ b/tools/src/char.h
@@ -0,0 +1,539 @@
+/**
+ * Utilities for the quality of service module mod_qos.
+ *
+ * See http://mod-qos.sourceforge.net/ for further
+ * details.
+ *
+ * Copyright (C) 2023 Pascal Buchbinder
+ *
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+#define S_W_MAX 6
+#define S_H_MAX 7
+
+static int s_0[S_H_MAX][S_W_MAX] = {
+  { 0,1,1,1,0,0},
+  { 1,0,0,0,1,0},
+  { 1,0,0,0,1,0},
+  { 1,0,0,0,1,0},
+  { 1,0,0,0,1,0},
+  { 0,1,1,1,0,0},
+  { 0,0,0,0,0,0}
+};
+
+static int s_1[S_H_MAX][S_W_MAX] = {
+  { 0,0,0,1,0,0},
+  { 0,0,1,1,0,0},
+  { 0,1,0,1,0,0},
+  { 0,0,0,1,0,0},
+  { 0,0,0,1,0,0},
+  { 0,0,0,1,0,0},
+  { 0,0,0,0,0,0}
+};
+
+static int s_2[S_H_MAX][S_W_MAX] = {
+  { 0,1,1,1,0,0},
+  { 1,0,0,0,1,0},
+  { 0,0,0,1,0,0},
+  { 0,0,1,0,0,0},
+  { 0,1,0,0,0,0},
+  { 1,1,1,1,1,0},
+  { 0,0,0,0,0,0}
+};
+
+static int s_3[S_H_MAX][S_W_MAX] = {
+  { 0,1,1,1,0,0},
+  { 1,0,0,0,1,0},
+  { 0,0,1,1,0,0},
+  { 0,0,0,0,1,0},
+  { 1,0,0,0,1,0},
+  { 0,1,1,1,0,0},
+  { 0,0,0,0,0,0}
+};
+
+static int s_4[S_H_MAX][S_W_MAX] = {
+  { 0,0,0,1,0,0},
+  { 0,0,1,0,0,0},
+  { 0,1,0,0,0,0},
+  { 1,0,0,1,0,0},
+  { 1,1,1,1,1,0},
+  { 0,0,0,1,0,0},
+  { 0,0,0,0,0,0}
+};
+
+static int s_5[S_H_MAX][S_W_MAX] = {
+  { 1,1,1,1,1,0},
+  { 1,0,0,0,0,0},
+  { 1,1,1,1,0,0},
+  { 0,0,0,0,1,0},
+  { 0,0,0,0,1,0},
+  { 1,1,1,1,0,0},
+  { 0,0,0,0,0,0}
+};
+
+static int s_6[S_H_MAX][S_W_MAX] = {
+  { 0,1,1,1,0,0},
+  { 1,0,0,0,0,0},
+  { 1,0,1,1,0,0},
+  { 1,1,0,0,1,0},
+  { 1,0,0,0,1,0},
+  { 0,1,1,1,0,0},
+  { 0,0,0,0,0,0}
+};
+
+static int s_7[S_H_MAX][S_W_MAX] = {
+  { 1,1,1,1,1,0},
+  { 0,0,0,0,1,0},
+  { 0,0,0,1,0,0},
+  { 0,0,1,0,0,0},
+  { 0,1,0,0,0,0},
+  { 0,1,0,0,0,0},
+  { 0,0,0,0,0,0}
+};
+
+static int s_8[S_H_MAX][S_W_MAX] = {
+  { 0,1,1,1,0,0},
+  { 1,0,0,0,1,0},
+  { 0,1,1,1,0,0},
+  { 1,0,0,0,1,0},
+  { 1,0,0,0,1,0},
+  { 0,1,1,1,0,0},
+  { 0,0,0,0,0,0}
+};
+
+static int s_9[S_H_MAX][S_W_MAX] = {
+  { 0,1,1,1,0,0},
+  { 1,0,0,0,1,0},
+  { 0,1,1,1,1,0},
+  { 0,0,0,0,1,0},
+  { 0,0,0,0,1,0},
+  { 0,1,1,1,0,0},
+  { 0,0,0,0,0,0}
+};
+
+/* ----------------------------------------------- */
+static int s_a[S_H_MAX][S_W_MAX] = {
+  { 0,0,0,0,0,0},
+  { 0,1,1,1,0,0},
+  { 0,0,0,0,1,0},
+  { 0,1,1,1,1,0},
+  { 1,0,0,0,1,0},
+  { 0,1,1,1,1,0},
+  { 0,0,0,0,0,0}
+};
+
+static int s_b[S_H_MAX][S_W_MAX] = {
+  { 1,0,0,0,0,0},
+  { 1,0,0,0,0,0},
+  { 1,1,1,1,0,0},
+  { 1,0,0,0,1,0},
+  { 1,0,0,0,1,0},
+  { 1,1,1,1,0,0},
+  { 0,0,0,0,0,0}
+};
+
+static int s_c[S_H_MAX][S_W_MAX] = {
+  { 0,0,0,0,0,0},
+  { 0,1,1,1,0,0},
+  { 1,0,0,0,1,0},
+  { 1,0,0,0,0,0},
+  { 1,0,0,0,1,0},
+  { 0,1,1,1,0,0},
+  { 0,0,0,0,0,0}
+};
+
+static int s_d[S_H_MAX][S_W_MAX] = {
+  { 0,0,0,0,1,0},
+  { 0,0,0,0,1,0},
+  { 0,1,1,1,1,0},
+  { 1,0,0,0,1,0},
+  { 1,0,0,0,1,0},
+  { 0,1,1,1,1,0},
+  { 0,0,0,0,0,0}
+};
+
+static int s_e[S_H_MAX][S_W_MAX] = {
+  { 0,0,0,0,0,0},
+  { 0,1,1,1,0,0},
+  { 1,0,0,0,1,0},
+  { 1,1,1,1,1,0},
+  { 1,0,0,0,0,0},
+  { 0,1,1,1,0,0},
+  { 0,0,0,0,0,0}
+};
+
+static int s_f[S_H_MAX][S_W_MAX] = {
+  { 0,0,1,1,0,0},
+  { 0,1,0,0,0,0},
+  { 1,1,1,0,0,0},
+  { 0,1,0,0,0,0},
+  { 0,1,0,0,0,0},
+  { 0,1,0,0,0,0},
+  { 0,0,0,0,0,0}
+};
+
+static int s_g[S_H_MAX][S_W_MAX] = {
+  { 0,0,0,0,0,0},
+  { 0,1,1,1,1,0},
+  { 1,0,0,0,1,0},
+  { 1,0,0,0,1,0},
+  { 0,1,1,1,1,0},
+  { 0,0,0,0,1,0},
+  { 0,1,1,1,0,0}
+};
+
+static int s_h[S_H_MAX][S_W_MAX] = {
+  { 1,0,0,0,0,0},
+  { 1,0,0,0,0,0},
+  { 1,0,1,1,0,0},
+  { 1,1,0,0,1,0},
+  { 1,0,0,0,1,0},
+  { 1,0,0,0,1,0},
+  { 0,0,0,0,0,0}
+};
+
+static int s_i[S_H_MAX][S_W_MAX] = {
+  { 0,0,1,0,0,0},
+  { 0,0,0,0,0,0},
+  { 0,1,1,0,0,0},
+  { 0,0,1,0,0,0},
+  { 0,0,1,0,0,0},
+  { 0,1,1,1,0,0},
+  { 0,0,0,0,0,0}
+};
+
+static int s_j[S_H_MAX][S_W_MAX] = {
+  { 0,0,0,0,1,0},
+  { 0,0,0,0,0,0},
+  { 0,0,0,1,1,0},
+  { 0,0,0,0,1,0},
+  { 0,0,0,0,1,0},
+  { 0,0,0,0,1,0},
+  { 0,0,1,1,0,0}
+};
+
+static int s_k[S_H_MAX][S_W_MAX] = {
+  { 1,0,0,0,0,0},
+  { 1,0,0,0,0,0},
+  { 1,0,1,1,0,0},
+  { 1,1,0,0,0,0},
+  { 1,0,1,0,0,0},
+  { 1,0,0,1,0,0},
+  { 0,0,0,0,0,0}
+};
+
+static int s_l[S_H_MAX][S_W_MAX] = {
+  { 0,1,1,0,0,0},
+  { 0,0,1,0,0,0},
+  { 0,0,1,0,0,0},
+  { 0,0,1,0,0,0},
+  { 0,0,1,0,0,0},
+  { 0,0,1,0,0,0},
+  { 0,0,0,0,0,0}
+};
+
+static int s_m[S_H_MAX][S_W_MAX] = {
+  { 0,0,0,0,0,0},
+  { 1,1,0,1,0,0},
+  { 1,0,1,0,1,0},
+  { 1,0,1,0,1,0},
+  { 1,0,1,0,1,0},
+  { 1,0,1,0,1,0},
+  { 0,0,0,0,0,0}
+};
+
+static int s_n[S_H_MAX][S_W_MAX] = {
+  { 0,0,0,0,0,0},
+  { 1,0,1,1,0,0},
+  { 1,1,0,0,1,0},
+  { 1,0,0,0,1,0},
+  { 1,0,0,0,1,0},
+  { 1,0,0,0,1,0},
+  { 0,0,0,0,0,0}
+};
+
+static int s_o[S_H_MAX][S_W_MAX] = {
+  { 0,0,0,0,0,0},
+  { 0,1,1,1,0,0},
+  { 1,0,0,0,1,0},
+  { 1,0,0,0,1,0},
+  { 1,0,0,0,1,0},
+  { 0,1,1,1,0,0},
+  { 0,0,0,0,0,0}
+};
+
+static int s_p[S_H_MAX][S_W_MAX] = {
+  { 0,0,0,0,0,0},
+  { 1,1,1,1,0,0},
+  { 1,0,0,0,1,0},
+  { 1,0,0,0,1,0},
+  { 1,1,1,1,0,0},
+  { 1,0,0,0,0,0},
+  { 1,0,0,0,0,0}
+};
+
+static int s_q[S_H_MAX][S_W_MAX] = {
+  { 0,0,0,0,0,0},
+  { 0,1,1,1,1,0},
+  { 1,0,0,0,1,0},
+  { 1,0,0,0,1,0},
+  { 0,1,1,1,1,0},
+  { 0,0,0,0,1,0},
+  { 0,0,0,0,1,0}
+};
+
+static int s_r[S_H_MAX][S_W_MAX] = {
+  { 0,0,0,0,0,0},
+  { 1,0,1,1,0,0},
+  { 1,1,0,0,1,0},
+  { 1,0,0,0,0,0},
+  { 1,0,0,0,0,0},
+  { 1,0,0,0,0,0},
+  { 0,0,0,0,0,0}
+};
+
+static int s_s[S_H_MAX][S_W_MAX] = {
+  { 0,0,0,0,0,0},
+  { 0,1,1,1,1,0},
+  { 1,0,0,0,0,0},
+  { 0,1,1,1,0,0},
+  { 0,0,0,0,1,0},
+  { 1,1,1,1,0,0},
+  { 0,0,0,0,0,0}
+};
+
+static int s_t[S_H_MAX][S_W_MAX] = {
+  { 0,0,1,0,0,0},
+  { 0,1,1,1,0,0},
+  { 0,0,1,0,0,0},
+  { 0,0,1,0,0,0},
+  { 0,0,1,0,1,0},
+  { 0,0,0,1,0,0},
+  { 0,0,0,0,0,0}
+};
+
+static int s_u[S_H_MAX][S_W_MAX] = {
+  { 0,0,0,0,0,0},
+  { 1,0,0,0,1,0},
+  { 1,0,0,0,1,0},
+  { 1,0,0,0,1,0},
+  { 1,0,0,0,1,0},
+  { 0,1,1,1,1,0},
+  { 0,0,0,0,0,0}
+};
+
+static int s_v[S_H_MAX][S_W_MAX] = {
+  { 0,0,0,0,0,0},
+  { 1,0,0,0,1,0},
+  { 1,0,0,0,1,0},
+  { 1,0,0,0,1,0},
+  { 0,1,0,1,0,0},
+  { 0,0,1,0,0,0},
+  { 0,0,0,0,0,0}
+};
+
+static int s_w[S_H_MAX][S_W_MAX] = {
+  { 0,0,0,0,0,0},
+  { 1,0,0,0,1,0},
+  { 1,0,0,0,1,0},
+  { 1,0,1,0,1,0},
+  { 1,1,0,1,1,0},
+  { 1,0,0,0,1,0},
+  { 0,0,0,0,0,0}
+};
+
+static int s_x[S_H_MAX][S_W_MAX] = {
+  { 0,0,0,0,0,0},
+  { 1,0,0,0,1,0},
+  { 0,1,0,1,0,0},
+  { 0,0,1,0,0,0},
+  { 0,1,0,1,0,0},
+  { 1,0,0,0,1,0},
+  { 0,0,0,0,0,0}
+};
+
+static int s_y[S_H_MAX][S_W_MAX] = {
+  { 0,0,0,0,0,0},
+  { 1,0,0,0,1,0},
+  { 1,0,0,0,1,0},
+  { 1,0,0,0,1,0},
+  { 0,1,1,1,1,0},
+  { 0,0,0,0,1,0},
+  { 1,1,1,1,0,0}
+};
+
+static int s_z[S_H_MAX][S_W_MAX] = {
+  { 0,0,0,0,0,0},
+  { 1,1,1,1,1,0},
+  { 0,0,0,1,1,0},
+  { 0,0,1,0,0,0},
+  { 1,1,0,0,0,0},
+  { 1,1,1,1,1,0},
+  { 0,0,0,0,0,0}
+};
+
+static int s_BRO[S_H_MAX][S_W_MAX] = {
+  { 0,0,0,1,0,0},
+  { 0,0,1,0,0,0},
+  { 0,1,0,0,0,0},
+  { 0,1,0,0,0,0},
+  { 0,0,1,0,0,0},
+  { 0,0,0,1,0,0},
+  { 0,0,0,0,0,0}
+};
+
+static int s_BRC[S_H_MAX][S_W_MAX] = {
+  { 0,0,1,0,0,0},
+  { 0,0,0,1,0,0},
+  { 0,0,0,0,1,0},
+  { 0,0,0,0,1,0},
+  { 0,0,0,1,0,0},
+  { 0,0,1,0,0,0},
+  { 0,0,0,0,0,0}
+};
+
+static int s_MI[S_H_MAX][S_W_MAX] = {
+  { 0,0,0,0,0,0},
+  { 0,0,0,0,0,0},
+  { 0,0,0,0,0,0},
+  { 1,1,1,1,1,0},
+  { 0,0,0,0,0,0},
+  { 0,0,0,0,0,0},
+  { 0,0,0,0,0,0}
+};
+
+static int s_LT[S_H_MAX][S_W_MAX] = {
+  { 0,0,0,0,0,0},
+  { 0,0,0,1,0,0},
+  { 0,1,1,0,0,0},
+  { 1,0,0,0,0,0},
+  { 0,1,1,0,0,0},
+  { 0,0,0,1,0,0},
+  { 0,0,0,0,0,0}
+};
+
+static int s_GT[S_H_MAX][S_W_MAX] = {
+  { 0,0,0,0,0,0},
+  { 0,1,0,0,0,0},
+  { 0,0,1,1,0,0},
+  { 0,0,0,0,1,0},
+  { 0,0,1,1,0,0},
+  { 0,1,0,0,0,0},
+  { 0,0,0,0,0,0}
+};
+
+static int s_SP[S_H_MAX][S_W_MAX] = {
+  { 0,0,0,0,0,0},
+  { 0,0,0,0,0,0},
+  { 0,0,0,0,0,0},
+  { 0,0,0,0,0,0},
+  { 0,0,0,0,0,0},
+  { 0,0,0,0,0,0},
+  { 0,0,0,0,0,0}
+};
+
+static int s_US[S_H_MAX][S_W_MAX] = {
+  { 0,0,0,0,0,0},
+  { 0,0,0,0,0,0},
+  { 0,0,0,0,0,0},
+  { 0,0,0,0,0,0},
+  { 0,0,0,0,0,0},
+  { 1,1,1,1,1,0},
+  { 0,0,0,0,0,0}
+};
+
+static int s_M[S_H_MAX][S_W_MAX] = {
+  { 1,0,0,0,1,0},
+  { 1,1,0,1,1,0},
+  { 1,0,1,0,1,0},
+  { 1,0,0,0,1,0},
+  { 1,0,0,0,1,0},
+  { 1,0,0,0,1,0},
+  { 0,0,0,0,0,0}
+};
+
+static int s_DT[S_H_MAX][S_W_MAX] = {
+  { 0,0,0,0,0,0},
+  { 0,0,0,0,0,0},
+  { 0,0,0,0,0,0},
+  { 0,0,0,0,0,0},
+  { 0,0,0,0,0,0},
+  { 0,1,0,0,0,0},
+  { 0,0,0,0,0,0}
+};
+
+static int s_CM[S_H_MAX][S_W_MAX] = {
+  { 0,0,0,0,0,0},
+  { 0,0,0,0,0,0},
+  { 0,0,0,0,0,0},
+  { 0,0,0,0,0,0},
+  { 0,0,0,0,0,0},
+  { 0,0,1,0,0,0},
+  { 0,1,0,0,0,0}
+};
+
+static int s_SC[S_H_MAX][S_W_MAX] = {
+  { 0,0,0,0,0,0},
+  { 0,0,0,0,0,0},
+  { 0,0,1,0,0,0},
+  { 0,0,0,0,0,0},
+  { 0,0,0,0,0,0},
+  { 0,0,1,0,0,0},
+  { 0,1,0,0,0,0}
+};
+
+static int s_CO[S_H_MAX][S_W_MAX] = {
+  { 0,0,0,0,0,0},
+  { 0,0,0,0,0,0},
+  { 0,0,1,0,0,0},
+  { 0,0,0,0,0,0},
+  { 0,0,0,0,0,0},
+  { 0,0,1,0,0,0},
+  { 0,0,0,0,0,0}
+};
+
+static int s_SL[S_H_MAX][S_W_MAX] = {
+  { 0,0,0,0,0,1},
+  { 0,0,0,0,1,0},
+  { 0,0,0,1,0,0},
+  { 0,0,1,0,0,0},
+  { 0,1,0,0,0,0},
+  { 1,0,0,0,0,0},
+  { 0,0,0,0,0,0}
+};
+
+static int s_SQ[S_H_MAX][S_W_MAX] = {
+  { 0,0,1,0,0,0},
+  { 0,0,1,0,0,0},
+  { 0,0,1,0,0,0},
+  { 0,0,0,0,0,0},
+  { 0,0,0,0,0,0},
+  { 0,0,0,0,0,0},
+  { 0,0,0,0,0,0}
+};
+
+static int s_X[S_H_MAX][S_W_MAX] = {
+  { 1,1,1,1,1,0},
+  { 1,1,1,1,1,0},
+  { 1,1,1,1,1,0},
+  { 1,1,1,1,1,0},
+  { 1,1,1,1,1,0},
+  { 1,1,1,1,1,0},
+  { 0,0,0,0,0,0}
+};
+
diff --git a/tools/src/qs_apo.c b/tools/src/qs_apo.c
new file mode 100644
index 0000000..67f4027
--- /dev/null
+++ b/tools/src/qs_apo.c
@@ -0,0 +1,135 @@
+/**
+ * Utilities for the quality of service module mod_qos.
+ *
+ * See http://mod-qos.sourceforge.net/ for further
+ * details.
+ *
+ * Copyright (C) 2023 Pascal Buchbinder
+ *
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+static const char revision[] = "$Id: qs_apo.c 2654 2022-05-13 09:12:42Z pbuchbinder $";
+
+#include <stdio.h>
+#include <pthread.h>
+#include <stdlib.h>
+#include <string.h>
+#include <ctype.h>
+#include <stdarg.h>
+#include <fcntl.h>
+#include <dirent.h>
+#include <unistd.h>
+#include <errno.h>
+#include <pwd.h>
+
+/* apr/apr-util */
+#include <apr.h>
+#include <apr_base64.h>
+#include <apr_pools.h>
+#include <apr_strings.h>
+#include <apr_thread_proc.h>
+#include <apr_file_io.h>
+#include <apr_time.h>
+
+#include "qs_util.h"
+#include "qs_apo.h"
+
+static apr_table_t *qs_args(apr_pool_t *pool, const char *line) {
+  char *last = apr_pstrdup(pool, line);
+  apr_table_t* table = apr_table_make(pool, 10);
+  char *val;
+  while((val = apr_strtok(NULL, " ", &last))) {
+    apr_table_addn(table, val, "");
+  }
+  return table;
+}
+
+static void qs_failedexec(const char *msg, const char *cmd, apr_status_t status) {
+  char buf[MAX_LINE];
+  apr_strerror(status, buf, sizeof(buf));
+  fprintf(stderr, "ERROR %s '%s': '%s'\n", msg, cmd, buf);
+  exit(1);
+}
+
+/**
+ * Reads a passphrase using the defined passphrase getter (executes
+ * the program and reads the passphras from stdout).
+ * 
+ * @param pool To allocate memory
+ * @param prg Path of the program to exectue
+ * @return The passphrase
+ */
+char *qs_readpwd(apr_pool_t *pool, const char *prg) {
+  apr_status_t status;
+  apr_proc_t proc;
+  const char **args;
+  apr_table_entry_t *entry;
+  char *last;
+  char *copy = apr_pstrdup(pool, prg);
+  char *cmd = apr_strtok(copy, " ", &last);
+  apr_table_t *a = qs_args(pool, prg);
+  int i;
+  apr_procattr_t *attr;
+  apr_size_t len = MAX_LINE;
+  char *buf = apr_pcalloc(pool, len);
+
+  args = apr_pcalloc(pool, (apr_table_elts(a)->nelts + 1) * sizeof(const char *));
+  entry = (apr_table_entry_t *) apr_table_elts(a)->elts;
+  for(i = 0; i < apr_table_elts(a)->nelts; i++) {
+    args[i] = entry[i].key;
+  }
+  args[i] = NULL;
+
+  if(cmd == NULL) {
+    qs_failedexec("can't read password, invalid executable", prg, APR_EGENERAL);
+  }
+  if((status = apr_procattr_create(&attr, pool)) != APR_SUCCESS) {
+    qs_failedexec("while reading password from executable", prg, status);
+  }
+  if((status = apr_procattr_cmdtype_set(attr, APR_PROGRAM_PATH)) != APR_SUCCESS) {
+    qs_failedexec("while reading password from executable", prg, status);
+  }
+  if((status = apr_procattr_detach_set(attr, 0)) != APR_SUCCESS) {
+    qs_failedexec("while reading password from executable", prg, status);
+  }
+  if((status = apr_procattr_io_set(attr, APR_FULL_BLOCK, APR_FULL_BLOCK, APR_NO_PIPE)) != APR_SUCCESS) {
+    qs_failedexec("while reading password from executable", prg, status);
+  }
+  if((status = apr_proc_create(&proc, cmd, args, NULL, attr, pool)) != APR_SUCCESS) {
+    qs_failedexec("could not execute program", prg, status);
+  } else {
+    char *e;
+    status = apr_proc_wait(&proc, NULL, NULL, APR_WAIT);
+    if(status != APR_CHILD_DONE && status != APR_SUCCESS) {
+      qs_failedexec("while reading password from executable", prg, status);
+    }
+    status = apr_file_read(proc.out, buf, &len);
+    if(status != APR_SUCCESS) {
+      qs_failedexec("failed to read password from program", prg, status);
+    }
+    e = buf;
+    while(e && e[0]) {
+      if((e[0] == LF) || (e[0] == CR)) {
+	e[0] = '\0';
+      } else {
+	e++;
+      }
+    }
+  }
+  return buf;
+}
diff --git a/tools/src/qs_apo.h b/tools/src/qs_apo.h
new file mode 100644
index 0000000..4316571
--- /dev/null
+++ b/tools/src/qs_apo.h
@@ -0,0 +1,31 @@
+/**
+ * Utilities for the quality of service module mod_qos.
+ *
+ * See http://mod-qos.sourceforge.net/ for further
+ * details.
+ *
+ * Copyright (C) 2023 Pascal Buchbinder
+ *
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+#ifndef QS_APO_H
+#define QS_APO_H
+
+char *qs_readpwd(apr_pool_t *pool, const char *prg);
+
+#endif
diff --git a/tools/src/qs_util.c b/tools/src/qs_util.c
new file mode 100644
index 0000000..ddf1e89
--- /dev/null
+++ b/tools/src/qs_util.c
@@ -0,0 +1,409 @@
+/**
+ * Utilities for the quality of service module mod_qos.
+ *
+ * See http://mod-qos.sourceforge.net/ for further
+ * details.
+ *
+ * Copyright (C) 2023 Pascal Buchbinder
+ *
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+static const char revision[] = "$Id: qs_util.c 2654 2022-05-13 09:12:42Z pbuchbinder $";
+
+#include <stdio.h>
+#include <pthread.h>
+#include <stdlib.h>
+#include <string.h>
+#include <ctype.h>
+#include <stdarg.h>
+#include <fcntl.h>
+#include <dirent.h>
+#include <unistd.h>
+#include <errno.h>
+#include <pwd.h>
+
+#define PCRE2_CODE_UNIT_WIDTH 8
+#include <pcre2.h>
+typedef pcre2_match_data* match_data_pt;
+typedef size_t*           match_vector_pt;
+
+#include "qs_util.h"
+
+/* mutex for counter access */
+static pthread_mutex_t m_qs_lock_cs;
+/* online/offline mode */
+static int m_qs_offline = 0;
+/* internal clock for offline analysis
+ * stores time in seconds */
+static time_t m_qs_virtualSystemTime = 0;
+
+/* ----------------------------------
+ * functions
+ * ---------------------------------- */
+
+/**
+ * man:
+ * - escape special chars, like "\" and "-"
+ * - wipe leading spaces
+ * - wipe tailing LF
+ */
+void qs_man_print(int man, const char *fmt, ...) {
+  char bufin[4096];
+  char bufout[4096];
+  va_list args;
+  int i = 0;
+  int j = 0;
+  memset(bufin, 0, 4096);
+  va_start(args, fmt);
+  vsprintf(bufin, fmt, args);
+  if(man) {
+    // wipe leading spaces
+    //    while(bufin[i] == ' ' && bufin[i+1] == ' ') {
+    while(bufin[i] == ' ') {
+      i++;
+    }
+  }
+  while(bufin[i] && j < 4000) {
+    // escape "\\" and "-" for man page
+    if(man && (bufin[i] == '\\' || bufin[i] == '-')) {
+      bufout[j] = '\\';
+      j++;
+    }
+    if(bufin[i] == '\n') {
+      if(man) {
+	// skip LF for man page
+	i++;
+      } else {
+	// keep LF
+	bufout[j] = bufin[i];
+	i++;
+	j++;
+      }
+    } else {
+      // standard char
+      bufout[j] = bufin[i];
+      i++;
+      j++;
+    }
+  }
+  bufout[j] = '\0';
+  printf("%s", bufout);
+  if(man) {
+    printf(" ");
+  }
+}
+
+// escape only
+void qs_man_println(int man, const char *fmt, ...) {
+  char bufin[4096];
+  char bufout[4096];
+  va_list args;
+  int i = 0;
+  int j = 0;
+  memset(bufin, 0, 4096);
+  va_start(args, fmt);
+  vsprintf(bufin, fmt, args);
+  while(bufin[i] && j < 4000) {
+    // escape "\\" and "-" for man page
+    if(man && (bufin[i] == '\\' || bufin[i] == '-')) {
+      bufout[j] = '\\';
+      j++;
+    }
+    // standard char
+    bufout[j] = bufin[i];
+    i++;
+    j++;
+  }
+  bufout[j] = '\0';
+  printf("%s", bufout);
+}
+
+char *qs_CMD(const char *cmd) {
+  char *buf = calloc(1024, 1);
+  int i = 0;
+  while(cmd[i] && i < 1023) {
+    buf[i] = toupper(cmd[i]);
+    i++;
+  }
+  buf[i] = '\0';
+  return buf;
+}
+
+/* io --------------------------------------------------------- */
+/*
+ * reads a line from stdin
+ *
+ * @param s Buffer to write line to
+ * @param n Length of the buffer
+ * @return 0 on EOF, or 1 if there is more data to read
+ */
+int qs_getLine(char *s, int n) {
+  int i = 0;
+  while (1) {
+    s[i] = (char)getchar();
+    if(s[i] == EOF) return 0;
+    if (s[i] == CR) {
+      s[i] = getchar();
+    }
+    if ((s[i] == 0x4) || (s[i] == LF) || (i == (n - 1))) {
+      s[i] = '\0';
+      return 1;
+    }
+    ++i;
+  }
+}
+
+/*
+ * reads a line from file
+ *
+ * @param s Buffer to write line to
+ * @param n Length of the buffer
+ * @return 0 on EOF, or 1 if there is more data to read
+ */
+int qs_getLinef(char *s, int n, FILE *f) {
+  register int i = 0;
+  while (1) {
+    s[i] = (char) fgetc(f);
+    if (s[i] == CR) {
+      s[i] = fgetc(f);
+    }
+    if ((s[i] == 0x4) || (s[i] == LF) || (i == (n - 1))) {
+      s[i] = '\0';
+      return (feof(f) ? 1 : 0);
+    }
+    ++i;
+  }
+}
+
+/* time ------------------------------------------------------- */
+/*
+ * We implement our own time which is either
+ * the system time (real time) or the time from
+ * the access log lines (offline) if m_qs_offline
+ * has been set (use qs_set2OfflineMode() to enable
+ * the offline mode).
+ *
+ * @param tme Set to the time since the Epoch in seconds.
+ */
+void qs_time(time_t *tme) {
+  if(m_qs_offline) {
+    /* use virtual time from the access log */
+    *tme = m_qs_virtualSystemTime;
+  } else {
+    time(tme);
+  }
+}
+
+/**
+ * Sets time measurement (qs_time()) to offline mode.
+ */
+void qs_set2OfflineMode() {
+  m_qs_offline = 1;
+}
+
+/* 
+ * Updates the virtual time.
+ */
+void qs_setTime(time_t tme) {
+  m_qs_virtualSystemTime = tme;
+}
+
+/* synchronisation -------------------------------------------- */
+/*
+ * locks all counter
+ */
+void qs_csLock() {
+  pthread_mutex_lock(&m_qs_lock_cs);
+}
+
+/*
+ * unlocks all counter
+ */
+void qs_csUnLock() {
+  pthread_mutex_unlock(&m_qs_lock_cs);
+}
+
+/*
+ * init locks
+ */
+void qs_csInitLock() {
+  pthread_mutex_init(&m_qs_lock_cs, NULL);
+}
+
+/* logs ------------------------------------------------------- */
+
+/**
+ * Keeps only the specified number of files
+ *
+ * @param file_name Absolute file name
+ * @param generations Number of files to keep
+ */
+void qs_deleteOldFiles(const char *file_name, int generations) {
+  DIR *dir;
+  char dirname[QS_HUGE_STR];
+  char *p;
+  memset(dirname, 0, QS_HUGE_STR);
+  if(strlen(file_name) > (QS_HUGE_STR - 12)) {
+    // invalid file length
+    return;
+  }
+  if(strrchr(file_name, '/') == NULL) {
+    sprintf(dirname, "./%s", file_name);
+  } else {
+    strcpy(dirname, file_name);
+  }
+  p = strrchr(dirname, '/');
+  p[0] = '\0'; p++;
+  dir = opendir(dirname);
+  if(dir) {
+    int num = 0;
+    struct dirent *de;
+    char filename[QS_HUGE_STR];
+    snprintf(filename, sizeof(filename), "%s.20", p);
+    /* determine how many files to delete */
+    while((de = readdir(dir)) != 0) {
+      if(de->d_name && (strncmp(de->d_name, filename, strlen(filename)) == 0)) {
+	num++;
+      }
+    }
+    /* delete the oldest files (assumes they are ordered by their creation date) */
+    while(num > generations) {
+      char old[QS_HUGE_STR];
+      old[0] = '\0';
+      rewinddir(dir);
+      while((de = readdir(dir)) != 0) {
+	if(de->d_name && (strncmp(de->d_name, filename, strlen(filename)) == 0)) {
+	  if(strcmp(old, de->d_name) > 0) {
+	    snprintf(old, sizeof(old), "%s", de->d_name);
+	  } else {
+	    if(old[0] == '\0') {
+	      snprintf(old, sizeof(old), "%s", de->d_name);
+	    }
+	  }
+	}
+      }
+      {
+	/* build abs path and delete it */
+	char unl[QS_HUGE_STR];
+	snprintf(unl, sizeof(unl), "%s/%s", dirname, old);
+	unlink(unl);
+      }
+      num--;
+    }
+    closedir(dir);
+  }
+}
+
+/* user ------------------------------------------------------- */
+void qs_setuid(const char *username, const char *cmd) {
+  if(username && getuid() == 0) {
+    struct passwd *pwd = getpwnam(username);
+    uid_t uid, gid;
+    if(pwd == NULL) {
+      fprintf(stderr, "[%s] failed to switch user: unknown user id '%s'\n", cmd, username);
+      exit(1);
+    }
+    uid = pwd->pw_uid;
+    gid = pwd->pw_gid;
+    setgid(gid);
+    setuid(uid);
+    if(getuid() != uid) {
+      fprintf(stderr, "[%s] setuid failed (%s,%d)\n", cmd, username, uid);
+      exit(1);
+    }
+    if(getgid() != gid) {
+      fprintf(stderr, "[%s] setgid failed (%d)\n", cmd, gid);
+      exit(1);
+    }
+  }
+}
+/* pcre ------------------------------------------------------- */
+int qs_pregfree(void *p) {
+  qs_regfree((qs_regex_t *)p);
+  return 0;
+}
+
+void qs_regfree(qs_regex_t *preg) {
+  if(preg->state == 1) {
+    pcre2_code_free(preg->re_pcre);
+  }
+}
+
+int qs_regcomp(qs_regex_t *preg, const char *pattern, int cflags) {
+  unsigned int capcount;
+  size_t erroffset;
+  int errcode = 0;
+  int options = cflags;
+  preg->state = 0;
+
+  preg->re_pcre = pcre2_compile((const unsigned char *)pattern,
+				PCRE2_ZERO_TERMINATED, options, &errcode,
+				&erroffset, NULL);
+
+  if (preg->re_pcre == NULL) {
+    return 1;
+  }
+
+  pcre2_pattern_info((const pcre2_code *)preg->re_pcre,
+		     PCRE2_INFO_CAPTURECOUNT, &capcount);
+  preg->re_nsub = capcount;
+
+  preg->state = 1;
+  
+  return 0;
+}
+
+int qs_regexec_len(const qs_regex_t *preg, const char *buff,
+		   unsigned int len, unsigned int nmatch,
+		   qs_regmatch_t *pmatch, int eflags) {
+  int rc;
+  int options = 0;
+  match_vector_pt ovector = NULL;
+  unsigned int ncaps = (unsigned int)preg->re_nsub + 1;
+  match_data_pt data = pcre2_match_data_create(ncaps, NULL);
+
+  if (!data) {
+    return -1;
+  }
+
+  options = eflags;
+
+  rc = pcre2_match((const pcre2_code *)preg->re_pcre,
+		   (const unsigned char *)buff, len,
+		   0, options, data, NULL);
+  ovector = pcre2_get_ovector_pointer(data);
+  
+  if (rc >= 0) {
+    unsigned int n = rc, i;
+    if (n == 0 || n > nmatch)
+      rc = n = nmatch; /* All capture slots were filled in */
+    for (i = 0; i < n; i++) {
+      pmatch[i].rm_so = ovector[i * 2];
+      pmatch[i].rm_eo = ovector[i * 2 + 1];
+    }
+    for (; i < nmatch; i++) {
+      pmatch[i].rm_so = pmatch[i].rm_eo = -1;
+    }
+    pcre2_match_data_free(data);
+    return rc;
+  }
+  else {
+    pcre2_match_data_free(data);
+    
+    return -1;
+  }
+}
diff --git a/tools/src/qs_util.h b/tools/src/qs_util.h
new file mode 100644
index 0000000..fa0bc1c
--- /dev/null
+++ b/tools/src/qs_util.h
@@ -0,0 +1,98 @@
+/**
+ * Utilities for the quality of service module mod_qos.
+ *
+ * See http://mod-qos.sourceforge.net/ for further
+ * details.
+ *
+ * Copyright (C) 2023 Pascal Buchbinder
+ *
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+#ifndef QS_UTIL_H
+#define QS_UTIL_H
+
+/* ----------------------------------
+ * version info
+ * ---------------------------------- */
+static const char man_version[] = "11.74";
+static const char man_date[] = "May 2023";
+
+/* ----------------------------------
+ * definitions
+ * ---------------------------------- */
+/* huge (128kb) buffer supporting very long lines (twice as
+   much as Apache's rotatelogs uses */
+#define MAX_LINE_BUFFER 131072
+/* smaller buffer, e.g. for qslog */
+#define MAX_LINE 32768
+#define QS_HUGE_STR 2048
+#define CR 13
+#define LF 10
+
+/* ----------------------------------
+ * functions
+ * ---------------------------------- */
+char *qs_CMD(const char *cmd);
+void qs_man_print(int man, const char *fmt, ...);
+void qs_man_println(int man, const char *fmt, ...);
+
+/* io */
+int qs_getLine(char *s, int n);
+int qs_getLinef(char *s, int n, FILE *f);
+
+/* time */
+void qs_time(time_t *tme);
+void qs_set2OfflineMode();
+void qs_setTime(time_t tme);
+
+/* synchronisation */
+void qs_csInitLock();
+void qs_csLock();
+void qs_csUnLock();
+
+/* log */
+void qs_deleteOldFiles(const char *file_name, int generations);
+
+/* user */
+void qs_setuid(const char *username, const char *cmd);
+
+/* pcre */
+#define QS_MAX_REG_MATCH 10
+
+typedef struct {
+  int rm_so;
+  int rm_eo;
+} qs_regmatch_t;
+
+typedef struct {
+  void *re_pcre;
+  int re_nsub;
+  int state; 
+} qs_regex_t;
+
+int qs_pregfree(void *p);
+
+void qs_regfree(qs_regex_t *preg);
+
+int qs_regcomp(qs_regex_t *preg, const char *regex, int cflags);
+
+int qs_regexec_len(const qs_regex_t *preg, const char *buff,
+		   unsigned int len, unsigned int nmatch,
+		   qs_regmatch_t *pmatch, int eflags);
+
+#endif
diff --git a/tools/src/qscheck.c b/tools/src/qscheck.c
new file mode 100644
index 0000000..4b75c36
--- /dev/null
+++ b/tools/src/qscheck.c
@@ -0,0 +1,413 @@
+/**
+ * Utilities for the quality of service module mod_qos.
+ *
+ * qscheck.c: Monitor testing tcp connectivity to servers used by mod_proxy.
+ *
+ * See http://mod-qos.sourceforge.net/ for further
+ * details.
+ *
+ * Copyright (C) 2023 Pascal Buchbinder
+ *
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+static const char revision[] = "$Id: qscheck.c 2654 2022-05-13 09:12:42Z pbuchbinder $";
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <netdb.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include <ctype.h>
+#include <arpa/inet.h>
+
+#include "qs_util.h"
+
+//#include <config.h>
+
+#define CR 13
+#define LF 10
+#define QS_TIMEOUT 2
+#define QS_PROXYP "proxypass "
+#define QS_PROXYP_TAB "proxypass\t"
+#define QS_PROXYPR "proxypassreverse "
+#define QS_PROXYPR_TAB "proxypassreverse\t"
+#define QS_PROXYR "proxyremote "
+#define QS_PROXYR_TAB "proxyremote\t"
+#define QS_INCLUDE "nclude "
+#define QS_INCLUDE_TAB "nclude\t"
+#define QS_SERVERROOT "ServerRoot "
+#define QS_SERVERROOT_TAB "ServerRoot\t"
+
+static int m_verbose = 0;
+static char ServerRoot[1024];
+static char *checkedHosts = NULL;
+
+/**
+ * Prints usage text
+ */
+static void usage(char *cmd) {
+  printf("\n");
+  printf("Monitor program testing the TCP connectivity to servers.\n");
+  printf("\n");
+  printf("Usage: %s -c <httpd.conf> [-v]\n", cmd);
+  printf("\n");
+  printf("Verifies the connectivity to the server referred either\n");
+  printf("by the ProxyPass, ProxyPassReverse, or ProxyReverse\n");
+  printf("directive used by mod_proxy.\n");
+  printf("\n");
+  printf("You may alternatively use \"%s -i <hostname>:<port>\" if\n", cmd);
+  printf("you want to check the TCP connectivity to a single host.\n");
+  printf("\n");
+  printf("See http://mod-qos.sourceforge.net/ for further details.\n");
+  exit(1);
+}
+
+/**
+ * Opens a tcp connection
+ */
+static int ping(unsigned long address, int port) {
+  int status = 0;
+  struct sockaddr_in addr;
+  int skt;
+  addr.sin_addr.s_addr = address;
+  addr.sin_port = htons(port);
+  addr.sin_family = PF_INET;
+  skt = socket(PF_INET, SOCK_STREAM, IPPROTO_TCP);
+  if(skt != -1) {
+    int sflags = fcntl(skt,F_GETFL,0);
+    if(sflags >=0) {
+      /* set non blocking socket */
+      if(fcntl(skt,F_SETFL,sflags|O_NONBLOCK) >=0) {
+	/* this connect returns immediately */
+	int ret = connect(skt, (struct sockaddr*)&addr, sizeof(struct sockaddr_in));
+	if(fcntl(skt,F_SETFL,sflags) >=0) {
+	  socklen_t lon = sizeof(int); 
+	  int valopt;
+	  fd_set fd_w;
+	  struct timeval tme;
+	  tme.tv_sec = QS_TIMEOUT;
+	  tme.tv_usec = 0;
+	  FD_ZERO(&fd_w);
+	  FD_SET(skt, &fd_w);
+	  /* select returns -1 on timeout, else 1 (connected or refused) */
+	  if(select(FD_SETSIZE, NULL, &fd_w, NULL, &tme) > 0) {
+	    /* check the status of the socket in order to distinguish between
+	       connected or refused */
+	    if(getsockopt(skt, SOL_SOCKET, SO_ERROR, (void*)(&valopt), &lon) >= 0) {
+	      if(!valopt) {
+		/* UP ! */
+		status = 1;
+	      }
+	    }
+	  }
+	}
+      }
+    }
+  }
+  return status;
+}
+
+/**
+ * resolves host address
+ */
+static unsigned long getAddress(const char *hostname) {
+  int ip = 1;
+  int i = 0;
+  unsigned long address = 0L;
+  struct hostent *hoste;
+  for(i = 0; i < (int) strlen(hostname); i++) {
+    if((!isdigit((int) hostname[i])) && (hostname[i] != '.')) {
+      ip = 0;
+      break;
+    }
+  }
+  if (ip) {
+    address = inet_addr(hostname);
+    if(address == -1) {
+      return 0L;
+    }
+  } else {
+    hoste = gethostbyname(hostname);
+    if (!hoste || !hoste->h_addr_list[ 0 ]) {
+      /* can't resolve host name */
+      return 0L;
+    }
+    address = ((struct in_addr*)hoste->h_addr_list[ 0 ])->s_addr;
+  }
+  return address;
+}
+
+/*
+ * Checks a single host (parse host string, resolve address, ping).
+ */
+static int checkHost(const char *cmd, const char *filename, int ln, char *abs_url) {
+  int status = 1;
+  char *schema = abs_url;
+  char *host = NULL;
+  char *ports = NULL;
+  int port = 0;
+  char hp[1024];
+  unsigned long address;
+  char *x = strstr(abs_url, "://");
+  if(x == NULL) {
+    if(m_verbose) {
+      fprintf(stderr,"[%s]: ERROR, wrong syntax <%s> in %s on line %d\n",
+	      cmd, abs_url, filename, ln);
+    }
+    return 0;
+  }
+  x[0] = '\0'; x = x + strlen("://");
+  host = x;
+  ports = strchr(x, ':');
+  if(ports != NULL) {
+    ports[0] = '\0'; ports++;
+    x = strchr(ports, '/');
+    if(x == NULL) {
+      int i;
+      x = ports;
+      for(i=0;(x[i] != ' ') && (x[i] != '\t') && (x[i] != '\0'); i++);
+      x[i] = '\0';
+    } else {
+      x[0] = '\0';
+    }
+    port = atoi(ports);
+  } else {
+    ports = strchr(x, '/');
+    if(ports == NULL) {
+      int i;
+      for(i=0;(x[i] != ' ') && (x[i] != '\t') && (x[i] != '\0'); i++);
+      x[i] = '\0';
+    } else {
+      ports[0] = '\0';
+    }
+    if(strcmp(schema, "http") == 0) {
+      port = 80;
+    } else {
+      port = 443;
+    }
+  }
+  /* check each host only once */
+  snprintf(hp, sizeof(hp), "#%s:%d#", host, port);
+  if(checkedHosts && strstr(checkedHosts, hp) != NULL) {
+    /* already checked */
+    return 1;
+  }
+  if(checkedHosts == NULL) {
+    checkedHosts = calloc(1, strlen(hp) + 1);
+    strcpy(checkedHosts, hp);
+  } else {
+    int pl = strlen(checkedHosts) +strlen(hp) + 1;
+    char *p = calloc(1, pl);
+    snprintf(p, pl, "%s%s", checkedHosts, hp);
+    free(checkedHosts);
+    checkedHosts = p;
+  }
+  /* resolve address */
+  address = getAddress(host);
+  if(address == 0L) {
+    fprintf(stderr,"[%s]: ERROR, could not resolve hostname %s\n", cmd, host);
+    return -1;
+  }
+  /* check connection */
+  if(ping(address, port)) {
+    if(m_verbose) {
+      printf("[%s]: %s:%d Up\n", cmd, host, port);
+    }
+    return 1;
+  } else {
+    printf("[%s]: %s:%d Down\n", cmd, host, port);
+    return 0;
+  }
+}
+
+/**
+ * Open file and check every ProxyPass* or ProxyR* entry.
+ * - follows include ... directive
+ * - determines serverroot
+ */
+static int checkFile(const char *cmd, const char *filename) {
+  int status = 1;
+  int ln = 0;
+  char line[1024];
+  FILE *f = fopen(filename, "r");
+  if(f == NULL) {
+    if(ServerRoot[0] != '\0') {
+      char fqfile[2048];
+      snprintf(fqfile, sizeof(fqfile), "%s/%s", ServerRoot, filename);
+      f = fopen(fqfile, "r");
+    }
+  }
+  if(f == NULL) {
+    fprintf(stderr,"[%s]: ERROR, could not open file %s\n", cmd, filename);
+    return 0;
+  }
+
+  while(!qs_getLinef(line, sizeof(line), f)) {
+    char *command = NULL;
+    int cmd_len = 0;
+    int to = 0;
+    while(line[to]) {
+      line[to] = tolower(line[to]);
+      to++;
+    }
+    ln++;
+    command = strstr(line, QS_PROXYP);
+    cmd_len = strlen(QS_PROXYP);
+    if(command == NULL) command = strstr(line, QS_PROXYP_TAB);
+    if(command == NULL) {
+      command = strstr(line, QS_PROXYPR);
+      cmd_len = strlen(QS_PROXYPR);
+    }
+    if(command == NULL) command = strstr(line, QS_PROXYPR_TAB);
+    if(command == NULL) {
+      command = strstr(line, QS_PROXYR);
+      cmd_len = strlen(QS_PROXYR);
+    }
+    if(command == NULL) command = strstr(line, QS_PROXYR_TAB);
+    if(command && strchr(line, '#') == 0) {
+      /* command = cmd url schema://host[:port]/url */
+      char *abs_url = &command[cmd_len];
+      int i, j;
+
+      /* get the url */
+      for(i=0;(abs_url[i] == ' ') || (abs_url[i] == '\t'); i++);
+      abs_url = &abs_url[i];
+
+      /* skip url */
+      for(i=0;(abs_url[i] != ' ') && (abs_url[i] != '\t') && (abs_url[i] != '\0'); i++);
+      abs_url = &abs_url[i];
+
+      /* get schema://host[:port]/url */
+      for(i=0;(abs_url[i] == ' ') || (abs_url[i] == '\t'); i++);
+      abs_url = &abs_url[i];
+
+      /* ping */
+      if(abs_url && abs_url[0] != '\0' && abs_url[0] != '!') {
+	status = status & checkHost(cmd, filename, ln, abs_url);
+      }
+    } else {
+      /* include commands */
+      command = strstr(line, QS_INCLUDE);
+      if(command == NULL) command = strstr(line, QS_INCLUDE_TAB);
+      if(command && strchr(line, '#') == 0) {
+	char *file = &command[strlen(QS_INCLUDE)];
+	int i, j;
+	/* get the value */
+	for(i=0;(file[i] == ' ') || (file[i] == '\t'); i++);
+	/* delete spaces at the end of the value */
+	if(&file[i] != '\0') {
+	  for(j=i+1;(file[j] != ' ') && (file[j] != '\t') && (file[j] != '\0'); j++);
+	  file[j] = '\0';
+	}
+	file = &file[i];
+	status = status & checkFile(cmd, file);
+      } else {
+	/* server root */
+	command = strstr(line, QS_SERVERROOT);
+	if(command == NULL) command = strstr(line, QS_SERVERROOT_TAB);
+	if(command && strchr(line, '#') == 0) {
+	  char *sr = &command[strlen(QS_SERVERROOT)];
+	  int i, j;
+	  /* get the value */
+	  for(i=0;(sr[i] == ' ') || (sr[i] == '\t'); i++);
+	  /* delete spaces at the end of the value */
+	  if(&sr[i] != '\0') {
+	    for(j=i+1;(sr[j] != ' ') && (sr[j] != '\t') && (sr[j] != '\0'); j++);
+	    sr[j] = '\0';
+	  }
+	  strcpy(ServerRoot, &sr[i]);
+	}
+      }
+    }
+  }
+  fclose(f);
+  return status;
+}
+
+int main(int argc, char **argv) {
+  char *config = NULL;
+  char *cmd = strrchr(argv[0], '/');
+  char *single = NULL;
+  int status = 1;
+  if(cmd == NULL) {
+    cmd = argv[0];
+  } else {
+    cmd++;
+  }
+  ServerRoot[0] = '\0';
+  while(argc >= 1) {
+    if(strcmp(*argv,"-c") == 0) {
+      if (--argc >= 1) {
+	config = *(++argv);
+      }
+    } else if(strcmp(*argv,"-i") == 0) {
+      if (--argc >= 1) {
+	single = *(++argv);
+      }
+    } else if(strcmp(*argv,"-v") == 0) {
+      m_verbose = 1;
+    }
+    argc--;
+    argv++;
+  }
+  if(single) {
+    char *hostName = single;
+    char *portNumber = strchr(single, ':');
+    if(portNumber) {
+      unsigned long addr;
+      int prt;
+      portNumber[0] = '\0';
+      portNumber++;
+      addr = getAddress(hostName);
+      prt = atoi(portNumber);
+      if(addr && prt) {
+	if(ping(addr, prt)) {
+	  if(m_verbose) {
+	    printf("[%s]: %s:%d Up\n", cmd, hostName, prt);
+	  }
+	  status = 1;
+	} else {
+	  printf("[%s]: %s:%d Down\n", cmd, hostName, prt);
+	  status = 0;
+	}
+      } else {
+	// could not resolve
+	fprintf(stderr,"[%s]: ERROR, unknown host/port\n", cmd); 
+	status = 0;
+      }
+    } else {
+      // invalid input
+      fprintf(stderr,"[%s]: ERROR, invalid format\n", cmd); 
+      status = 0;
+    }
+  } else {
+    if(config == NULL) {
+      usage(cmd);
+    }
+    status = checkFile(cmd, config);
+  }
+  if(status == 0) {
+    fprintf(stderr,"[%s]: ERROR, check failed\n", cmd);
+    exit(1);
+  }
+  printf("[%s]: OK, check successful\n", cmd);
+  return 0;
+}
diff --git a/tools/src/qsdt.c b/tools/src/qsdt.c
new file mode 100644
index 0000000..b2c9747
--- /dev/null
+++ b/tools/src/qsdt.c
@@ -0,0 +1,336 @@
+/**
+ * Utility for the quality of service module mod_qos.
+ *
+ * qsdt.c: simple tool to measure the elapse time between 
+ *         related log messages
+ *
+ * See http://mod-qos.sourceforge.net/ for further
+ * details.
+ *
+ * Copyright (C) 2023 Pascal Buchbinder
+ *
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+#include <stdio.h>
+#include <string.h>
+
+#include <stdlib.h>
+#include <unistd.h>
+#include <time.h>
+
+#include <sys/types.h>
+#include <regex.h>
+
+#include <apr.h>
+#include <apr_portable.h>
+#include <apr_strings.h>
+
+#include "qs_util.h"
+
+#define MAX_REG_MATCH 10
+
+#define TIMESTR "%H:%M:%S"
+#define TIMEEX "([0-9]{2}:[0-9]{2}:[0-9]{2})[.,]([0-9]{3})"
+
+typedef struct {
+  time_t seconds;
+  int milliseconds;
+  char *id;
+} entry_t;
+
+
+static void usage(const char *cmd, int man) {
+  if(man) {
+    //.TH [name of program] [section number] [center footer] [left footer] [center header]
+    printf(".TH %s 1 \"%s\" \"mod_qos utilities %s\" \"%s man page\"\n", qs_CMD(cmd), man_date,
+	   man_version, cmd);
+  }
+  printf("\n");
+
+  if(man) {
+    printf(".SH NAME\n");
+  }
+  qs_man_print(man, "%s calculates the elapsed time between two related log messages.\n", cmd);
+  printf("\n");
+
+  if(man) {
+    printf(".SH SYNOPSIS\n");
+  }
+  qs_man_print(man, "%s%s [-t <regex>] -i <regex> -s <regex> -e <regex> [-v] [<path>]\n", man ? "" : "Usage: ", cmd);
+  printf("\n");
+
+  if(man) {
+    printf(".SH DESCRIPTION\n");
+  } else {
+    printf("Summary\n");
+  }
+  qs_man_print(man, "%s is a simple tool to search two different messages\n", cmd);
+  qs_man_print(man, "in a log file and calculates the elapsed time between these\n");
+  qs_man_print(man, "lines. The two log messages need a common identifier such an\n");
+  qs_man_print(man, "unique request id (UNIQUE_ID), a thread id, or a transaction\n");
+  qs_man_print(man, "code.\n");
+  printf("\n");
+
+  if(man) {
+    printf(".SH OPTIONS\n");
+  } else {
+    printf("Options\n");
+  }
+  if(man) printf(".TP\n");
+  qs_man_print(man, "  -t <regex>\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Defines a pattern (regular expression) matching the log line's\n");
+  qs_man_print(man, "     timestamp. The pattern must include two sub-expressions, one matching\n");
+  qs_man_print(man, "     hours, minutes and seconds the other matching the milliseconds.\n");
+  qs_man_print(man, "     Default pattern is "TIMEEX"\n");
+  if(man) printf("\n.TP\n");
+  qs_man_print(man, "  -i <regex>\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Pattern (regular expression) matching the identifier which the two\n");
+  qs_man_print(man, "     messages have in common. The sub-expression defines the part which\n");
+  qs_man_print(man, "     needs to be extracted from the matching string. Note: You can also\n");
+  qs_man_print(man, "     use the start (-s) and end (-e) pattern to define the sub-expression\n");
+  qs_man_print(man, "     matching this identifier.\n");
+  if(man) printf("\n.TP\n");
+  qs_man_print(man, "  -s <regex>\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Defines the pattern (regular expression or literal string)\n");
+  qs_man_print(man, "     identifying the first (start) of the two messages.\n");
+  if(man) printf("\n.TP\n");
+  qs_man_print(man, "  -e <regex>\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Defines the pattern (regular expression or literal string)\n");
+  qs_man_print(man, "     identifying the second (end) of the two messages.\n");
+  if(man) printf("\n.TP\n");
+  qs_man_print(man, " -v\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Verbose mode.\n");
+  if(man) printf("\n.TP\n");
+  qs_man_print(man, "  <path>\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Defines the input file to process. %s reads from\n", cmd);
+  qs_man_print(man, "     from standard input if this parameter is omitted.\n");
+  printf("\n");
+  if(man) {
+    printf(".SH EXAMPLE\n");
+    printf("Sample command line arguments:\n");
+    printf("\n");
+  } else {
+    printf(" Sample arguments:\n");
+  }
+  qs_man_println(man, "  -i ' ([a-z0-9]+) [A-Z]+ ' -s 'Received Request' -e 'Received Response'\n");
+  printf("\n");
+  qs_man_println(man, " matching those sample log messages:\n");
+  qs_man_println(man, "  2018-03-12 16:34:08.653 threadid23 INFO Received Request\n");
+  qs_man_println(man, "  2018-03-13 16:35:09.891 threadid23 DEBUG MessageHandler Received Response\n");
+  printf("\n");
+  if(man) {
+    printf(".SH NOTE\n");
+  } else {
+    printf("Notes:\n");
+  }
+  qs_man_println(man, "The four patterns (t,i,s,e) are concatenated into two search patterns:\n");
+  qs_man_println(man, " first (start): [t (HH:MM:SS)(SSS) ].*[i (id) ].*[s ]\n");
+  qs_man_println(man, " second (end):  [t (HH:MM:SS)(SSS) ].*[i (id) ].*[e ]\n");
+  printf("\n");
+  qs_man_print(man, "And the three sub-expression are used to extract the timestamp and the\n");
+  qs_man_print(man, "unique identifier that the start and end message have in common.\n");
+  qs_man_print(man, "This means that you could specify the sub-expression for the unique\n");
+  qs_man_print(man, "identifier in the start (-s) or end (-e) pattern alternatively, e.g. in\n");
+  qs_man_print(man, "case the identifier is at the end of the log line.\n");
+  printf("\n");
+  if(man) {
+    printf(".SH SEE ALSO\n");
+    printf("qsexec(1), qsfilter2(1), qsgeo(1), qsgrep(1), qshead(1), qslog(1), qslogger(1), qspng(1), qsre(1), qsrespeed(1), qsrotate(1), qssign(1), qstail(1)\n");
+    printf(".SH AUTHOR\n");
+    printf("Pascal Buchbinder, http://mod-qos.sourceforge.net/\n");
+  } else {
+    printf("See http://mod-qos.sourceforge.net/ for further details.\n");
+  }
+  if(man) {
+    exit(0);
+  } else {
+    exit(1);
+  }
+}
+
+
+int main(int argc, const char *const argv[]) {
+  FILE *file;
+  char line[MAX_LINE];
+  int verbose = 0;
+  
+  const char *cmd = strrchr(argv[0], '/');
+
+  apr_pool_t *pool;
+  apr_table_t *inmsg;
+ 
+  regmatch_t ma[MAX_REG_MATCH];
+  regex_t pregstart;
+  regex_t pregend;
+
+  const char *timeex = TIMEEX;
+  const char *idex = NULL;
+  const char *startex = NULL;
+  const char *endex = NULL;
+  const char *filename = NULL;
+  
+  char *regexStr;
+  
+  apr_app_initialize(&argc, &argv, NULL);
+  apr_pool_create(&pool, NULL);
+  inmsg = apr_table_make(pool, 100);
+
+  if(cmd == NULL) {
+    cmd = (char *)argv[0];
+  } else {
+    cmd++;
+  }
+
+  argc--;
+  argv++;
+  while(argc >= 1) {
+    if(strcmp(*argv,"-t") == 0) {
+      if (--argc >= 1) {
+        timeex = *(++argv);
+      }
+    } else if(strcmp(*argv,"-i") == 0) {
+      if (--argc >= 1) {
+        idex = *(++argv);
+      }
+    } else if(strcmp(*argv,"-s") == 0) {
+      if (--argc >= 1) {
+        startex = *(++argv);
+      }
+    } else if(strcmp(*argv,"-e") == 0) {
+      if (--argc >= 1) {
+        endex = *(++argv);
+      }
+    } else if(strcmp(*argv,"-v") == 0) {
+      verbose = 1;
+    } else if(strcmp(*argv,"-h") == 0) {
+      usage(cmd, 0);
+    } else if(strcmp(*argv,"--help") == 0) {
+      usage(cmd, 0);
+    } else if(strcmp(*argv,"-?") == 0) {
+      usage(cmd, 0);
+    } else if(strcmp(*argv,"--man") == 0) {
+      usage(cmd, 1);
+    } else {
+      filename = *argv;
+    }
+    argc--;
+    argv++;
+  }
+
+  if(idex == NULL || startex == NULL || endex == NULL) {
+    usage(cmd, 0);
+  }
+
+  if(filename) {
+    file = fopen(filename, "r");
+    if(!file) {
+      fprintf(stderr, "ERROR, failed to open the log file '%s'\n", filename);
+      exit(1);
+    }
+  } else {
+    file = stdin;
+  }
+
+
+  regexStr = apr_psprintf(pool, "%s.*%s.*%s", timeex, idex, startex);
+  if(verbose) {
+    fprintf(stderr, "start pattern: %s\n", regexStr);
+  }
+  if(regcomp(&pregstart, regexStr, REG_EXTENDED)) {
+    fprintf(stderr, "ERROR, could not compile %s\n", regexStr);
+    exit(1);
+  };
+  regexStr = apr_psprintf(pool, "%s.*%s.*%s", timeex, idex, endex);
+  if(verbose) {
+    fprintf(stderr, "end pattern: %s\n", regexStr);
+  }
+  if(regcomp(&pregend, regexStr, REG_EXTENDED)) {
+    fprintf(stderr, "ERROR, could not compile %s\n", regexStr);
+    exit(1);
+  };
+
+  while(fgets(line, MAX_LINE-1, file) != NULL) {
+    char *hms;
+    char *ms;
+    char *id;
+    if(regexec(&pregstart, line, MAX_REG_MATCH, ma, 0) == 0) {
+      entry_t *entry = calloc(1, sizeof(entry_t));
+      struct tm tm;
+      if(ma[3].rm_so == -1) {
+	fprintf(stderr, "ERROR, invalid regular expression (missing sub-expression in pattern)\n");
+	exit(1);
+      }
+      hms = &line[ma[1].rm_so];
+      ms = &line[ma[2].rm_so];
+      id = &line[ma[3].rm_so];
+      line[ma[1].rm_eo] = '\0';
+      line[ma[2].rm_eo] = '\0';
+      line[ma[3].rm_eo] = '\0';
+      strptime(hms, TIMESTR, &tm);
+      entry->seconds = mktime(&tm);
+      entry->milliseconds = atoi(ms);
+      entry->id = calloc(strlen(id)+1, sizeof(char));
+      sprintf(entry->id, "%s", id);
+      if(verbose) {
+	fprintf(stderr, "START [%s][%s][%s] %lu %d\n",
+		hms, ms, id, entry->seconds, entry->milliseconds);
+      }
+      apr_table_setn(inmsg, entry->id, (char *)entry);
+    } else if(regexec(&pregend, line, MAX_REG_MATCH, ma, 0) == 0) {
+      entry_t entry;
+      entry_t *start;
+      struct tm tm;
+      if(ma[3].rm_so == -1) {
+	fprintf(stderr, "ERROR, invalid regular expression (missing sub-expression in pattern)\n");
+	exit(1);
+      }
+      hms = &line[ma[1].rm_so];
+      ms = &line[ma[2].rm_so];
+      id = &line[ma[3].rm_so];
+      line[ma[1].rm_eo] = '\0';
+      line[ma[2].rm_eo] = '\0';
+      line[ma[3].rm_eo] = '\0';
+      strptime(hms, TIMESTR, &tm);
+      entry.seconds = mktime(&tm);
+      entry.milliseconds = atoi(ms);
+      if(verbose) {
+	fprintf(stderr, "END [%s][%s][%s] %lu %d\n",
+		hms, ms, id, entry.seconds, entry.milliseconds);
+      }
+      start = (entry_t *)apr_table_get(inmsg, id);
+      if(start) {
+	printf("@%s %s %10lu [ms]\n",
+	       line,
+	       id,
+	       (entry.seconds-start->seconds)*1000 + entry.milliseconds-start->milliseconds);
+	apr_table_unset(inmsg, id);
+	free(start->id);
+	free(start);
+      }
+    }
+  }
+  fclose(file);
+
+  return 0;
+}
diff --git a/tools/src/qsexec.c b/tools/src/qsexec.c
new file mode 100644
index 0000000..8a56b3e
--- /dev/null
+++ b/tools/src/qsexec.c
@@ -0,0 +1,376 @@
+/* -*-mode: c; indent-tabs-mode: nil; c-basic-offset: 2; -*-
+ */
+/**
+ * Command line execution utility for the quality of service module mod_qos.
+ *
+ * See http://mod-qos.sourceforge.net/ for further details.
+ *
+ * Copyright (C) 2023 Pascal Buchbinder
+ *
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+static const char revision[] = "$Id: qsexec.c 2654 2022-05-13 09:12:42Z pbuchbinder $";
+
+/* system */
+#include <stdio.h>
+#include <string.h>
+
+#include <stdlib.h>
+#include <unistd.h>
+#include <time.h>
+
+/* apr */
+#include <apr.h>
+#include <apr_strings.h>
+#include <apr_file_io.h>
+#include <apr_time.h>
+#include <apr_getopt.h>
+#include <apr_general.h>
+#include <apr_lib.h>
+#include <apr_portable.h>
+#include <apr_support.h>
+
+#define PCRE2_CODE_UNIT_WIDTH 8
+#include <pcre2.h>
+
+#include "qs_util.h"
+
+#ifndef POSIX_MALLOC_THRESHOLD
+#define POSIX_MALLOC_THRESHOLD (10)
+#endif
+
+/* same as APR_SIZE_MAX which doesn't appear until APR 1.3 */
+#define QSUTIL_SIZE_MAX (~((apr_size_t)0))
+
+typedef struct {
+    int rm_so;
+    int rm_eo;
+} regmatch_t;
+
+static void usage(char *cmd, int man) {
+  if(man) {
+    //.TH [name of program] [section number] [center footer] [left footer] [center header]
+    printf(".TH %s 1 \"%s\" \"mod_qos utilities %s\" \"%s man page\n", qs_CMD(cmd), man_date, man_version, cmd);
+  }
+  printf("\n");
+  if(man) {
+    printf(".SH NAME\n");
+  }
+  printf("%s %s- parses the data received via stdin and executes the defined command on a pattern match.\n",
+         cmd, man ? "\\" : "");
+  printf("\n");
+  if(man) {
+    printf(".SH SYNOPSIS\n");
+  }
+  qs_man_print(man, "%s%s -e <pattern> [-t <number>:<sec>] [-c <pattern> [<command string>]]\n", man ? "" : "Usage: ", cmd);
+  qs_man_print(man, "       [-p] [-u <user>] <command string>\n");
+  printf("\n");
+  if(man) {
+    printf(".SH DESCRIPTION\n");
+  } else {
+    printf("Summary\n");
+  }
+  qs_man_print(man, "%s reads log lines from stdin and searches for the defined pattern.\n", cmd);
+  qs_man_print(man, "It executes the defined command string on pattern match.\n");
+  printf("\n");
+  if(man) {
+    printf(".SH OPTIONS\n");
+  } else {
+    printf("Options\n");
+  }
+  if(man) printf(".TP\n");
+  qs_man_print(man, "  -e <pattern>\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Specifies the search pattern causing an event which shall trigger the\n");
+  qs_man_print(man, "     command.\n");
+  if(man) printf("\n.TP\n");
+  qs_man_print(man, "  -t <number>:<sec>\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Defines the number of pattern match within the the defined number of\n");
+  qs_man_print(man, "     seconds in order to trigger the command execution. By default, every\n");
+  qs_man_print(man, "     pattern match causes a command execution.\n");
+  if(man) printf("\n.TP\n");
+  qs_man_print(man, "  -c <pattern> [<command string>]\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Pattern which clears the event counter. Executes optionally a command\n");
+  qs_man_print(man, "     if an event command has been executed before.\n");
+  if(man) printf("\n.TP\n");
+  qs_man_print(man, "  -p\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Writes data also to stdout (for piped logging).\n");
+  if(man) printf("\n.TP\n");
+  qs_man_print(man, "  -u <name>\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Become another user, e.g. www-data.\n");
+  if(man) printf("\n.TP\n");
+  qs_man_print(man, "  <command string>\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Defines the event command string where $0-$9 are substituted by the\n");
+  qs_man_print(man, "     submatches of the regular expression.\n");
+  printf("\n");
+  if(man) {
+    printf(".SH EXAMPLE\n");
+  } else {
+    printf("Example:\n");
+  }
+  qs_man_print(man, "Executes the deny.sh script providing the IP address of the\n");
+  qs_man_print(man, "client causing a mod_qos(031) messages whenever the log message\n");
+  qs_man_print(man, "appears 10 times within at most one minute:\n");
+  if(man) printf("\n");
+  qs_man_println(man, "  ErrorLog \"|/usr/bin/%s -e \\'mod_qos\\(031\\).*, c=([0-9a-zA-Z:.]*)\\' -t 10:60 \\'/usr/local/bin/deny.sh $1\\'\"\n", cmd);
+  printf("\n");
+  if(man) {
+    printf(".SH SEE ALSO\n");
+    printf("qsdt(1), qsfilter2(1), qsgeo(1), qsgrep(1), qshead(1), qslog(1), qslogger(1), qspng(1), qsre(1), qsrespeed(1), qsrotate(1), qssign(1), qstail(1)\n");
+    printf(".SH AUTHOR\n");
+    printf("Pascal Buchbinder, http://mod-qos.sourceforge.net/\n");
+  } else {
+    printf("See http://mod-qos.sourceforge.net/ for further details.\n");
+  }
+  if(man) {
+    exit(0);
+  } else {
+    exit(1);
+  }
+}
+
+/*
+ * Substitutes for $0-$9 within the matching string.
+ * See ap_pregsub().
+ */
+char *qs_pregsub(apr_pool_t *pool, const char *input,
+		 const char *source, size_t nmatch,
+		 qs_regmatch_t pmatch[]) {
+  const char *src = input;
+  char *dest, *dst;
+  char c;
+  size_t no;
+  int len;
+  if(!source) {
+    return NULL;
+  }
+  if(!nmatch) {
+    return apr_pstrdup(pool, src);
+  }
+  /* First pass, find the size */  
+  len = 0;
+  while((c = *src++) != '\0') {
+    if(c == '&')
+      no = 0;
+    else if (c == '$' && apr_isdigit(*src))
+      no = *src++ - '0';
+    else
+      no = 10;
+    
+    if (no > 9) {                /* Ordinary character. */
+      if (c == '\\' && (*src == '$' || *src == '&'))
+	src++;
+      len++;
+    }
+    else if (no < nmatch && pmatch[no].rm_so < pmatch[no].rm_eo) {
+      if(QSUTIL_SIZE_MAX - len <= pmatch[no].rm_eo - pmatch[no].rm_so) {
+        fprintf(stderr, "ERROR, integer overflow or out of memory condition");
+        return NULL;
+      }
+      len += pmatch[no].rm_eo - pmatch[no].rm_so;
+    }
+    
+  }
+  dest = dst = apr_pcalloc(pool, len + 1);
+  /* Now actually fill in the string */
+  src = input;
+  while ((c = *src++) != '\0') {
+    if (c == '&')
+      no = 0;
+    else if (c == '$' && apr_isdigit(*src))
+      no = *src++ - '0';
+    else
+      no = 10;
+
+    if (no > 9) {                /* Ordinary character. */
+      if (c == '\\' && (*src == '$' || *src == '&'))
+        c = *src++;
+      *dst++ = c;
+    }
+    else if (no < nmatch && pmatch[no].rm_so < pmatch[no].rm_eo) {
+      len = pmatch[no].rm_eo - pmatch[no].rm_so;
+      memcpy(dst, source + pmatch[no].rm_so, len);
+      dst += len;
+    }
+  }
+  *dst = '\0';
+  return dest;
+}
+
+int main(int argc, const char * const argv[]) {
+  const char *username = NULL;
+  int nr = 0;
+  char *line = calloc(1, MAX_LINE_BUFFER+1);
+  apr_pool_t *pool;
+  char *cmd = strrchr(argv[0], '/');
+  const char *command = NULL;
+  const char *pattern = NULL;
+  const char *clearcommand = NULL;
+  const char *clearpattern = NULL;
+  int executed = 0;
+  qs_regex_t *preg;
+  qs_regex_t *clearpreg;
+  qs_regmatch_t regm[QS_MAX_REG_MATCH];
+  time_t sec = 0;
+  int threshold = 0;
+  int counter = 0;
+  time_t countertime;
+  static int pass = 0;
+  apr_app_initialize(&argc, &argv, NULL);
+  apr_pool_create(&pool, NULL);
+
+  if(cmd == NULL) {
+    cmd = (char *)argv[0];
+  } else {
+    cmd++;
+  }
+
+  argc--;
+  argv++;
+  while(argc >= 1) {
+    if(strcmp(*argv,"-e") == 0) {
+      if (--argc >= 1) {
+	pattern = *(++argv);
+      }
+    } else if(strcmp(*argv,"-u") == 0) {
+      if (--argc >= 1) {
+	username = *(++argv);
+      }
+    } else if(strcmp(*argv,"-c") == 0) {
+      if (--argc >= 1) {
+	clearpattern = *(++argv);
+	if (argc >=1 && *argv[0] != '-') {
+	  clearcommand = *(++argv);
+	  argc--;
+	}
+      }
+    } else if(argc >= 1 && strcmp(*argv,"-t") == 0) {
+      if (--argc >= 1) {
+	char *str = apr_pstrdup(pool, *(++argv));
+	char *tme = strchr(str, ':');
+	if(tme == NULL) {
+	  fprintf(stderr,"[%s]: ERROR, invalid number:sec format\n", cmd);
+	  exit(1);
+	}
+	tme[0] = '\0';
+	tme++;
+	threshold = atoi(str);
+	sec = atol(tme);
+	if(threshold == 0 || sec == 0) {
+	  fprintf(stderr,"[%s]: ERROR, invalid number:sec format\n", cmd);
+	  exit(1);
+	}
+      }
+    } else if(argc >= 1 && strcmp(*argv,"-p") == 0) {
+      pass = 1;
+    } else if(strcmp(*argv,"-h") == 0) {
+      usage(cmd, 0);
+    } else if(strcmp(*argv,"-?") == 0) {
+      usage(cmd, 0);
+    } else if(strcmp(*argv,"-help") == 0) {
+      usage(cmd, 0);
+    } else if(strcmp(*argv,"--help") == 0) {
+      usage(cmd, 0);
+    } else if(strcmp(*argv,"--man") == 0) {
+      usage(cmd, 1);
+    } else {
+      command = *argv;
+    }
+    argc--;
+    argv++;
+  }
+
+  if(pattern == NULL || command == NULL) {
+    usage(cmd, 0);
+  }
+
+  qs_setuid(username, cmd);
+
+  preg = apr_palloc(pool, sizeof(qs_regex_t));
+  if(qs_regcomp(preg, pattern, PCRE2_DOTALL) != 0) {
+    fprintf(stderr, "ERROR, could not compile '%s'\n", pattern);
+    exit(1);
+  }
+  apr_pool_pre_cleanup_register(pool, preg, qs_pregfree);
+  if(clearpattern) {
+    clearpreg = apr_palloc(pool, sizeof(qs_regex_t));
+    if(qs_regcomp(clearpreg, clearpattern, PCRE2_DOTALL) != 0) {
+      fprintf(stderr, "ERROR, could not compile '%s'\n", clearpattern);
+      exit(1);
+    }
+    apr_pool_pre_cleanup_register(pool, clearpattern, qs_pregfree);
+  }
+
+  while(fgets(line, MAX_LINE_BUFFER, stdin) != NULL) {
+    size_t len;
+    nr++;
+    if(pass) {
+      printf("%s", line);
+      fflush(stdout);
+    }
+    len = strlen(line);
+    if(clearpattern && (qs_regexec_len(clearpreg, line, len, QS_MAX_REG_MATCH, regm, 0) >= 0)) {
+      apr_pool_t *subpool;
+      apr_pool_create(&subpool, pool);
+      counter = 0;
+      countertime = 0;
+      if(clearcommand && executed) {
+	char *replaced = qs_pregsub(subpool, clearcommand, line, QS_MAX_REG_MATCH, regm);
+	if(!replaced) {
+	  fprintf(stderr, "[%s]: ERROR, failed to substitute"
+                  " submatches '%s' in (%s)\n", cmd, clearcommand, line);
+	} else {
+	  int rc = system(replaced);
+	}
+	executed = 0;
+      }
+      apr_pool_destroy(subpool);
+    } else if(qs_regexec_len(preg, line, len, QS_MAX_REG_MATCH, regm, 0) >= 0) {
+      apr_pool_t *subpool;
+      char *replaced;
+      apr_pool_create(&subpool, pool);
+      replaced = qs_pregsub(subpool, command, line, QS_MAX_REG_MATCH, regm);
+      if(!replaced) {
+	fprintf(stderr, "[%s]: ERROR, failed to substitute"
+                " submatches '%s' in (%s)\n", cmd, command, line);
+      } else {
+	counter++;
+	if(counter == 1) {
+	  countertime = time(NULL);
+	}
+	if(counter >= threshold) {
+	  if(countertime + sec >= time(NULL)) {
+	    int rc = system(replaced);
+	    executed = 1;
+	  }
+	  countertime = 0;
+	  counter = 0;
+	}
+      }
+      apr_pool_destroy(subpool);
+    }
+  }
+  
+  apr_pool_destroy(pool);
+  return 0;
+}
diff --git a/tools/src/qsfilter2.c b/tools/src/qsfilter2.c
new file mode 100644
index 0000000..603085e
--- /dev/null
+++ b/tools/src/qsfilter2.c
@@ -0,0 +1,1826 @@
+/* -*-mode: c; indent-tabs-mode: nil; c-basic-offset: 2; -*-
+ */
+/**
+ * Filter utilities for the quality of service module mod_qos
+ * used to create allow list rules for request line filters.
+ *
+ * See http://mod-qos.sourceforge.net/ for further
+ * details.
+ *
+ * Copyright (C) 2023 Pascal Buchbinder
+ *
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+static const char revision[] = "$Id: qsfilter2.c 2654 2022-05-13 09:12:42Z pbuchbinder $";
+
+/* system */
+#include <stdio.h>
+#include <errno.h>
+#include <string.h>
+
+#include <stdlib.h>
+#include <unistd.h>
+#include <time.h>
+
+/* apr */
+#include <apr.h>
+#include <apr_uri.h>
+#include <apr_signal.h>
+#include <apr_strings.h>
+#include <apr_network_io.h>
+#include <apr_file_io.h>
+#include <apr_time.h>
+#include <apr_getopt.h>
+#include <apr_general.h>
+#include <apr_lib.h>
+#include <apr_portable.h>
+#include <apr_thread_proc.h>
+#include <apr_thread_cond.h>
+#include <apr_thread_mutex.h>
+#include <apr_support.h>
+//#include <ap_config.h>
+
+/* OpenSSL  */
+#include <openssl/safestack.h>
+
+#define PCRE2_CODE_UNIT_WIDTH 8
+#include <pcre2.h>
+
+#include "qs_util.h"
+
+#define MAX_LINE 32768
+/* 2mb */
+#define MAX_BODY_BUFFER 2097152
+#define CR 13
+#define LF 10
+
+typedef enum  {
+  QS_UT_PATH,
+  QS_UT_QUERY
+} qs_url_type_e;
+
+#define QS_PCRE_RESERVED      "{}[]()^$.|*+?\\-"
+//#define QS_PCRE_RESERVED      "{}[]()^$.|*+?\"'\\-"
+
+/* reserved (to be escaped): {}[]()^$.|*+?\- */
+#define QS_UNRESERVED         "a-zA-Z0-9-\\._~% "
+#define QS_GEN                ":/\\?#\\[\\]@"
+#define QS_SUB                "!$&'\\(\\)\\*\\+,;="
+#define QS_SUB_S              "!$&\\(\\)\\*\\+,;="
+
+#define QS_SIMPLE_PATH_PCRE   "(/[a-zA-Z0-9\\-_]+)+[/]?\\.?[a-zA-Z]{0,4}"
+#define QS_B64                "([a-z]+[a-z0-9]*[A-Z]+[A-Z0-9]*)"
+#define QS_HX                 "([A-F0-9]*[A-F]+[0-9]+[A-F0-9]*)"
+
+#define QS_OVECCOUNT 3
+
+/* request line detection */
+#define QOSC_REQ          "(OPTIONS|GET|HEAD|POST|PUT|DELETE|TRACE|CONNECT|PROPFIND|PROPPATCH|MKCOL|COPY|MOVE|LOCK|UNLOCK|VERSION-CONTROL|REPORT|CHECKOUT|CHECKIN|UNCHECKOUT|MKWORKSPACE|UPDATE|LABEL|MERGE|BASELINE-CONTROL|MKACTIVITY|ORDERPATCH|ACL|PATCH|SEARCH|BCOPY|BDELETE|BMOVE|BPROPFIND|BPROPPATCH|NOTIFY|POLL|SUBSCRIBE|UNSUBSCRIBE|X-MS-ENUMATTS|RPC_IN_DATA|RPC_OUT_DATA) (/[\x20-\x21\x23-\xFF]*) HTTP/"
+
+qs_regex_t *pcre_b64;
+qs_regex_t *pcre_hx;
+qs_regex_t *pcre_simple_path;
+
+#define QOS_DEC_MODE_FLAGS_URL        0x00
+#define QOS_DEC_MODE_FLAGS_HTML       0x01
+#define QOS_DEC_MODE_FLAGS_UNI        0x02
+#define QOS_DEC_MODE_FLAGS_ANSI       0x04
+
+/* global variables to store settings */
+static int m_mode = QOS_DEC_MODE_FLAGS_URL;
+static int m_base64 = 5;
+static int m_verbose = 1;
+static int m_path_depth = 1;
+static int m_redundant = 1;
+static int m_query_pcre = 0;
+static int m_query_multi_pcre = 0;
+static int m_query_o_pcre = 0;
+static int m_query_single_pcre = 0;
+static int m_query_len_pcre = 10;
+static int m_exit_on_error = 0;
+static int m_handler = 0;
+static qs_regex_t *m_req_regex = NULL;
+static int m_log_req_regex = 0;
+static const char *m_pfx = NULL;
+static const char *m_filter = NULL;
+
+typedef struct {
+  qs_regex_t *pcre;
+  char *rule;
+  char *path;
+  char *query_m_string;
+  char *query_m_pcre;
+  int fragment;
+} qs_rule_t;
+
+
+/* openssl stack compare function used to sort the rules */
+int STACK_qs_cmp(const char * const *_pA, const char * const *_pB) {
+  qs_rule_t *pA=*(( qs_rule_t **)_pA);
+  qs_rule_t *pB=*(( qs_rule_t **)_pB);
+  return strcmp(pA->rule,pB->rule);
+}
+
+/* compiles a pcre (exit on error) */
+static qs_regex_t *qos_pcre_compile(apr_pool_t *pool, char *pattern, int option) {
+  qs_regex_t *preg = apr_palloc(pool, sizeof(qs_regex_t));
+  if(qs_regcomp(preg, pattern, PCRE2_DOTALL|option) != 0) {
+    fprintf(stderr, "ERROR, rule <%s> could not compile pcre\n", pattern);
+    exit(1);
+  }
+  apr_pool_pre_cleanup_register(pool, preg, qs_pregfree);
+  return preg;
+}
+
+/* tries to detect base64/hex patterns (mix of upper and lower case characters) */
+static char *qos_detect_b64(char *line, int silent) {
+  qs_regmatch_t regm[QS_MAX_REG_MATCH];
+  int rc_c = qs_regexec_len(pcre_b64, line, strlen(line), QS_MAX_REG_MATCH, regm, 0);
+  if(rc_c >= 0) {
+    if((m_verbose > 1) && !silent) printf("  B64: %.*s\n",
+                                          regm[0].rm_eo - regm[0].rm_so, &line[regm[0].rm_so]);
+    return &line[regm[0].rm_so];
+  }
+  rc_c = qs_regexec_len(pcre_hx, line, strlen(line), QS_MAX_REG_MATCH, regm, 0);
+  if(rc_c >= 0) {
+    if((m_verbose > 1) && !silent) printf("  HX: %.*s\n",
+                                          regm[0].rm_eo - regm[0].rm_so, &line[regm[0].rm_so]);
+    return &line[regm[0].rm_so];
+  }
+  return NULL;
+}
+
+/* escape double quotes and backslash (to be used for Apache directive) */
+static char *qs_apache_escape(apr_pool_t *pool, const char *line) {
+  char *ret = apr_pcalloc(pool, strlen(line) * 4);
+  int i = 0;
+  const char *in = line;
+  while(in && in[0]) {
+    if(in[0] == '"') {
+      ret[i] = '\\';
+      i++;
+      ret[i] = 'x';
+      i++;
+      ret[i] = '2';
+      i++;
+      ret[i] = '2';
+      i++;
+    } else if(in[0] == '\\' && in[1] == '\\') {
+      ret[i] = '\\';
+      i++;
+      ret[i] = 'x';
+      i++;
+      ret[i] = '5';
+      i++;
+      ret[i] = 'c';
+      i++;
+      in++;
+    } else {
+      ret[i] = (char)in[0];
+      i++;
+    }
+    in++;
+  }
+  return ret;
+}
+
+/* escape a string in order to be used withn a pcre */
+static char *qos_escape_pcre(apr_pool_t *pool, char *line) {
+  int i = 0;
+  unsigned char prev = 0;
+  unsigned char *in = (unsigned char *)line;
+  char *ret = apr_pcalloc(pool, strlen(line) * 4);
+  int reti = 0;
+  if(strlen(line) == 0) return "";
+  while(in[i]) {
+    if(strchr(QS_PCRE_RESERVED, in[i]) != NULL) {
+      if(prev && (prev == '\\')) {
+        /* already escaped */
+        ret[reti] = in[i];
+        reti++;
+      } else if(prev && (in[i] == '\\') && (strchr(QS_PCRE_RESERVED, in[i+1]) != NULL)) {
+        /* escape char */
+        ret[reti] = in[i];
+        reti++;
+      } else {
+        ret[reti] = '\\';
+        reti++;
+        ret[reti] = in[i];
+        reti++;
+      }
+    } else if((in[i] < ' ') || (in[i]  > '~')) {
+      sprintf(&ret[reti], "\\x%02x", in[i]);
+      reti = reti + 4;
+    } else {
+      ret[reti] = in[i];
+      reti++;
+    }
+    prev = in[i];
+    i++;
+  }
+  return ret;
+}
+
+/* helper for url decoding */
+static int qos_hex2c(const char *x) {
+  int i, ch;
+  ch = x[0];
+  if (isdigit(ch)) {
+    i = ch - '0';
+  }else if (isupper(ch)) {
+    i = ch - ('A' - 10);
+  } else {
+    i = ch - ('a' - 10);
+  }
+  i <<= 4;
+
+  ch = x[1];
+  if (isdigit(ch)) {
+    i += ch - '0';
+  } else if (isupper(ch)) {
+    i += ch - ('A' - 10);
+  } else {
+    i += ch - ('a' - 10);
+  }
+  return i;
+}
+
+static int qos_ishex(char x) {
+  if((x >= '0') && (x <= '9')) return 1;
+  if((x >= 'a') && (x <= 'f')) return 1;
+  if((x >= 'A') && (x <= 'F')) return 1;
+  return 0;
+}
+
+/* url decoding */
+static int qos_unescaping(char *x) {
+  int i, j, ch;
+  if (x[0] == '\0')
+    return 0;
+  for (i = 0, j = 0; x[i] != '\0'; i++, j++) {
+    ch = x[i];
+    if(ch == '%' && qos_ishex(x[i + 1]) && qos_ishex(x[i + 2])) {
+      ch = qos_hex2c(&x[i + 1]);
+      i += 2;
+    } else if((m_mode & QOS_DEC_MODE_FLAGS_UNI) && 
+              ((ch == '%') || (ch == '\\')) &&
+              ((x[i + 1] == 'u') || (x[i + 1] == 'U')) &&
+              qos_ishex(x[i + 2]) &&
+              qos_ishex(x[i + 3]) &&
+              qos_ishex(x[i + 4]) &&
+              qos_ishex(x[i + 5])) {
+      /* unicode %uXXXX */
+      ch = qos_hex2c(&x[i + 4]);
+      if((ch > 0x00) && (ch < 0x5f) &&
+         ((x[i + 2] == 'f') || (x[i + 2] == 'F')) &&
+         ((x[i + 3] == 'f') || (x[i + 3] == 'F'))) {
+        ch += 0x20;
+      }
+      i += 5;
+    } else if (ch == '\\' && (x[i + 1] == 'x') && qos_ishex(x[i + 2]) && qos_ishex(x[i + 3])) {
+      ch = qos_hex2c(&x[i + 2]);
+      i += 3;
+    } else if (ch == '+') {
+      ch = ' ';
+    }
+    x[j] = ch;
+  }
+  x[j] = '\0';
+  if(strlen(x) != j) {
+    fprintf(stderr, "WARNING, found escaped null char %s\n", x);
+  }
+  return j;
+}
+
+static int qos_fgetline(char *s, int n, FILE *f) {
+  register int i = 0;
+  while (1) {
+    s[i] = (char) fgetc(f);
+    if (s[i] == CR) {
+      s[i] = fgetc(f);
+    }
+    if ((s[i] == 0x4) || (s[i] == LF) || (i == (n - 1))) {
+      s[i] = '\0';
+      return (feof(f) ? 1 : 0);
+    }
+    ++i;
+  }
+}
+
+/* init global pcre */
+static void qos_init_pcre(apr_pool_t *pool) {
+  char buf[1024];
+  sprintf(buf, "%s{%d,}", QS_B64, m_base64);
+  pcre_b64 = qos_pcre_compile(pool, buf, 0);
+  sprintf(buf, "%s{%d,}", QS_HX, m_base64);
+  pcre_hx = qos_pcre_compile(pool, buf, 0);
+  pcre_simple_path = qos_pcre_compile(pool, "^"QS_SIMPLE_PATH_PCRE"$", 0);
+  m_req_regex = qos_pcre_compile(pool, QOSC_REQ, 0);
+}
+
+static void usage(char *cmd, int man) {
+  char space[1024];
+  memset(space, ' ', 1024);
+  space[strlen(cmd)] = '\0';
+  if(man) {
+    //.TH [name of program] [section number] [center footer] [left footer] [center header]
+    printf(".TH %s 1 \"%s\" \"mod_qos utilities %s\" \"%s man page\"\n", qs_CMD(cmd), man_date,
+           man_version, cmd);
+  }
+  printf("\n");
+  if(man) {
+    printf(".SH NAME\n");
+  }
+  qs_man_print(man, "%s - an utility to generate mod_qos request line rules out from\n",
+               cmd);
+  qs_man_print(man, "existing access/audit log data.\n");
+  printf("\n");
+  if(man) {
+    printf(".SH SYNOPSIS\n");
+  }
+  qs_man_print(man, "%s%s -i <path> [-c <path>] [-d <num>] [-h] [-b <num>]\n", man ? "" : "Usage: ", cmd);
+  qs_man_print(man, "       %s [-p|-s|-m|-o] [-l <len>] [-n] [-e] [-u 'uni']\n", space);
+  qs_man_print(man, "       %s [-k <prefix>] [-t] [-f <path>] [-v 0|1|2]\n", space);
+  printf("\n");
+  if(man) {
+    printf(".SH DESCRIPTION\n");
+  } else {
+    printf("Summary\n");
+  }
+  qs_man_print(man, " mod_qos implements a request filter which validates each request\n");
+  qs_man_print(man, " line. The module supports both, negative and positive security\n");
+  qs_man_print(man, " model. The QS_Deny* directives are used to specify request line\n");
+  qs_man_print(man, " patterns which are not allowed to access the server (negative\n");
+  qs_man_print(man, " security model / deny list). These rules are used to restrict\n");
+  qs_man_print(man, " access to certain resources which should not be available to\n");
+  qs_man_print(man, " users or to protect the server from malicious patterns. The\n");
+  qs_man_print(man, " QS_Permit* rules implement a positive security model (allow list).\n");
+  qs_man_print(man, " These directives are used to define allowed request line patterns.\n");
+  qs_man_print(man, " Request which do not match any of these patterns are not allowed\n");
+  qs_man_print(man, " to access the server.\n");
+  if(man) printf("\n\n");
+  qs_man_print(man, " %s is an audit log analyzer used to generate filter\n", cmd);
+  qs_man_print(man, " rules (perl compatible regular expressions) which may be used\n");
+  qs_man_print(man, " by mod_qos to deny access for suspect requests (QS_PermitUri rules).\n");
+  qs_man_print(man, " It parses existing audit log files in order to generate request\n");
+  qs_man_print(man, " patterns covering all allowed requests.\n");
+  printf("\n");
+  if(man) {
+    printf(".SH OPTIONS\n");
+  } else {
+    printf("Options\n");
+  }
+  if(man) printf(".TP\n");
+  qs_man_print(man, "  -i <path>\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Input file containing request URIs.\n");
+  qs_man_print(man, "     The URIs for this file have to be extracted from the servers\n");
+  qs_man_print(man, "     access logs. Each line of the input file contains a request\n");
+  qs_man_print(man, "     URI consisting of a path and and query.\n");
+  printf("\n");
+  printf("     Example:\n");
+  qs_man_println(man, "       /aaa/index.do\n");
+  qs_man_println(man, "       /aaa/edit?image=1.jpg\n");
+  qs_man_println(man, "       /aaa/image/1.jpg\n");
+  qs_man_println(man, "       /aaa/view?page=1\n");
+  qs_man_println(man, "       /aaa/edit?document=1\n");
+  printf("\n");
+  qs_man_print(man, "     These access log data must include current request URIs but\n");
+  qs_man_print(man, "     also request lines from previous rule generation steps. It\n");
+  qs_man_print(man, "     must also include request lines which cover manually generated\n");
+  qs_man_print(man, "     rules.\n");
+  qs_man_print(man, "     You may use the 'qos-path' and 'qos-query' variables to create\n");
+  qs_man_print(man, "     an audit log containing all request data (path and query/body data).\n");
+  qs_man_print(man, "     Example: 'CustomLog audit_log %{qos-path}n%{qos-query}n'.\n");
+  qs_man_print(man, "     See also http://mod-qos.sourceforge.net#qsfiltersample about\n");
+  qs_man_print(man, "     the module settings.\n");
+  if(man) printf("\n.TP\n");
+  qs_man_print(man, "  -c <path>\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     mod_qos configuration file defining QS_DenyRequestLine and\n");
+  qs_man_print(man, "     QS_PermitUri directives.\n");
+  qs_man_print(man, "     %s generates rules from access log data automatically.\n", cmd);
+  qs_man_print(man, "     Manually generated rules (QS_PermitUri) may be provided from\n");
+  qs_man_print(man, "     this file. Note: each manual rule must be represented by a\n");
+  qs_man_print(man, "     request URI in the input data (-i) in order to make sure not\n");
+  qs_man_print(man, "     to be deleted by the rule optimisation algorithm.\n");
+  qs_man_print(man, "     QS_Deny* rules from this file are used to filter request lines\n");
+  qs_man_print(man, "     which should not be used for allow list rule generation.\n");
+  printf("\n");
+  printf("     Example:\n");
+  qs_man_println(man, "       # manually defined allow list rule:\n");
+  qs_man_println(man, "       QS_PermitUri +view deny \"^[/a-zA-Z0-9]+/view\\?(page=[0-9]+)?$\"\n");
+  qs_man_println(man, "       # filter unwanted request line patterns:\n");
+  qs_man_println(man, "       QS_DenyRequestLine +printable deny \".*[\\x00-\\x19].*\"\n");
+  printf("\n");
+  if(man) printf("\n.TP\n");
+  qs_man_print(man, "  -d <num>\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Depth (sub locations) of the path string which is defined as a\n");
+  qs_man_print(man, "     literal string. Default is 1.\n");
+  if(man) printf("\n.TP\n");
+  qs_man_print(man, "  -h\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Always use a string representing the handler name in the path even\n");
+  qs_man_print(man, "     the url does not have a query. See also -d option.\n");
+  if(man) printf("\n.TP\n");
+  qs_man_print(man, "  -b <num>\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Replaces url pattern by the regular expression when detecting\n");
+  qs_man_print(man, "     a base64/hex encoded string. Detecting sensibility is defined by a\n");
+  qs_man_print(man, "     numeric value. You should use values higher than 5 (default)\n");
+  qs_man_print(man, "     or 0 to disable this function.\n");
+  if(man) printf("\n.TP\n");
+  qs_man_print(man, "  -p\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Represents query by pcre only (no literal strings).\n");
+  if(man) printf("\n.TP\n");
+  qs_man_print(man, "  -s\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Uses one single pcre for the whole query string.\n");
+  if(man) printf("\n.TP\n");
+  qs_man_print(man, "  -m\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Uses one pcre for multiple query values (recommended mode).\n");
+  if(man) printf("\n.TP\n");
+  qs_man_print(man, "  -o\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Does not care the order of query parameters.\n");
+  if(man) printf("\n.TP\n");
+  qs_man_print(man, "  -l <len>\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Outsizes the query length by the defined length ({0,size+len}),\n");
+  qs_man_print(man, "     default is %d.\n", m_query_len_pcre);
+  if(man) printf("\n.TP\n");
+  qs_man_print(man, "  -n\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Disables redundant rules elimination.\n");
+  if(man) printf("\n.TP\n");
+  qs_man_print(man, "  -e\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Exit on error.\n");
+  if(man) printf("\n.TP\n");
+  qs_man_print(man, "  -u 'uni'\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Enables additional decoding methods. Use the same settings as you have\n");
+  qs_man_print(man, "     used for the QS_Decoding directive.\n");
+  if(man) printf("\n.TP\n");
+  qs_man_print(man, "  -k <prefix>\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Prefix used to generate rule identifiers (QSF by default).\n");
+  if(man) printf("\n.TP\n");
+  qs_man_print(man, "  -t\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Calculates the maximal latency per request (worst case) using the\n");
+  qs_man_print(man, "     generated rules.\n");
+  if(man) printf("\n.TP\n");
+  qs_man_print(man, "  -f <path>\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Filters the input by the provided path (prefix) only processing\n");
+  qs_man_print(man, "     matching lines.\n");
+  if(man) printf("\n.TP\n");
+  qs_man_print(man, "  -v <level>\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Verbose mode. (0=silent, 1=rule source, 2=detailed). Default is 1.\n");
+  qs_man_print(man, "     Don't use rules you haven't checked the request data used to\n");
+  qs_man_print(man, "     generate it! Level 1 is highly recommended (as long as you don't\n");
+  qs_man_print(man, "     have created the log data using your own web crawler).\n");
+  printf("\n");
+  if(man) {
+    printf(".SH OUTPUT\n");
+  } else {
+    printf("Output\n");
+  }
+  qs_man_print(man, " The output of %s is written to stdout. The output\n", cmd);
+  qs_man_print(man, " contains the generated QS_PermitUri directives but also\n");
+  qs_man_print(man, " information about the source which has been used to generate\n");
+  qs_man_print(man, " these rules. It is very important to check the validity of\n");
+  qs_man_print(man, " each request line which has been used to calculate the\n");
+  qs_man_print(man, " QS_PermitUri rules. Each request line which has been used to\n");
+  qs_man_print(man, " generate a new rule is shown in the output prefixed by\n");
+  qs_man_print(man, " \"ADD line <line number>:\". These request lines should be\n");
+  qs_man_print(man, " stored and reused at any later rule generation (add them to\n");
+  qs_man_print(man, " the URI input file). The subsequent line shows the generated\n");
+  qs_man_print(man, " rule.\n");
+  qs_man_print(man, " At the end of data processing a list of all generated\n");
+  qs_man_print(man, " QS_PermitUri rules is shown. These directives may be used\n");
+  qs_man_print(man, " withn the configuration file used by mod_qos.\n");
+  printf("\n");
+  if(man) {
+    printf(".SH EXAMPLE\n");
+  } else {
+    printf("Sample Usage and Output\n");
+  }
+  qs_man_println(man, "  %s -i loc.txt -c httpd.conf -m -e\n", cmd);
+  qs_man_println(man, "  ...\n");
+  qs_man_println(man, "  # ADD line 1: /aaa/index.do\n");
+  qs_man_println(man, "  # 003 ^(/[a-zA-Z0-9\\-_]+)+[/]?\\.?[a-zA-Z]{0,4}$\n");
+  qs_man_println(man, "  # ADD line 3: /aaa/view?page=1\n");
+  qs_man_println(man, "  # --- ^[/a-zA-Z0-9]+/view\\?(page=[0-9]+)?$\n");
+  qs_man_println(man, "  # ADD line 4: /aaa/edit?document=1\n");
+  qs_man_println(man, "  # 004 ^[/a-zA-Z]+/edit\\?((document)(=[0-9]*)*[&]?)*$\n");
+  qs_man_println(man, "  # ADD line 5: /aaa/edit?image=1.jpg\n");
+  qs_man_println(man, "  # 005 ^[/a-zA-Z]+/edit\\?((image)(=[0-9\\.a-zA-Z]*)*[&]?)*$\n");
+  qs_man_println(man, "  ...\n");
+  qs_man_println(man, "  QS_PermitUri +QSF001 deny \"^[/a-zA-Z]+/edit\\?((document|image)(=[0-9\\.a-zA-Z]*)*[&]?)*$\"\n");
+  qs_man_println(man, "  QS_PermitUri +QSF002 deny \"^[/a-zA-Z0-9]+/view\\?(page=[0-9]+)?$\"\n");
+  qs_man_println(man, "  QS_PermitUri +QSF003 deny \"^(/[a-zA-Z0-9\\-_]+)+[/]?\\.?[a-zA-Z]{0,4}$\"\n");
+  printf("\n");
+  if(man) {
+    printf(".SH SEE ALSO\n");
+    printf("qsdt(1), qsexec(1), qsgeo(1), qsgrep(1), qshead(1), qslog(1), qslogger(1), qspng(1), qsre(1), qsrespeed(1), qsrotate(1), qssign(1), qstail(1)\n");
+    printf(".SH AUTHOR\n");
+    printf("Pascal Buchbinder, http://mod-qos.sourceforge.net/\n");
+  } else {
+    printf("mod_qos %s\n", man_version);
+    printf("See http://mod-qos.sourceforge.net/ for further details.\n");
+  }
+  if(man) {
+    exit(0);
+  } else {
+    exit(1);
+  }
+}
+
+/* worker struct, used for parallel processing */
+typedef struct {
+  apr_pool_t *pool;
+  apr_table_t *rules;
+  apr_table_t *rules_url;
+  int from;
+  int to;
+} qs_worker_t;
+
+/* determines, if a rule is really required */
+static apr_table_t *qos_get_used(apr_pool_t *pool, apr_table_t *rules, apr_table_t *rules_url,
+                                 int from, int to) {
+  apr_table_t *used = apr_table_make(pool, 1);
+  int j;
+  for(j = from; j < to; j++) {
+    int l;
+    apr_table_entry_t *linee = (apr_table_entry_t *)apr_table_elts(rules_url)->elts;
+    if(m_verbose) {
+      printf("[%d]", j);
+      fflush(stdout);
+    }
+    for(l = 0; l < apr_table_elts(rules_url)->nelts; l++) {
+      char *line = linee[l].key;
+      int i;
+      int match = 0;
+      apr_table_entry_t *entry = (apr_table_entry_t *)apr_table_elts(rules)->elts;
+      for(i = 0; i < apr_table_elts(rules)->nelts; i++) {
+        if(i != j) {
+          qs_rule_t *rs = (qs_rule_t *)entry[i].val;
+          if(qs_regexec_len(rs->pcre, line, strlen(line), 0, NULL, 0) >= 0) {
+            match = 1;
+            break;
+          }
+        }
+      }
+      if(!match) {
+        /* no match, rule j is required */
+        apr_table_add(used, entry[j].key, "+");
+      }
+    }
+  }
+  return used;
+}
+
+static void *qos_worker(void *argv) {
+  qs_worker_t *wt = argv;
+  return qos_get_used(wt->pool, wt->rules, wt->rules_url, wt->from, wt->to);
+}
+
+/* get the characters used withn the string in order to define a pcre */
+static char *qos_2pcre(apr_pool_t *pool, const char *line) {
+  int hasA = 0;
+  int hasD = 0;
+  int hasE = 0;
+  int hasB = 0;
+  int i = 0;
+  unsigned char *in = (unsigned char *)line;
+  char *ret = apr_pcalloc(pool, strlen(line) * 6);
+  int reti = 0;
+  char *existing = "";
+  if(strlen(line) == 0) return "";
+  while(in[i]) {
+    if(isdigit(in[i])) {
+      if(!hasD) {
+        hasD = 1;
+        strcpy(&ret[reti], "0-9");
+        reti = reti + 3;
+      }
+    } else if(isalpha(in[i])) {
+      if(!hasA) {
+        hasA = 1;
+        strcpy(&ret[reti], "a-zA-Z");
+        reti = reti + 6;
+      }
+    } else if(in[i] == '\\') {
+      if(!hasE) {
+        hasE = 1;
+        strcpy(&ret[reti], "\\\\");
+        reti = reti + 2;
+      }
+    } else if(in[i] == '-') {
+      if(!hasB) {
+        hasB = 1;
+        strcpy(&ret[reti], "\\-");
+        reti = reti + 2;
+      }
+    } else if(in[i] == '\0') {
+      char *ck = apr_psprintf(pool, "#\\x%02x#", in[i]);
+      if(strstr(existing, ck) == NULL) {
+        sprintf(&ret[reti], "\\x%02x", in[i]);
+        reti = reti + 4;
+        existing = apr_pstrcat(pool, existing, ck, NULL);
+      }
+    } else if(strchr(ret, in[i]) == NULL) {
+      if(strchr(QS_PCRE_RESERVED, in[i]) != NULL) {
+        ret[reti] = '\\';
+        reti++;
+        ret[reti] = in[i];
+        reti++;
+      } else if((in[i] < ' ') || (in[i]  > '~')) {
+        char *ck = apr_psprintf(pool, "#\\x%02x#", in[i]);
+        if(strstr(existing, ck) == NULL) {
+          sprintf(&ret[reti], "\\x%02x", in[i]);
+          reti = reti + 4;
+          existing = apr_pstrcat(pool, existing, ck, NULL);
+        }
+      } else {
+        ret[reti] = in[i];
+        reti++;
+      }
+    }
+    i++;
+  }
+  if(strlen(ret) == 0) return NULL;
+  ret[reti] = '\0';
+  return ret;
+}
+
+/* check for the pattern "p" in "r" using the delimter "d",
+   returns 1 if it is in the string */
+static int qos_checkstr(apr_pool_t *pool, char *r, char *d, char *p) {
+  /*
+   * r = ..|p|..
+   * r = p|...
+   * r = ..|p
+   * r = p
+   */
+  char *check1 = apr_pstrcat(pool, d, p, d, NULL);
+  char *check2 = apr_pstrcat(pool, p, d, NULL);
+  char *check3 = apr_pstrcat(pool, d, p, NULL);
+
+  if(strstr(r, check1) != NULL) {
+    return 1;
+  }
+  if(strncmp(r, check2, strlen(check2)) == 0) {
+    return 1;
+  }
+  if(strlen(r) > strlen(check3)) {
+    if((strncmp(&r[strlen(r)-strlen(check3)], check3, strlen(check3)) == 0)) {
+      return 1;
+    }
+  }
+  if(strcmp(r, p) == 0) {
+    return 1;
+  }
+
+  return 0;
+}
+
+/* add the string "n" to "o" using the delimiter "d" (only if not
+   already available */
+static char *qos_addstr(apr_pool_t *pool, char *o, char *d, char *n) {
+  char *p = apr_pstrdup(pool, n);
+  char *r = o;
+  if(n == NULL) return o;
+  while(p && p[0]) {
+    char *this = p;
+    char *next = strchr(p, d[0]);
+
+    /* \| */
+    while(next) {
+      if((next > this) && (next[-1] == '\\')) {
+        next++;
+        next = strchr(next, d[0]);
+      } else {
+        break;
+      }
+    }
+    if(next == NULL) {
+      p = NULL;
+    } else {
+      next[0] = '\0';
+      next++;
+      p = next;
+    }
+    if(!qos_checkstr(pool, r, d, this)) {
+      r = apr_pstrcat(pool, r, d, this, NULL);
+    }
+  }
+  return r;
+}
+
+
+/* create a name=pcre string like this: ((s1|s2)(=[<pcre>]*)*[&]?)*" */
+static char *qos_qqs(apr_pool_t *pool, char *string, char *query_pcre, int singleEq, int hasEq, int startAmp) {
+  char *se = NULL;
+  char *s = "";
+  if(startAmp) s = "[&]?";
+  if(singleEq) {
+    se = "(=[&]?)*";
+  }
+  if(strlen(query_pcre) > 0) {
+    return apr_pstrcat(pool, s, "((", string, ")(=[", qos_2pcre(pool, query_pcre), "]*)*[&]?)*", se, NULL);
+  } else {
+    if(hasEq && !singleEq) {
+      se = "(=[&]?)*";
+      return apr_pstrcat(pool, s, "(((", string, ")[&]?)*", se, ")*", NULL);
+    }
+    return apr_pstrcat(pool, s, "((", string, ")[&]?)*", se, NULL);
+  }
+}
+
+/* tries to optimize the rules by merging all query into one single pcre matching
+   all values */
+static void qos_query_optimization(apr_pool_t *pool, apr_table_t *rules) {
+  apr_table_t *delete = apr_table_make(pool, 1);
+  apr_table_t *checked_path = apr_table_make(pool, 1);
+  apr_table_t *new = apr_table_make(pool, 1);
+  int i, j;
+  apr_table_entry_t *entry = (apr_table_entry_t *)apr_table_elts(rules)->elts;
+  for(i = 0; i < apr_table_elts(rules)->nelts; i++) {
+    char *rule_str = entry[i].key;
+    qs_rule_t *r = (qs_rule_t *)entry[i].val;
+    if(!r->fragment && r->path && (apr_table_get(checked_path, r->path) == NULL)) {
+      int merged = 0;
+      char *query_m_string = r->query_m_string == NULL ? "" : r->query_m_string;
+      char *query_m_pcre = r->query_m_pcre == NULL ? "" : r->query_m_pcre;
+      if(m_verbose > 1) printf("  search for path %s (%s)\n", r->path, rule_str);
+      if(m_verbose > 1) printf("  . %s %s\n", query_m_string, query_m_pcre);
+      apr_table_add(checked_path, r->path, "");
+      /* search for rules with the same path and delete them */
+      for(j = 0; j < apr_table_elts(rules)->nelts; j++) {
+        if(i != j) {
+          qs_rule_t *n = (qs_rule_t *)entry[j].val;
+          if(!n->fragment && n->path && (strcmp(r->path, n->path) == 0)) {
+            if(m_verbose > 1) printf("  + %s %s\n",
+                                     n->query_m_string == NULL ? "-" : n->query_m_string,
+                                     n->query_m_pcre == NULL ? "-" : n->query_m_pcre);
+            if(strlen(query_m_string) == 0) {
+              query_m_string = apr_pstrcat(pool, query_m_string, n->query_m_string, NULL);
+            } else {
+              query_m_string = qos_addstr(pool, query_m_string, "|", n->query_m_string);
+            }
+            if(m_verbose > 1) printf("  > %s\n", query_m_string);
+            query_m_pcre = apr_pstrcat(pool, query_m_pcre, n->query_m_pcre, NULL);
+            apr_table_add(delete, entry[j].key, "");
+            merged = 1;
+          }
+        }
+      }
+      /* update rule if merged to any */
+      if(merged) {
+        apr_table_add(delete, entry[i].key, "");
+        if(m_verbose) {
+          printf("# CHANGE: <%s>", rule_str);
+        }
+        {
+          const char *errptr = NULL;
+          char *rule = apr_pstrcat(pool, "^", r->path, NULL);
+          qs_rule_t *rs = apr_pcalloc(pool, sizeof(qs_rule_t));
+          if(strlen(query_m_string) > 0) {
+            rule = apr_pstrcat(pool, rule, "\\?",
+                               qos_qqs(pool, query_m_string, query_m_pcre, 0, 0, 0), NULL);
+          }
+          rule = apr_pstrcat(pool, rule, "$", NULL);
+          rs->pcre = qos_pcre_compile(pool, rule, 0);
+          rs->path = r->path;
+          apr_table_setn(new, rule, (char *)rs);
+          if(m_verbose) {
+            printf(" to <%s>\n", rule);
+            fflush(stdout);
+          }
+        }
+      }
+    }
+  }
+  entry = (apr_table_entry_t *)apr_table_elts(delete)->elts;
+  for(i = 0; i < apr_table_elts(delete)->nelts; i++) {
+    if(m_verbose) printf("# DEL rule: %s\n", entry[i].key);
+    apr_table_unset(rules, entry[i].key);
+  }
+  entry = (apr_table_entry_t *)apr_table_elts(new)->elts;
+  for(i = 0; i < apr_table_elts(new)->nelts; i++) {
+    apr_table_setn(rules, entry[i].key, entry[i].val);
+  }
+}
+
+/* deletes rules which are not required and merge query name/value pairs */
+static void qos_delete_obsolete_rules(apr_pool_t *pool, apr_table_t *rules, apr_table_t *rules_url) {
+  apr_table_t *not_used = apr_table_make(pool, 1);
+  apr_table_t *used;
+  apr_table_t *used1;
+  pthread_attr_t *tha = NULL;
+  pthread_t tid;
+  qs_worker_t *wt = apr_pcalloc(pool, sizeof(qs_worker_t));
+
+
+  if(m_query_multi_pcre) {
+    if(m_verbose) {
+      printf("# search for redundant rules ...\n");
+      fflush(stdout);
+    }
+    qos_query_optimization(pool, rules);
+    if(m_verbose) printf("# ");
+  } else {
+    if(m_verbose) {
+      printf("# search for redundant rules ");
+      fflush(stdout);
+    }
+  }
+
+  wt->pool = pool;
+  wt->rules = rules;
+  wt->rules_url = rules_url;
+  wt->from = apr_table_elts(rules)->nelts / 2;
+  wt->to = apr_table_elts(rules)->nelts;
+
+  pthread_create(&tid, tha, qos_worker, (void *)wt);
+  used = qos_get_used(pool, rules, rules_url, 0, apr_table_elts(rules)->nelts / 2);
+  pthread_join(tid, (void *)&used1);
+  if(m_verbose) printf(" done\n");
+  {
+    int i;
+    apr_table_entry_t *entry = (apr_table_entry_t *)apr_table_elts(rules)->elts;
+    for(i = 0; i < apr_table_elts(rules)->nelts; i++) {
+      if((apr_table_get(used, entry[i].key) == NULL) &&
+         (apr_table_get(used1, entry[i].key) == NULL)) {
+        if(m_verbose) printf("# DEL rule (not required): %s\n", entry[i].key);
+        apr_table_add(not_used, entry[i].key, "-");
+      }
+    }
+    entry = (apr_table_entry_t *)apr_table_elts(not_used)->elts;
+    for(i = 0; i < apr_table_elts(not_used)->nelts; i++) {
+      apr_table_unset(rules, entry[i].key);
+    }
+  }
+}
+
+/* test if we need to create a new url (and save line if the rule is used the very
+   first time (rule has been read from the configuration file)) */
+static int qos_test_for_existing_rule(char *plain, char *line, apr_table_t *rules, 
+                                      apr_table_t *special_rules, int line_nr,
+                                      apr_table_t *rules_url, apr_table_t *source_rules, int first) {
+  int i;
+  apr_table_entry_t *entry = (apr_table_entry_t *)apr_table_elts(rules)->elts;
+  if((line == 0) || (strlen(line) == 0)) return 0;
+  for(i = 0; i < apr_table_elts(rules)->nelts; i++) {
+    qs_rule_t *rs = (qs_rule_t *)entry[i].val;
+    if(qs_regexec_len(rs->pcre, line, strlen(line), 0, NULL, 0) >= 0) {
+      if(first && (apr_table_get(source_rules, entry[i].key) == NULL)) {
+        apr_table_add(source_rules, entry[i].key, "");
+        apr_table_add(rules_url, line, "");
+        apr_table_setn(special_rules, entry[i].key, (char *)rs);
+        if(m_verbose) {
+          printf("# ADD line %d: %s\n", line_nr, plain);
+          printf("# --- %s\n", entry[i].key);
+        }
+      }
+      if(m_verbose > 1){
+        printf("LINE %d, exiting rule: %s\n", line_nr, entry[i].key);
+      }
+      return 1;
+    }
+  }
+  /* check for special rules */
+  entry = (apr_table_entry_t *)apr_table_elts(special_rules)->elts;
+  for(i = 0; i < apr_table_elts(special_rules)->nelts; i++) {
+    qs_rule_t *rs = (qs_rule_t *)entry[i].val;
+    if(qs_regexec_len(rs->pcre, line, strlen(line), 0, NULL, 0) >= 0) {
+      if(m_verbose) {
+        printf("# ADD line %d: %s\n", line_nr, plain);
+        printf("# -(S) %s\n", entry[i].key);
+      }
+      apr_table_setn(rules, entry[i].key, (char *)rs);
+      return 1;
+    }
+  }
+  return 0;
+}
+
+/* filter lines we don't want to add to the allow list */
+static int qos_enforce_denylist(apr_table_t *rules, const char *line) {
+  int i;
+  apr_table_entry_t *entry = (apr_table_entry_t *)apr_table_elts(rules)->elts;
+  if((line == 0) || (strlen(line) == 0)) return 0;
+  for(i = 0; i < apr_table_elts(rules)->nelts; i++) {
+    qs_rule_t *rs = (qs_rule_t *)entry[i].val;
+    if(qs_regexec_len(rs->pcre, line, strlen(line), 0, NULL, 0) == 0) {
+      if(m_verbose > 1) printf(" deny list match, rule %s\n", entry[i].key);
+      return 1;
+    }
+  }
+  return 0;
+}
+
+/* load existing rules */
+static void qos_load_rules(apr_pool_t *pool, apr_table_t *ruletable,
+                           const char *httpdconf, const char *command, int option) {
+  FILE *f = fopen(httpdconf, "r");
+  char line[MAX_LINE];
+  if(f == NULL) {
+    fprintf(stderr, "ERROR, could not open %s\n", httpdconf);
+    exit(1);
+  }
+  while(!qos_fgetline(line, sizeof(line), f)) {
+    // QS_DenyRequestLine '+'|'-'<id> 'log'|'deny' <pcre>
+    char *p = strstr(line, command);
+    if(p) {
+      p[0] = '\0';
+      p++;
+    }
+    if(p && (strchr(line, '#') == NULL)) {
+      p = strchr(p, ' ');
+      if(p) {
+        while(p[0] == ' ') p++;
+        p = strchr(p, ' ');
+        if(p) {
+          while(p[0] == ' ') p++;
+          p = strchr(p, ' ');
+          if(p) {
+            while(p[0] == ' ') p++;
+            if(m_verbose > 1) {
+              printf("load %s\n", p);
+            }
+            {
+              const char *errptr = NULL;
+              char *pattern;
+              qs_regex_t *pcre_test;
+              qs_rule_t *rs;
+              if(p[0] == '"') {
+                int fl = strlen(p)-2;
+                pattern = apr_psprintf(pool, "%.*s", fl, &p[1]);
+              } else {
+                int fl = strlen(p);
+                pattern = apr_psprintf(pool, "%.*s", fl, p);
+              }
+              pcre_test = qos_pcre_compile(pool, pattern, option);
+              rs = apr_pcalloc(pool, sizeof(qs_rule_t));
+              rs->pcre = pcre_test;
+              apr_table_setn(ruletable, pattern, (char *)rs);
+            }
+          }
+        }
+      }
+    }
+  }
+  fclose(f);
+}
+
+static void qos_load_denylist(apr_pool_t *pool, apr_table_t *denylist, const char *httpdconf) {
+  qos_load_rules(pool, denylist, httpdconf, "QS_DenyRequestLine", PCRE2_CASELESS);
+}
+static void qos_load_allowlist(apr_pool_t *pool, apr_table_t *rules, const char *httpdconf) {
+  qos_load_rules(pool, rules, httpdconf, "QS_PermitUri", 0);
+}
+
+/* tries to map a base64 string to a pcre */
+static char *qos_b64_2pcre(apr_pool_t *pool, const char *line) {
+  char *copy = apr_pstrdup(pool, line);
+  char *b64 = qos_detect_b64(copy, 1);
+  char *st = b64;
+  char *ed = &b64[1];
+  if(m_verbose > 1) printf("  B642pcre: %s", copy);
+  /* reserved: {}[]()^$.|*+?\ */
+#define QS_BX "-_$+!"
+  while(st[0] && (isdigit(st[0]) || isalpha(st[0]) || (strchr(QS_BX, st[0]) != NULL))) {
+    st--;
+  }
+  st++;
+  st[0] = '\0';
+  while(ed[0] && (isdigit(ed[0]) || isalpha(ed[0]) || (strchr(QS_BX, ed[0]) != NULL))) {
+    ed++;
+  }
+  if(m_verbose > 1) printf(" %s <> %s\n", copy, ed);
+  return apr_pstrcat(pool, qos_escape_pcre(pool, copy),
+                     "[a-zA-Z0-9\\-_\\$\\+!]+",
+                     ed[0] == '\0' ? NULL : qos_escape_pcre(pool, ed), NULL);
+}
+
+
+/* maps a query string to a pairs of <string>=<pcre> or <pcre>=<pcre> */
+static char *qos_query_string_pcre(apr_pool_t *pool, const char *path) {
+  char *copy = apr_pstrdup(pool, path);
+  char *pos = copy;
+  char *ret = "";
+  int isValue = 0;
+  int open = 0;
+  while(copy[0]) {
+    if((copy[0] == '=') && (copy[1] != '=') && !open) {
+      copy[0] = '\0';
+      qos_unescaping(pos);
+      if(!open) {
+        ret = apr_pstrcat(pool, ret, "(", NULL);
+        open = 1;
+      }
+      if(m_query_pcre) {
+        if(strlen(pos) > 0) {
+          ret = apr_pstrcat(pool, ret, "[", qos_2pcre(pool, pos), "]+=", NULL);
+        } else {
+          ret = apr_pstrcat(pool, ret, "=", NULL);
+        }
+      } else {
+        ret = apr_pstrcat(pool, ret, qos_escape_pcre(pool, pos), "=", NULL);
+      }
+      open = 1;
+      pos = copy;
+      pos++;
+      isValue = 1;
+    }
+    if(copy[0] == '&') {
+      copy[0] = '\0';
+      if(strlen(pos) == 0) {
+        ret = apr_pstrcat(pool, ret, "[&]?", NULL);
+        if(open) {
+          ret = apr_pstrcat(pool, ret, ")?", NULL);
+          open = 0;
+        }
+      } else {
+        qos_unescaping(pos);
+        ret = apr_psprintf(pool, "%s[%s]{0,%"APR_SIZE_T_FMT"}[&]?", ret, qos_2pcre(pool, pos),
+                           strlen(pos) + m_query_len_pcre);
+        if(open) {
+          ret = apr_pstrcat(pool, ret, ")?", NULL);
+          open = 0;
+        }
+      }
+      pos = copy;
+      pos++;
+      isValue = 0;
+    }
+    copy++;
+  }
+  if(pos != copy) {
+    qos_unescaping(pos);
+    if(isValue) {
+      ret = apr_psprintf(pool, "%s[%s]{0,%"APR_SIZE_T_FMT"}[&]?", ret, qos_2pcre(pool, pos),
+                         strlen(pos) + m_query_len_pcre);
+    } else {
+      if(!open) {
+        ret = apr_pstrcat(pool, "(", ret, NULL);
+        open = 1;
+      }
+      if(m_query_pcre) {
+        ret = apr_pstrcat(pool, ret, "[", qos_2pcre(pool, pos), "]+", NULL);
+      } else {
+        ret = apr_pstrcat(pool, ret, qos_escape_pcre(pool, pos), NULL);
+      }
+    }
+    if(open) {
+      ret = apr_pstrcat(pool, ret, ")?", NULL);
+      open = 0;
+    }
+  }
+  if(open) {
+    ret = apr_pstrcat(pool, ret, ")?", NULL);
+    open = 0;
+  }
+  if(m_query_pcre) {
+    return ret;
+  } else {
+    return ret;
+    /* it would be nice to use (see -o):
+     *  ((a=b)?(c=d)?)* 
+     * instead of:
+     *  (a=b)?(c=d)? and (c=d)?(a=b)?
+     * but in this case, two rules are much faster than one
+     * it's probably better to use the -m option
+     */
+  }
+}
+
+/* maps a query string to a list of names and a single pcre for all values:
+   <string>|<string>=<pcre> */
+static char *qos_multi_query_string_pcre(apr_pool_t *pool, const char *path,
+                                         char **query_m_string, char **query_m_pcre) {
+  char *copy = apr_pstrdup(pool, path);
+  char *pos = copy;
+  char *string = "";
+  char *query_pcre = "";
+  int isValue = 0;
+  int singleEq = 0;
+  int hasEq = 0;
+  int startAmp = 0;
+  if(copy[0] == '&') startAmp = 1;
+  while(copy[0]) {
+    if(copy[0] == '=') hasEq = 1;
+    if((copy[0] == '=') && (copy[1] != '=') && !isValue) {
+      copy[0] = '\0';
+      qos_unescaping(pos);
+      if(strlen(pos) > 0) {
+        if(strlen(string) > 0) string = apr_pstrcat(pool, string, "|",  NULL);
+        string = apr_pstrcat(pool, string, qos_escape_pcre(pool, pos),  NULL);
+      } else {
+        if((copy[1] == '&') || (copy[1] == '\0')) {
+          singleEq = 1;
+        }
+      }
+      pos = copy;
+      pos++;
+      isValue = 1;
+    }
+    if(copy[0] == '&') {
+      copy[0] = '\0';
+      if(!isValue) {
+        qos_unescaping(pos);
+        if(strlen(string) > 0) string = apr_pstrcat(pool, string, "|",  NULL);
+        string = apr_pstrcat(pool, string, qos_escape_pcre(pool, pos),  NULL);
+      } else {
+        if(strlen(pos) != 0) {
+          qos_unescaping(pos);
+          query_pcre = apr_pstrcat(pool, query_pcre, pos,  NULL);
+        }
+      }
+      pos = copy;
+      pos++;
+      isValue = 0;
+    }
+    copy++;
+  }
+  if(pos != copy) {
+    qos_unescaping(pos);
+    if(isValue) {
+      query_pcre = apr_pstrcat(pool, query_pcre, pos, NULL);
+    } else {
+      if(strlen(string) > 0) string = apr_pstrcat(pool, string, "|",  NULL);
+      string = apr_pstrcat(pool, string, qos_escape_pcre(pool, pos),  NULL);
+    }
+  }
+  *query_m_string = string;
+  *query_m_pcre = query_pcre;
+  return qos_qqs(pool, string, query_pcre, singleEq, hasEq, startAmp);
+}
+
+/* maps a path to a single pcre (don't mind its length) */
+static char *qos_path_pcre(apr_pool_t *lpool, const char *path) {
+  char *dec = apr_pstrdup(lpool, path);
+  qos_unescaping(dec);
+  return apr_pstrcat(lpool, "[", qos_2pcre(lpool, dec), "]+", NULL);
+}
+
+/* maps a path to <pcre>/<string> */
+static char *qos_path_pcre_string(apr_pool_t *lpool, const char *path) {
+  int nohandler = 0;
+  char *lpath = apr_pstrdup(lpool, path);
+  char *last;
+  char *str = "";
+  int depth = m_path_depth;
+  char *rx = "";
+  if(lpath[strlen(lpath)-1] == '/') {
+    lpath[strlen(lpath)-1] = '\0';
+    nohandler = 1;
+  }
+  last = strrchr(lpath, '/');
+  while(last && depth) {
+    qos_unescaping(last);
+    if(m_base64 && qos_detect_b64(last, 0)) {
+      str = apr_pstrcat(lpool, qos_b64_2pcre(lpool, last), str, NULL);
+    } else {
+      str = apr_pstrcat(lpool, qos_escape_pcre(lpool, last), str, NULL);
+    }
+    last[0] = '\0';
+    last = strrchr(lpath, '/');
+    depth--;
+  }
+  if(lpath[0]) {
+    qos_unescaping(lpath);
+    rx = apr_pstrcat(lpool, "[", qos_2pcre(lpool, lpath), "]+", NULL);
+  }
+  if(strlen(str) > 0) {
+    if(nohandler) {
+      rx = apr_pstrcat(lpool, rx, str, "[/]?", NULL);
+    } else {
+      rx = apr_pstrcat(lpool, rx, str, NULL);
+    }
+  }
+  return rx;
+}
+
+static int qos_is_alnum(const char *string) {
+  unsigned char *in = (unsigned char *)string;
+  int i = 0;
+  if(in == NULL) return 0;
+  while(in[i]) {
+    if(!apr_isalnum(in[i])) return 0;
+    i++;
+  }
+  return 1;
+}
+
+static void qos_rule_optimization(apr_pool_t *pool, apr_pool_t *lpool,
+                                  apr_table_t *rules, apr_table_t *special_rules) {
+  int i;
+  apr_table_t *new_rules = apr_table_make(pool, 5);
+  apr_table_t *del_rules = apr_table_make(pool, 5);
+  apr_table_entry_t *entry = (apr_table_entry_t *)apr_table_elts(rules)->elts;
+  for(i = 0; i < apr_table_elts(rules)->nelts; i++) {
+    qs_rule_t *rs = (qs_rule_t *)entry[i].val;
+    int hit = 0;
+    int j;
+    for(j = 0; j < apr_table_elts(rules)->nelts; j++) {
+      if(i != j) {
+        qs_rule_t *rsj = (qs_rule_t *)entry[j].val;
+        if(rs->query_m_string && rsj->query_m_string) {
+          if(strcmp(rs->query_m_string, rsj->query_m_string) == 0) {
+            if(strlen(entry[i].key) == strlen(entry[j].key)) {
+              hit++;
+            }
+          }
+          if(hit == 5) {
+            int s = 0;
+            int e = 0;
+            while(entry[i].key[s] && (entry[i].key[s] == entry[j].key[s])) s++;
+            e = s;
+            while(entry[i].key[e] &&
+                  ((entry[i].key[e] != entry[j].key[e]) ||
+                   (apr_isalnum(entry[i].key[e]) && apr_isalnum(entry[j].key[e])))) e++;
+            if((e > s) &&
+               (s > 14) &&
+               (e < strlen(entry[i].key)) &&
+               (strstr(&entry[i].key[e], "\?") != NULL)) {
+              const char *errptr = NULL;
+              char *match = apr_psprintf(lpool, "%.*s%.*s",
+                                         e-s, &entry[i].key[s],
+                                         e-s, &entry[j].key[s]);
+              if(qos_is_alnum(match)) {
+                char *matchx = apr_psprintf(lpool, "[%s]{%d}", qos_2pcre(lpool, match), e-s);
+                char *new = apr_psprintf(pool, "%.*s%s%s", s, entry[i].key, matchx, &entry[i].key[e]);
+                qs_rule_t *rsn = apr_pcalloc(pool, sizeof(qs_rule_t));
+                rsn->pcre = qos_pcre_compile(pool, new, 0);
+                rsn->path = rs->path;
+                rsn->query_m_string = rs->query_m_string;
+                rsn->query_m_pcre = rs->query_m_pcre;
+                rsn->fragment = rs->fragment;
+                if(m_verbose) {
+                  printf("# CHANGE: <%s> to <%s>\n", entry[i].key, new);
+                  fflush(stdout);
+                }
+                apr_table_setn(new_rules, new, (char *)rsn);
+                apr_table_addn(del_rules, entry[i].key, entry[i].val);
+                apr_table_addn(del_rules, entry[j].key, entry[j].val);
+                if(m_verbose > 1) {
+                  if(m_verbose) printf("  [%s] [%s]\n", entry[i].key, entry[j].key);
+                  if(m_verbose) printf("  [%s] [%s]\n", match, matchx);
+                }
+                break;
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+  entry = (apr_table_entry_t *)apr_table_elts(new_rules)->elts;
+  for(i = 0; i < apr_table_elts(new_rules)->nelts; i++) {
+    apr_table_setn(rules, entry[i].key, entry[i].val);
+  }
+  entry = (apr_table_entry_t *)apr_table_elts(del_rules)->elts;
+  for(i = 0; i < apr_table_elts(del_rules)->nelts; i++) {
+    apr_table_unset(rules, entry[i].key);
+  }
+}
+
+/* rules do not care the order of parameter values (makes rule processing slow)
+ *  (id=[0-9]{0,13}[&]?)?(name=[a-zA-Z]{0,12}[&]?)?
+ * ((id=[0-9]{0,13}[&]?)|(name=[a-zA-Z]{0,12}[&]?))*
+ */
+static char *qos_post_optimization(apr_pool_t *lpool, char *query) {
+  int hit = 0;
+  char *p = query;
+  while(p && p[0]) {
+    if(strncmp(p, "[&]?)?(", 7) == 0) {
+      hit = 1;
+      p[5] = '|';
+    }
+    p++;
+  }
+  if(hit) {
+    query[strlen(query)-1] = '\0';
+    return apr_psprintf(lpool, "(%s)*", query);
+  }
+  return query;
+}
+
+static void qos_auto_detect(char **raw) {
+  char *line = *raw;
+  int rc_c = -1;
+  if(m_req_regex) {
+    qs_regmatch_t regm[QS_MAX_REG_MATCH];
+    /* no request line, maybe raw Apache access log? */
+    rc_c = qs_regexec_len(m_req_regex, line, strlen(line), QS_MAX_REG_MATCH, regm, 0);
+    if(rc_c >= 0) {
+      char *sr = &line[regm[2].rm_so];
+      sr[regm[2].rm_eo - regm[2].rm_so] = '\0';
+      *raw = sr;
+    }
+  }
+  if(rc_c < 0) {
+    /* or an audit log like "%h %>s %{qos-loc}n %{qos-path}n%{qos-query}n" */
+    char *pe = line;
+    int pi = 3;
+    while(pe && (pi > 0)) {
+      pi--;
+      pe = strchr(pe, ' ');
+      if(pe) {
+        pe++;
+      }
+    }
+    if(pe && pe[0] == '/' && (pi == 0)) {
+      *raw = pe;
+    }
+  }
+  return;
+}
+
+/* process the input file line by line */
+static void qos_process_log(apr_pool_t *pool, apr_table_t *denylist, apr_table_t *rules,
+                            apr_table_t *rules_url, apr_table_t *special_rules,
+                            FILE *f, int *ln, int *dc, int first) {
+  char *readline = apr_pcalloc(pool, MAX_BODY_BUFFER);
+  int deny_count = *dc;
+  int line_nr = *ln;
+  apr_table_t *source_rules = apr_table_make(pool, 10);
+  int rule_optimization = 300;
+  while(!qos_fgetline(readline, MAX_BODY_BUFFER, f)) {
+    int doubleSlash = 0;
+    apr_uri_t parsed_uri;
+    apr_pool_t *lpool;
+    char *line = readline;
+    apr_pool_create(&lpool, NULL);
+    line_nr++;
+    if((strlen(line) > 1) && line[1] == '/') {
+      doubleSlash = 1;
+      line++;
+    }
+    if(line[0] != '/') {
+      if(!m_log_req_regex) {
+        m_log_req_regex = 1;
+        fprintf(stderr, "WARNING, line %d: "
+                "unexpected data format, try to detect request lines automatically\n",
+                line_nr);
+      }
+      qos_auto_detect(&line);
+    }
+    if(apr_uri_parse(lpool, line, &parsed_uri) != APR_SUCCESS) {
+      fprintf(stderr, "ERROR, could not parse uri %s\n", line);
+      if(m_exit_on_error) exit(1);
+    }
+    if(parsed_uri.path == NULL || (parsed_uri.path[0] != '/')) {
+      fprintf(stderr, "WARNING, line %d: invalid request %s\n", line_nr, line);
+    } else if(m_filter && parsed_uri.path && strncmp(parsed_uri.path, m_filter, strlen(m_filter)) != 0) {
+      // skip filtered line
+    } else {
+      char *path = NULL;
+      char *query = NULL;
+      char *query_m_string = NULL;
+      char *query_m_pcre = NULL;
+      char *fragment = NULL;
+      char *copy = apr_pstrdup(lpool, line);
+      qos_unescaping(copy);
+      if(qos_enforce_denylist(denylist, copy)) {
+        fprintf(stderr, "WARNING: deny list filter match at line %d for %s\n",
+                line_nr, line);
+        deny_count++;
+      } else {
+        if(!qos_test_for_existing_rule(line, copy, rules, special_rules,
+                                       line_nr, rules_url, source_rules, first)) {
+          if(m_verbose > 1) printf("LINE %d, analyse: %s\n", line_nr, line);
+          if(parsed_uri.query) {
+            if(strcmp(parsed_uri.path, "/") == 0) {
+              path = apr_pstrdup(lpool, "/");
+            } else {
+              path = qos_path_pcre_string(lpool, parsed_uri.path);
+            }
+            if(m_query_single_pcre) {
+              char *qc = apr_pstrdup(lpool, parsed_uri.query);
+              qos_unescaping(qc);
+              query = apr_pstrcat(lpool, "[", qos_2pcre(lpool, qc), "]+", NULL);
+            } else {
+              if(!m_query_multi_pcre) {
+                query = qos_query_string_pcre(lpool, parsed_uri.query);
+                if(m_query_o_pcre) {
+                  query = qos_post_optimization(lpool, query);
+                }
+              } else {
+                query = qos_multi_query_string_pcre(lpool, parsed_uri.query,
+                                                    &query_m_string, &query_m_pcre);
+              }
+            }
+          } else {
+            if(strcmp(parsed_uri.path, "/") == 0) {
+              path = apr_pstrdup(lpool, "/");
+            } else {
+              if(m_handler) {
+                path = qos_path_pcre_string(lpool, parsed_uri.path);
+              } else {
+                if(qs_regexec_len(pcre_simple_path,
+                                  parsed_uri.path, strlen(parsed_uri.path),
+                                  0, NULL, 0) >= 0) {
+                  path = apr_pstrdup(lpool, QS_SIMPLE_PATH_PCRE);
+                } else {
+                  path = qos_path_pcre(lpool, parsed_uri.path);
+                }
+              }
+            }
+          }
+          if(parsed_uri.fragment) {
+            char *f = apr_pstrdup(lpool, parsed_uri.fragment);
+            if(strlen(f) > 0) {
+              qos_unescaping(f);
+              fragment = apr_pstrcat(lpool, "[", qos_2pcre(lpool, f), "]+", NULL);
+            } else {
+              fragment = apr_pstrcat(lpool, "", NULL);
+            }
+          }
+          if(m_verbose > 1) {
+            printf(" path:      %s\n", parsed_uri.path);
+            printf(" path rule: %s\n", path);
+            if(query) {
+              printf(" query:      %s\n", parsed_uri.query);
+              printf(" query rule: %s\n", query);
+            }
+            if(fragment) {
+              printf(" fragment:      %s\n", parsed_uri.fragment);
+              printf(" fragment rule: %s\n", fragment);
+            }
+          }
+          {
+            const char *errptr = NULL;
+            char *rule;
+            qs_rule_t *rs = apr_pcalloc(pool, sizeof(qs_rule_t));
+            if(doubleSlash) {
+              rule = apr_pstrcat(pool, "^[/]?", path, NULL);
+            } else {
+              rule = apr_pstrcat(pool, "^", path, NULL);
+            }
+            if(query) {
+              rule = apr_pstrcat(pool, rule, "\\?", query, NULL);
+            }
+            if(fragment) {
+              rule = apr_pstrcat(pool, rule, "#", fragment, NULL);
+              rs->fragment = 1;
+            } else {
+              rs->fragment = 0;
+            }
+            rule = apr_pstrcat(pool, rule, "$", NULL);
+            rs->pcre = qos_pcre_compile(pool, rule, 0);
+            rs->path = apr_pstrdup(pool, path);
+            if(m_query_multi_pcre && !fragment) {
+              rs->query_m_string = apr_pstrdup(pool, query_m_string);
+              rs->query_m_pcre = apr_pstrdup(pool, query_m_pcre);
+            } else {
+              rs->query_m_string = NULL;
+              rs->query_m_pcre = NULL;
+            }
+            // don't mind if extra is null
+            if(m_verbose) {
+              printf("# ADD line %d: %s\n", line_nr, line);
+              printf("# %.3d %s\n", apr_table_elts(rules)->nelts+1, rule);
+              fflush(stdout);
+            }
+            if(qs_regexec_len(rs->pcre, copy, strlen(copy), 0, NULL, 0) < 0) {
+              fprintf(stderr, "ERROR, rule check failed (did not match)!\n");
+              fprintf(stderr, " line %d: %s\n", line_nr, line);
+              fprintf(stderr, " string: %s\n", copy);
+              fprintf(stderr, " rule: %s\n", rule);
+              if(m_exit_on_error) exit(1);
+            } else {
+              apr_table_add(rules_url, copy, "unescaped line");
+              apr_table_add(source_rules, rule, "");
+              apr_table_setn(rules, rule, (char *)rs);
+            }
+            if(apr_table_elts(rules)->nelts == 2000) {
+              fprintf(stderr, "ERROR, too many rules (limited to max. 2000)\n");
+              if(m_exit_on_error) exit(1);
+            }
+            /* rule optimazion searching for redundant patterns (only in
+	       conjunction with -m, -b and !-n */
+            if((apr_table_elts(rules)->nelts == rule_optimization) &&
+               m_redundant &&
+               m_query_multi_pcre &&
+               m_base64) {
+              /* got too many rules, try to find more general rules */
+              if(m_verbose) {
+                printf("# too many rules: start rule optimization ...\n");
+                fflush(stdout);
+              }
+              qos_rule_optimization(pool, lpool, rules, special_rules);
+              if(m_verbose) {
+                printf("# continue with rule generation\n");
+                fflush(stdout);
+              }
+              rule_optimization = rule_optimization + 200;
+            }
+          }
+        }
+      }
+    }
+    apr_pool_destroy(lpool);
+  }
+  *dc = deny_count;
+  *ln = line_nr;
+}
+
+static void qos_measurement(apr_pool_t *pool, apr_table_t *denylist, apr_table_t *rules, FILE *f, int *ln) {
+  char *readline = apr_pcalloc(pool, MAX_BODY_BUFFER);
+  int line_nr = 0;
+  while(!qos_fgetline(readline, MAX_BODY_BUFFER, f)) {
+    apr_uri_t parsed_uri;
+    apr_pool_t *lpool;
+    char *line = readline;
+    apr_pool_create(&lpool, NULL);
+    line_nr++;
+    if((strlen(line) > 1) && line[1] == '/') {
+      strcpy(line, &line[1]);
+    }
+    if(line[0] != '/') {
+      qos_auto_detect(&line);
+    }
+    if(apr_uri_parse(lpool, line, &parsed_uri) != APR_SUCCESS) {
+      fprintf(stderr, "ERROR, could parse uri %s\n", line);
+      if(m_exit_on_error) exit(1);
+    }
+    if(parsed_uri.path == NULL || (parsed_uri.path[0] != '/')) {
+      fprintf(stderr, "WARNING, line %d: invalid request %s\n", line_nr, line);
+    } else {
+      char *copy = apr_pstrdup(lpool, line);
+      int i;
+      apr_table_entry_t *entry = (apr_table_entry_t *)apr_table_elts(rules)->elts;
+      qos_unescaping(copy);
+      for(i = 0; i < apr_table_elts(rules)->nelts; i++) {
+        qs_rule_t *rs = (qs_rule_t *)entry[i].val;
+        qs_regexec_len(rs->pcre, copy, strlen(copy), 0, NULL, 0);
+      }
+    }
+    apr_pool_destroy(lpool);
+  }
+  *ln = line_nr;
+}
+
+int main(int argc, const char * const argv[]) {
+  apr_table_entry_t *entry;
+  long performance = -1;
+  time_t start = time(NULL);
+  time_t end;
+  int line_nr = 0;
+  int deny_count = 0;
+  char *time_string;
+  int i, rc;
+  const char *access_log = NULL;
+  FILE *f;
+  apr_pool_t *pool;
+  apr_table_t *rules;
+  apr_table_t *special_rules;
+  apr_table_t *denylist;
+  apr_table_t *rules_url;
+  int denylist_size = 0;
+  int allowlist_size = 0;
+  char *cmd = strrchr(argv[0], '/');
+  const char *httpdconf = NULL;
+  apr_app_initialize(&argc, &argv, NULL);
+  apr_pool_create(&pool, NULL);
+  rules = apr_table_make(pool, 10);
+  special_rules = apr_table_make(pool, 10);
+  denylist = apr_table_make(pool, 10);
+  rules_url = apr_table_make(pool, 10);
+  rc = nice(10);
+  if(rc == -1) {
+    fprintf(stderr, "ERROR, failed to change nice value: %s\n", strerror(errno));
+  }
+  if(cmd == NULL) {
+    cmd = (char *)argv[0];
+  } else {
+    cmd++;
+  }
+
+  argc--;
+  argv++;
+  while(argc >= 1) {
+    if(strcmp(*argv,"-v") == 0) {
+      if (--argc >= 1) {
+        m_verbose = atoi(*(++argv));
+      }
+    } else if(strcmp(*argv,"-c") == 0) {
+      if (--argc >= 1) {
+        httpdconf = *(++argv);
+      }
+    } else if(strcmp(*argv,"-i") == 0) {
+      if (--argc >= 1) {
+        access_log = *(++argv);
+      }
+    } else if(strcmp(*argv,"-k") == 0) {
+      if (--argc >= 1) {
+        m_pfx = *(++argv);
+      }
+    } else if(strcmp(*argv,"-f") == 0) {
+      if (--argc >= 1) {
+        m_filter = *(++argv);
+      }
+    } else if(strcmp(*argv,"-d") == 0) {
+      if (--argc >= 1) {
+        m_path_depth = atoi(*(++argv));
+      }
+    } else if(strcmp(*argv,"-u") == 0) {
+      if (--argc >= 1) {
+        const char *coders = *(++argv);
+        if(strstr(coders, "uni")) {
+          m_mode |= QOS_DEC_MODE_FLAGS_UNI;
+        }
+        if(strstr(coders, "ansi")) {
+          m_mode |= QOS_DEC_MODE_FLAGS_ANSI;
+        }
+        if(strstr(coders, "html")) {
+          m_mode |= QOS_DEC_MODE_FLAGS_HTML;
+        }
+      }
+    } else if(strcmp(*argv,"-n") == 0) {
+      m_redundant = 0;
+    } else if(strcmp(*argv,"-b") == 0) {
+      if (--argc >= 1) {
+        m_base64 = atoi(*(++argv));
+      }
+    } else if(strcmp(*argv,"-l") == 0) {
+      if (--argc >= 1) {
+        m_query_len_pcre = atoi(*(++argv));
+      }
+    } else if(strcmp(*argv,"-p") == 0) {
+      m_query_pcre = 1;
+    } else if(strcmp(*argv,"-m") == 0) {
+      m_query_multi_pcre = 1;
+    } else if(strcmp(*argv,"-o") == 0) {
+      m_query_o_pcre = 1;
+    } else if(strcmp(*argv,"-s") == 0) {
+      m_query_single_pcre = 1;
+    } else if(strcmp(*argv,"-e") == 0) {
+      m_exit_on_error = 1;
+    } else if(strcmp(*argv,"-t") == 0) {
+      performance = 0;
+    } else if(strcmp(*argv,"-h") == 0) {
+      m_handler = 1;
+    } else if(strcmp(*argv,"-?") == 0) {
+      usage(cmd, 0);
+    } else if(strcmp(*argv,"-help") == 0) {
+      usage(cmd, 0);
+    } else if(strcmp(*argv,"--help") == 0) {
+      usage(cmd, 0);
+    } else if(strcmp(*argv,"--man") == 0) {
+      usage(cmd, 1);
+    }
+    argc--;
+    argv++;
+  }
+  qos_init_pcre(pool);
+
+  if((m_query_pcre && m_query_multi_pcre) ||
+     (m_query_pcre && m_query_single_pcre) ||
+     (m_query_multi_pcre && m_query_single_pcre) ||
+     (m_query_pcre && m_query_o_pcre) ||
+     (m_query_multi_pcre && m_query_o_pcre) ||
+     (m_query_single_pcre && m_query_o_pcre)) {
+    fprintf(stderr, "ERROR, option -s,-m,-o or -p can't be used together.\n");
+    exit(1);
+  }
+
+  if(httpdconf) {
+    qos_load_denylist(pool, denylist, httpdconf);
+    denylist_size = apr_table_elts(denylist)->nelts;
+    qos_load_allowlist(pool, rules, httpdconf);
+    allowlist_size = apr_table_elts(rules)->nelts;
+  }
+
+  if(access_log == NULL) usage(cmd, 0);
+  f = fopen(access_log, "r");
+  if(f == NULL) {
+    fprintf(stderr, "ERROR, could not open input file %s\n", access_log);
+    exit(1);
+  }
+  qos_process_log(pool, denylist, rules, rules_url, special_rules, f, &line_nr, &deny_count, 1);
+  fclose(f);
+
+  if(m_redundant) {
+    int xl = 0;
+    int y = 0;
+    // delete useless rules
+    qos_delete_obsolete_rules(pool, rules, rules_url);
+    // ensure, we have not deleted to many!
+    if(m_verbose) {
+      printf("# verify new rules ...\n"); 
+      fflush(stdout);
+    }
+    //    if(httpdconf) {
+    //      qos_load_allowlist(pool, rules, httpdconf);
+    //    }
+    f = fopen(access_log, "r");
+    qos_process_log(pool, denylist, rules, rules_url, special_rules, f, &xl, &y, 0);
+    fclose(f);
+  }
+
+  if(performance == 0) {
+    int lx = 0;
+    apr_time_t tv;
+    f = fopen(access_log, "r");
+    tv = apr_time_now();
+    qos_measurement(pool, denylist, rules, f, &lx);
+    tv = apr_time_now() - tv;
+    performance = apr_time_msec(tv) + (apr_time_sec(tv) * 1000);
+    performance = performance / lx;
+    fclose(f);
+  }
+
+  end = time(NULL);
+  time_string = ctime(&end);
+  time_string[strlen(time_string) - 1] = '\0';
+  printf("\n# --------------------------------------------------------\n");
+  printf("# %s\n", time_string);
+  printf("# %d rules from %d access log lines\n", apr_table_elts(rules)->nelts, line_nr);
+  printf("#  mod_qos version: %s\n", man_version);
+  if(performance >= 0) {
+    printf("#  performance index (ms/req): %ld\n", performance);
+  }
+  printf("#  source (-i): %s\n", access_log);
+  printf("#  path depth (-d): %d\n", m_path_depth);
+  printf("#  disable path only regex (-h): %s\n", m_handler == 1 ? "yes" : "no");
+  printf("#  base64 detection level (-b): %d\n", m_base64);
+  printf("#  redundancy check (-n): %s\n", m_redundant == 1 ? "yes" : "no");
+  printf("#  pcre only for query (-p): %s\n", m_query_pcre == 1 ? "yes" : "no");
+  printf("#  decoding (-u): url");
+  if(m_mode & QOS_DEC_MODE_FLAGS_UNI) {
+    printf(" uni");
+  }
+  if(m_mode & QOS_DEC_MODE_FLAGS_HTML) {
+    printf(" html");
+  }
+  if(m_mode & QOS_DEC_MODE_FLAGS_ANSI) {
+    printf(" ansi");
+  }
+  printf("\n");
+  printf("#  one pcre for query value (-m): %s\n", m_query_multi_pcre == 1 ? "yes" : "no");
+  if(m_query_o_pcre) {
+    printf("#  ignore query order (-o): yes\n");
+  }
+  printf("#  single pcre for query (-s): %s\n", m_query_single_pcre == 1 ? "yes" : "no");
+  printf("#  query outsize (-l): %d\n", m_query_len_pcre);
+  printf("#  exit on error (-e): %s\n", m_exit_on_error == 1 ? "yes" : "no");
+  printf("#  rule file (-c): %s\n", httpdconf == NULL ? "-" : httpdconf);
+  if(httpdconf) {
+    printf("#    allow list (loaded existing rules): %d\n", allowlist_size);
+    printf("#    deny list (loaded deny rules): %d\n", denylist_size);
+    printf("#    deny list matches: %d\n", deny_count);
+  }
+  printf("#  duration: %ld minutes\n", (end - start) / 60);
+  printf("# --------------------------------------------------------\n");
+
+  {
+    STACK_OF(qs_rule_t) *st = sk_new(STACK_qs_cmp);
+    qs_rule_t *r;
+    int j = 1;
+    entry = (apr_table_entry_t *)apr_table_elts(rules)->elts;
+    for(i = 0; i < apr_table_elts(rules)->nelts; i++) {
+      //  printf("QS_PermitUri +QSF%0.3d deny \"%s\"\n", i+1, entry[i].key);
+      r = apr_pcalloc(pool, sizeof(qs_rule_t));
+      r->rule = entry[i].key;
+      sk_push(st, (char *)r);
+    }
+    sk_sort(st);
+    i = sk_num(st);
+    for(; i > 0; i--) {
+      r = (qs_rule_t *)sk_value(st, i-1);
+      printf("QS_PermitUri +%s%.3d deny \"%s\"\n",
+             m_pfx ? m_pfx : "QSF",
+             j, qs_apache_escape(pool, r->rule));
+      j++;
+    }
+  }
+
+  apr_pool_destroy(pool);
+  return 0;
+}
diff --git a/tools/src/qsgeo.c b/tools/src/qsgeo.c
new file mode 100644
index 0000000..0a46628
--- /dev/null
+++ b/tools/src/qsgeo.c
@@ -0,0 +1,607 @@
+/* -*-mode: c; indent-tabs-mode: nil; c-basic-offset: 2; -*-
+ */
+/**
+ * Utilities for the quality of service module mod_qos.
+ *
+ * qsgeo.c: resolves the country codes of IP addresses
+ *
+ * See http://mod-qos.sourceforge.net/ for further
+ * details.
+ *
+ * Copyright (C) 2023 Pascal Buchbinder
+ *
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+static const char revision[] = "$Id: qsgeo.c 2654 2022-05-13 09:12:42Z pbuchbinder $";
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <errno.h>
+#include <string.h>
+#include <time.h>
+#include <sys/time.h>
+#include <regex.h>
+
+/* apr */
+#include <apr.h>
+#include <apr_strings.h>
+#include <apr_file_io.h>
+#include <apr_time.h>
+#include <apr_lib.h>
+#include <apr_portable.h>
+#include <apr_support.h>
+#include <apr_base64.h>
+
+#include "qs_util.h"
+
+#define MAX_REG_MATCH 10
+
+// "3758096128","3758096383","AU"
+#define QS_GEO_PATTERN "\"([0-9]+)\",\"([0-9]+)\",\"([A-Z0-9]{2}|-)\""
+// "3758096128","3758096383","AU","Australia"
+#define QS_GEO_PATTERN_D "\"([0-9]+)\",\"([0-9]+)\",\"([A-Z0-9]{2})\",\"(.*)\""
+// "192.83.198.0","192.83.198.255","3226715648","3226715903","AU","Australia"
+#define QS_GEO_PATTERN_EXT  "\"[0-9]+\\.[0-9]+\\.[0-9]+\\.[0-9]+\",\"[0-9]+\\.[0-9]+\\.[0-9]+\\.[0-9]+\",\"([0-9]+)\",\"([0-9]+)\",\"([A-Z0-9]{2})\""
+// 182.12.34.23
+#define IPPATTERN "([0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3})[\"'\x0d\x0a, ]+"
+#define IPPATTERN2 "([0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3})[\"'\x0d\x0a,; ]+"
+
+static int m_inject = 0;
+static int m_verbose = 0;
+
+typedef struct {
+  unsigned long start;
+  char *c;
+} qos_inj_t;
+
+static const qos_inj_t m_inj[] = {
+  { 167772160, "\"10.0.0.0\",\"10.255.255.255\",\"167772160\",\"184549375\",\"PV\",\"private network\"" },
+  { 2130706432, "\"127.0.0.0\",\"127.255.255.255\",\"2130706432\",\"2147483647\",\"LO\",\"local loopback\"" },
+  { 2886729728, "\"172.16.0.0\",\"172.31.255.255\",\"2886729728\",\"2887778303\",\"PV\",\"private network\"" },
+  { 3232235520, "\"192.168.0.0\",\"192.168.255.255\",\"3232235520\",\"3232301055\",\"PV\",\"private network\"" },
+  { 0, NULL }
+};
+
+typedef struct {
+  unsigned long start;
+  unsigned long end;
+  char country[3];
+  char c[500];
+} qos_geo_t;
+
+typedef struct {
+  int num;
+  char *c;
+} qos_geo_stat_t;
+
+static int qos_is_num(const char *num) {
+  int i = 0;
+  while(num[i]) {
+    if(!isdigit(num[i])) {
+      return 0;
+    }
+    i++;
+  }
+  return 1;
+}
+
+/**
+ * Converts an IPv4 address string to it's numeric value.
+ * w.x.y.z results in 16777216*w + 65536*x + 256*y + z
+ *
+ * @param pool To make a copy of the address to parse
+ * @param ip
+ * @return The address or 0 on error
+ */
+static unsigned long qos_geo_str2long(apr_pool_t *pool, const char *ip) {
+  char *p;
+  char *i = apr_pstrdup(pool, ip);
+  unsigned long addr = 0;
+
+  p = strchr(i, '.');
+  if(!p) return 0;
+  p[0] = '\0';
+  if(!qos_is_num(i)) return 0;
+  addr += (atol(i) * 16777216);
+  i = p;
+  i++;
+
+  p = strchr(i, '.');
+  if(!p) return 0;
+  p[0] = '\0';
+  if(!qos_is_num(i)) return 0;
+  addr += (atol(i) * 65536);
+  i = p;
+  i++;
+
+  p = strchr(i, '.');
+  if(!p) return 0;
+  p[0] = '\0';
+  if(!qos_is_num(i)) return 0;
+  addr += (atol(i) * 256);
+  i = p;
+  i++;
+
+  if(!qos_is_num(i)) return 0;
+  addr += (atol(i));
+
+  return addr;
+}
+
+static void qos_geo_long2str(char *buf, unsigned long ip) {
+  int a,b,c,d;
+  a = ip % 256;
+  ip = ip / 256;
+  b = ip % 256;
+  ip = ip / 256;
+  c = ip % 256;
+  ip = ip / 256;
+  d = ip % 256;
+  sprintf(buf, "%d.%d.%d.%d", d, c, b, a);
+}
+
+/**
+ * Usage message (text or manpage format).
+ */
+static void usage(const char *cmd, int man) {
+  if(man) {
+    //.TH [name of program] [section number] [center footer] [left footer] [center header]
+    printf(".TH %s 1 \"%s\" \"mod_qos utilities %s\" \"%s man page\"\n", qs_CMD(cmd), man_date,
+	   man_version, cmd);
+  }
+  printf("\n");
+  if(man) {
+    printf(".SH NAME\n");
+  }
+  qs_man_print(man, "%s - an utility to lookup a client's country code.\n", cmd);
+  printf("\n");
+  if(man) {
+    printf(".SH SYNOPSIS\n");
+  }
+  qs_man_print(man, "%s%s -d <path> [-l] [-s] [-ip <ip>]\n",  man ? "" : "Usage: ", cmd);
+  printf("\n");
+  if(man) {
+    printf(".SH DESCRIPTION\n");
+  } else {
+    printf("Summary\n");
+  }
+  qs_man_print(man, "Use this utility to resolve the country codes of IP addresses\n");
+  qs_man_print(man, "within existing log files. The utility reads the log file data\n");
+  qs_man_print(man, "from stdin and writes them, with the injected country code, to\n");
+  qs_man_print(man, "stdout.\n");
+  printf("\n");
+  if(man) {
+    printf(".SH OPTIONS\n");
+  } else {
+    printf("Options\n");
+  }
+  if(man) printf("\n.TP\n");
+  qs_man_print(man, "  -d <path>\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Specifies the path to the geographical database files (CSV\n");
+  qs_man_print(man, "     file containing IP address ranges and country codes).\n");
+  if(man) printf("\n.TP\n");
+  qs_man_print(man, "  -s\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Writes a summary of the requests per country only.\n");
+  if(man) printf("\n.TP\n");
+  qs_man_print(man, "  -l\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Writes the database to stdout (ignoring stdin) inserting\n");
+  qs_man_print(man, "     local (127.*) and private (10.*, 172.16*, 192.168.*)\n");
+  qs_man_print(man, "     network addresses.\n");
+  if(man) printf("\n.TP\n");
+  qs_man_print(man, "  -ip <ip>\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Resolves a single IP address instead of processing a log file.\n");
+  printf("\n");
+  if(man) {
+    printf(".SH EXAMPLE\n");
+    printf("Reading the file access.log and adding the country code to the IP address field:\n");
+    printf("\n");
+  } else {
+    printf("Example reading the file access.log and adding the country code to\n");
+    printf("the IP address field:\n");
+  }
+  qs_man_println(man, "  cat access.log | %s -d GeoIPCountryWhois.csv\n", cmd);
+  printf("\n");
+  if(man) {
+    printf("Reading the file access.log and showing a summary only:\n");
+    printf("\n");
+  } else {
+    printf("Example reading the file access.log and showing a summary only:\n");
+  }
+  qs_man_println(man, "  cat access.log | %s -d GeoIPCountryWhois.csv -s\n", cmd);
+  printf("\n");
+  if(man) {
+    printf("Resolving a single IP address:\n");
+    printf("\n");
+  } else {
+   printf("Example resolving a single IP address:\n");
+  }
+  qs_man_println(man, "  %s -d GeoIPCountryWhois.csv -ip 192.84.12.23\n", cmd);
+  printf("\n");
+  if(man) {
+    printf(".SH SEE ALSO\n");
+    printf("qsdt(1), qsexec(1), qsfilter2(1), qsgrep(1), qshead(1), qslog(1), qslogger(1), qspng(1), qsre(1), qsrespeed(1), qsrotate(1), qssign(1), qstail(1)\n");
+    printf(".SH AUTHOR\n");
+    printf("Pascal Buchbinder, http://mod-qos.sourceforge.net/\n");
+  } else {
+    printf("See http://mod-qos.sourceforge.net/ for further details.\n");
+  }
+  if(man) {
+    exit(0);
+  } else {
+    exit(1);
+  }
+}
+
+/**
+ * Comperator to search entries using bsearch.
+ */
+static int qos_geo_comp(const void *_pA, const void *_pB) {
+  unsigned long *pA = (unsigned long *)_pA;
+  qos_geo_t *pB = (qos_geo_t *)_pB;
+  unsigned long search = *pA;
+  if((search >= pB->start) && (search <= pB->end)) return 0;
+  if(search > pB->start) return 1;
+  if(search < pB->start) return -1;
+  return -1; // error
+}
+
+/**
+ * Loads the (sorted) CSV file into the memory.
+ *
+ * @param pool
+ * @param db Path to the db file
+ * @param size Returns the size f the db (elements in the array)
+ * @param msg Error message if something got wrong
+ * @return Array with all entries from the CSV file (or NULL on error)
+ */
+static qos_geo_t *qos_loadgeo(apr_pool_t *pool, const char *db, int *size, char **msg, int *errors) {
+  regmatch_t ma[MAX_REG_MATCH];
+  regex_t preg;
+  regex_t pregd;
+  regex_t pregext;
+  qos_geo_t *geo = NULL;
+  qos_geo_t *g = NULL;
+  qos_geo_t *last = NULL;
+  int lines = 0;
+  char line[HUGE_STRING_LEN];
+  char buf[HUGE_STRING_LEN];
+  FILE *file;
+  const qos_inj_t *inj = m_inj;
+  *size = 0;
+  if(regcomp(&preg, QS_GEO_PATTERN, REG_EXTENDED)) {
+    // internal error
+    *msg = apr_pstrdup(pool, "failed to compile regular expression "QS_GEO_PATTERN);
+    (*errors)++;
+    return NULL;
+  }
+  if(regcomp(&pregd, QS_GEO_PATTERN_D, REG_EXTENDED)) {
+    // internal error
+    *msg = apr_pstrdup(pool, "failed to compile regular expression "QS_GEO_PATTERN_D);
+    (*errors)++;
+    return NULL;
+  }
+  if(regcomp(&pregext, QS_GEO_PATTERN_EXT, REG_EXTENDED)) {
+    // internal error
+    *msg = apr_pstrdup(pool, "failed to compile regular expression "QS_GEO_PATTERN_EXT);
+    (*errors)++;
+    return NULL;
+  }
+  file = fopen(db, "r");
+  if(!file) {
+    (*errors)++;
+    return NULL;
+  }
+  while(fgets(line, sizeof(line), file) != NULL) {
+    if(strlen(line) > 0) {
+      if(regexec(&preg, line, 0, NULL, 0) == 0) {
+	lines++;
+      } else {
+	*msg = apr_psprintf(pool, "invalid entry in database: '%s'", line);
+        (*errors)++;
+        if(m_verbose) {
+          char *p = *msg;
+          while(p[0]) {
+            if(p[0] < 32) {
+              p[0] = '.';
+            }
+            p++;
+          }
+          fprintf(stderr, "line %d: %s\n", lines, *msg);
+        }
+      }
+    }
+  }
+  *size = lines;
+  geo = apr_pcalloc(pool, sizeof(qos_geo_t) * lines);
+  g = geo;
+  fseek(file, 0, SEEK_SET);
+  lines = 0;
+  while(fgets(line, sizeof(line), file) != NULL) {
+    lines++;
+    if(strlen(line) > 0) {
+      int plus = 0;
+      if(m_inject) {
+        strcpy(buf, line);
+      }
+      if(regexec(&pregd, line, MAX_REG_MATCH, ma, 0) == 0) {
+	plus = 1;
+      }
+      if(plus || regexec(&preg, line, MAX_REG_MATCH, ma, 0) == 0) {
+        int missingAddr = 0;
+        if(regexec(&pregext, line, 0, NULL, 0) != 0) {
+          missingAddr = 1;
+        }
+	line[ma[1].rm_eo] = '\0';
+	line[ma[2].rm_eo] = '\0';
+	line[ma[3].rm_eo] = '\0';
+	g->start = atoll(&line[ma[1].rm_so]);
+	g->end = atoll(&line[ma[2].rm_so]);
+	g->c[0] = '\0';
+        if(m_inject) {
+          if(inj->start && (g->start > inj->start)) {
+            while(inj->start && (g->start > inj->start)) {
+              printf("%s\n", inj->c);
+              inj++;
+            }
+          } else if(g->start != inj->start) {
+            if(missingAddr) {
+              /* some databases do not include IP address 
+                 representation (but number only) */
+              char bs[128];
+              char be[128];
+              qos_geo_long2str(bs, g->start);
+              qos_geo_long2str(be, g->end);
+              printf("\"%s\",\"%s\",%s", bs, be, buf);
+            }
+          }
+          if(!missingAddr) {
+            printf("%s", buf);
+          }
+        }
+	strncpy(g->country, &line[ma[3].rm_so], 2);
+	if(last) {
+	  if(g->start < last->start) {
+	    *msg = apr_psprintf(pool, "wrong order/lines not sorted (line %d)", lines);
+            (*errors)++;
+            if(m_verbose) {
+              fprintf(stderr, "line %d: wrong order/lines not sorted\n", lines);
+            }
+	  }
+	}
+	if(plus) {
+	  line[ma[4].rm_eo] = '\0';
+	  strncpy(g->c, &line[ma[4].rm_so], 500);
+	}
+	last = g;
+	g++;
+      }
+    }
+  }
+  fclose(file);
+  return geo;
+}
+
+int main(int argc, const char * const argv[]) {
+  int errors = 0;
+  int rc;
+  int stat = 0;
+  const char *ip = NULL;
+  char *msg = NULL;
+  qos_geo_t *geo;
+  int size;
+  const char *db = NULL;
+  apr_table_t *entries;
+  apr_pool_t *pool;
+  const char *cmd = strrchr(argv[0], '/');
+  apr_app_initialize(&argc, &argv, NULL);
+  apr_pool_create(&pool, NULL);
+  entries = apr_table_make(pool, 100);
+
+  if(cmd == NULL) {
+    cmd = (char *)argv[0];
+  } else {
+    cmd++;
+  }
+
+  argc--;
+  argv++;
+  while(argc >= 1) {
+    if(strcmp(*argv, "-d") == 0) {
+      if (--argc >= 1) {
+	db = *(++argv);
+      }
+    } else if(strcmp(*argv, "-ip") == 0) {
+      if (--argc >= 1) {
+	ip = *(++argv);
+      }
+    } else if(strcmp(*argv, "-s") == 0) {
+      stat = 1;
+    } else if(strcmp(*argv, "-l") == 0) {
+      m_inject = 1;
+    } else if(strcmp(*argv, "-v") == 0) {
+      m_verbose = 1;
+    } else if(strcmp(*argv,"-h") == 0) {
+      usage(cmd, 0);
+    } else if(strcmp(*argv,"--help") == 0) {
+      usage(cmd, 0);
+    } else if(strcmp(*argv,"-?") == 0) {
+      usage(cmd, 0);
+    } else if(strcmp(*argv,"--man") == 0) {
+      usage(cmd, 1);
+    } else {
+      usage(cmd, 0);
+    }
+    argc--;
+    argv++;
+  }
+
+  if(db == NULL) {
+    usage(cmd, 0);
+  }
+
+  rc = nice(10);
+  if(rc == -1) {
+    fprintf(stderr, "ERROR, failed to change nice value: %s\n", strerror(errno));
+  }
+
+  geo = qos_loadgeo(pool, db, &size, &msg, &errors);
+  if(geo == NULL || msg != NULL) {
+    if(msg) {
+      char *p = msg;
+      while(p[0]) {
+        if(p[0] < 32) {
+          p[0] = '.';
+        }
+        p++;
+      }
+    }
+    fprintf(stderr, "failed to load database: %s (total %d errors)\n",
+            msg ? msg : "-", errors);
+    exit(1);
+  }
+  if(m_inject) {
+    exit(0);
+  }
+  
+  if(ip) {
+    qos_geo_t *pB;
+    unsigned long search = qos_geo_str2long(pool, ip);
+    printf("search %lu: ", search);
+    pB = bsearch(&search,
+		 geo,
+		 size,
+		 sizeof(qos_geo_t),
+		 qos_geo_comp);
+    if(pB) {
+      printf("%s\n", pB->country);
+    } else {
+      printf("n/a\n");
+    }
+    return 0;
+  }
+
+  // start reading from stdin
+  {
+    char prev;
+    qos_geo_t *pB;
+    apr_pool_t *tmp;
+    char *line = calloc(1, MAX_LINE_BUFFER+1);
+    regex_t preg;
+    regex_t preg2;
+    regmatch_t ma[MAX_REG_MATCH];
+    apr_pool_create(&tmp, NULL);
+    if(regcomp(&preg, IPPATTERN, REG_EXTENDED)) {
+      exit(1);
+    }
+    regcomp(&preg2, IPPATTERN2, REG_EXTENDED);
+    while(fgets(line, MAX_LINE_BUFFER, stdin) != NULL) {
+      int match = regexec(&preg, line, MAX_REG_MATCH, ma, 0);
+      if(match != 0) {
+        char *dx = strchr(line, ';');
+        if(dx && ((dx - line) <= 15)) {
+          // file starts probably with <ip>; => a qslog -pc file?
+          match = regexec(&preg2, line, MAX_REG_MATCH, ma, 0);
+        }
+      }
+      if(match == 0) {
+        unsigned long search;
+        prev = line[ma[1].rm_eo];
+        line[ma[1].rm_eo] = '\0';
+        search = qos_geo_str2long(tmp, &line[ma[1].rm_so]);
+        apr_pool_clear(tmp);
+        pB = bsearch(&search,
+                     geo,
+                     size,
+                     sizeof(qos_geo_t),
+                     qos_geo_comp);
+        if(stat) {
+          /* creates a single statistic entry for each country (used to collect
+             requests per source country) */
+          if(pB) {
+            qos_geo_stat_t *s = (qos_geo_stat_t *)apr_table_get(entries, pB->country);
+            if(s == NULL) {
+              s = apr_pcalloc(pool, sizeof(qos_geo_stat_t));
+              s->num = 0;
+              s->c = pB->c;
+              apr_table_addn(entries, apr_pstrdup(pool, pB->country), (char *)s);
+            }
+            s->num++;
+          }
+        } else {
+          /* modifies each log line inserting the country code
+           */
+          char cr = prev;
+          char delw[2];
+          char delx[2];
+          delw[1] = '\0';
+          delw[0] = ' ';
+          delx[1] = '\0';
+          delx[0] = ' ';
+          if(line[ma[1].rm_eo+1] == ' ') {
+            delx[0] = '\0';
+          }
+          if(line[ma[1].rm_eo+1] == ';') {
+            delx[0] = ';';
+          }
+          if(prev <= CR) {
+            prev = ' ';
+          }
+          if(prev == ' ') {
+            delw[0] = '\0';
+          }
+          if(prev == ';') {
+            delw[0] = '\0';
+            delx[0] = ';';
+          }
+          if(pB) {
+            printf("%s%c%s%s%s%s", line, prev,
+                   delw,
+                   pB->country,
+                   delx,
+                   &line[ma[1].rm_eo+1]);
+          } else {
+            printf("%s%c%s--%s%s", line, prev,
+                   delw,
+                   delx,
+                   &line[ma[1].rm_eo+1]);
+          }
+          if(cr <= CR) {
+            printf("\n");
+          }
+        }
+      } else {
+        printf("%s", line);
+      }
+      fflush(stdout);
+    }
+    if(stat) {
+      int i;
+      apr_table_entry_t *entry = (apr_table_entry_t *)apr_table_elts(entries)->elts;
+      for(i = 0; i < apr_table_elts(entries)->nelts; i++) {
+	qos_geo_stat_t *s = (qos_geo_stat_t *)entry[i].val;
+	printf("%7.d %s %s\n", s->num, entry[i].key, s->c ? s->c : "");
+      }
+    }
+  }
+  return 0;
+}
diff --git a/tools/src/qsgrep.c b/tools/src/qsgrep.c
new file mode 100644
index 0000000..5b2c654
--- /dev/null
+++ b/tools/src/qsgrep.c
@@ -0,0 +1,301 @@
+/* -*-mode: c; indent-tabs-mode: nil; c-basic-offset: 2; -*-
+ */
+/**
+ * Filter utility for the quality of service module mod_qos.
+ *
+ * qsgrep.c: simple tool to search patterns within files
+ *
+ * See http://mod-qos.sourceforge.net/ for further details.
+ *
+ * Copyright (C) 2023 Pascal Buchbinder
+ *
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+static const char revision[] = "$Id: qsgrep.c 2654 2022-05-13 09:12:42Z pbuchbinder $";
+
+/* system */
+#include <stdio.h>
+#include <errno.h>
+#include <string.h>
+
+#include <stdlib.h>
+#include <unistd.h>
+#include <time.h>
+
+/* apr */
+#include <apr.h>
+#include <apr_strings.h>
+#include <apr_file_io.h>
+#include <apr_time.h>
+#include <apr_getopt.h>
+#include <apr_general.h>
+#include <apr_lib.h>
+#include <apr_portable.h>
+#include <apr_support.h>
+
+#define PCRE2_CODE_UNIT_WIDTH 8
+#include <pcre2.h>
+
+#include "qs_util.h"
+
+#ifndef POSIX_MALLOC_THRESHOLD
+#define POSIX_MALLOC_THRESHOLD (10)
+#endif
+
+/* same as APR_SIZE_MAX which doesn't appear until APR 1.3 */
+#define QSUTIL_SIZE_MAX (~((apr_size_t)0))
+
+typedef struct {
+    int rm_so;
+    int rm_eo;
+} regmatch_t;
+
+static void usage(char *cmd, int man) {
+  if(man) {
+    //.TH [name of program] [section number] [center footer] [left footer] [center header]
+    printf(".TH %s 1 \"%s\" \"mod_qos utilities %s\" \"%s man page\"\n", qs_CMD(cmd), man_date,
+	   man_version, cmd);
+  }
+  printf("\n");
+  if(man) {
+    printf(".SH NAME\n");
+  }
+  qs_man_print(man, "%s - prints matching patterns within a file.\n", cmd);
+  printf("\n");
+  if(man) {
+    printf(".SH SYNOPSIS\n");
+  }
+  qs_man_print(man, "%s%s -e <pattern> -o <sub string> [<path>]\n", man ? "" : "Usage: ", cmd);
+  printf("\n");
+  if(man) {
+    printf(".SH DESCRIPTION\n");
+  } else {
+    printf("Summary\n");
+  }
+  qs_man_print(man, "%s is a simple tool to search patterns within files.\n", cmd);
+  qs_man_print(man, "It uses regular expressions to find patterns and prints the\n");
+  qs_man_print(man, "submatches within a pre-defined format string.\n");
+  printf("\n");
+  if(man) {
+    printf(".SH OPTIONS\n");
+  } else {
+    printf("Options\n");
+  }
+  if(man) printf(".TP\n");
+  qs_man_print(man, "  -e <pattern>\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Specifies the search pattern.\n");
+  if(man) printf("\n.TP\n");
+  qs_man_print(man, "  -o <string>\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Defines the output string where $0-$9 are substituted by the\n");
+  qs_man_print(man, "     submatches of the regular expression.\n");
+  if(man) printf("\n.TP\n");
+  qs_man_print(man, "  <path>\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Defines the input file to process. %s reads from\n", cmd);
+  qs_man_print(man, "     from standard input if this parameter is omitted.\n");
+  printf("\n");
+  printf("\n");
+  if(man) {
+    printf(".SH EXAMPLE\n");
+    qs_man_println(man, "Shows the IP addresses of clients causing mod_qos(031) messages):\n");
+    printf("\n");
+  } else {
+    printf("Example (shows the IP addresses of clients causing mod_qos(031) messages):\n");
+  }
+  qs_man_println(man, "  %s -e 'mod_qos\\(031\\).*, c=([a-zA-Z0-9:.]*)' -o 'ip=$1' error_log\n", cmd);
+  printf("\n");
+  if(man) {
+    printf(".SH SEE ALSO\n");
+    printf("qsdt(1), qsexec(1), qsfilter2(1), qsgeo(1), qshead(1), qslog(1), qslogger(1), qspng(1), qsre(1), qsrespeed(1), qsrotate(1), qssign(1), qstail(1)\n");
+    printf(".SH AUTHOR\n");
+    printf("Pascal Buchbinder, http://mod-qos.sourceforge.net/\n");
+  } else {
+    printf("See http://mod-qos.sourceforge.net/ for further details.\n");
+  }
+  if(man) {
+    exit(0);
+  } else {
+    exit(1);
+  }
+}
+
+/*
+ * Substitutes for $0-$9 within the matching string.
+ * See ap_pregsub().
+ */
+char *qs_pregsub(apr_pool_t *pool, const char *input,
+		 const char *source, size_t nmatch,
+		 qs_regmatch_t pmatch[]) {
+  const char *src = input;
+  char *dest, *dst;
+  char c;
+  size_t no;
+  int len;
+  if(!source) {
+    return NULL;
+  }
+  if(!nmatch) {
+    return apr_pstrdup(pool, src);
+  }
+  /* First pass, find the size */  
+  len = 0;
+  while((c = *src++) != '\0') {
+    if(c == '&')
+      no = 0;
+    else if (c == '$' && apr_isdigit(*src))
+      no = *src++ - '0';
+    else
+      no = 10;
+    
+    if (no > 9) {                /* Ordinary character. */
+      if (c == '\\' && (*src == '$' || *src == '&'))
+	src++;
+      len++;
+    }
+    else if (no < nmatch && pmatch[no].rm_so < pmatch[no].rm_eo) {
+      if(QSUTIL_SIZE_MAX - len <= pmatch[no].rm_eo - pmatch[no].rm_so) {
+        fprintf(stderr, "ERROR, integer overflow or out of memory condition");
+        return NULL;
+      }
+      len += pmatch[no].rm_eo - pmatch[no].rm_so;
+    }
+    
+  }
+  dest = dst = apr_pcalloc(pool, len + 1);
+  /* Now actually fill in the string */
+  src = input;
+  while ((c = *src++) != '\0') {
+    if (c == '&')
+      no = 0;
+    else if (c == '$' && apr_isdigit(*src))
+      no = *src++ - '0';
+    else
+      no = 10;
+
+    if (no > 9) {                /* Ordinary character. */
+      if (c == '\\' && (*src == '$' || *src == '&'))
+	c = *src++;
+      *dst++ = c;
+    }
+    else if (no < nmatch && pmatch[no].rm_so < pmatch[no].rm_eo) {
+      len = pmatch[no].rm_eo - pmatch[no].rm_so;
+      memcpy(dst, source + pmatch[no].rm_so, len);
+      dst += len;
+    }
+  }
+  *dst = '\0';
+  return dest;
+}
+
+int main(int argc, const char * const argv[]) {
+  unsigned long nr = 0;
+  char line[32768];
+  FILE *file = 0;
+  apr_pool_t *pool;
+  char *cmd = strrchr(argv[0], '/');
+  const char *out = NULL;
+  const char *pattern = NULL;
+  const char *filename = NULL;
+  qs_regex_t *preg;
+  qs_regmatch_t regm[QS_MAX_REG_MATCH];
+  apr_app_initialize(&argc, &argv, NULL);
+  apr_pool_create(&pool, NULL);
+
+  if(cmd == NULL) {
+    cmd = (char *)argv[0];
+  } else {
+    cmd++;
+  }
+
+  argc--;
+  argv++;
+  while(argc >= 1) {
+    if(strcmp(*argv,"-e") == 0) {
+      if (--argc >= 1) {
+	pattern = *(++argv);
+      } 
+    } else if(strcmp(*argv,"-o") == 0) {
+      if (--argc >= 1) {
+	out = *(++argv);
+      }
+    } else if(strcmp(*argv,"-h") == 0) {
+      usage(cmd, 0);
+    } else if(strcmp(*argv,"-?") == 0) {
+      usage(cmd, 0);
+    } else if(strcmp(*argv,"-help") == 0) {
+      usage(cmd, 0);
+    } else if(strcmp(*argv,"--man") == 0) {
+      usage(cmd, 1);
+    } else {
+      filename = *argv;
+    }
+    argc--;
+    argv++;
+  }
+
+  if(pattern == NULL || out == NULL) {
+    usage(cmd, 0);
+  }
+
+  if(nice(10) == -1) {
+    fprintf(stderr, "ERROR, failed to change nice value: %s\n", strerror(errno));
+  }
+
+  preg = apr_palloc(pool, sizeof(qs_regex_t));
+  if(qs_regcomp(preg, pattern, PCRE2_DOTALL) != 0) {
+    fprintf(stderr, "ERROR, could not compile '%s\n", pattern);
+    exit(1);
+  }
+  apr_pool_pre_cleanup_register(pool, preg, qs_pregfree);
+
+  if(filename) {
+    file = fopen(filename, "r");
+    if(!file) {
+      fprintf(stderr, "ERROR, could not open file\n");
+      exit(1);
+    }
+  } else {
+    file = stdin;
+  }
+    
+  while(fgets(line, sizeof(line), file) != NULL) {
+    size_t len = strlen(line);
+    nr++;
+    if(qs_regexec_len(preg, line, len, QS_MAX_REG_MATCH, regm, 0) >= 0) {
+      apr_pool_t *subpool;
+      char *replaced;
+      apr_pool_create(&subpool, pool);
+      replaced = qs_pregsub(subpool, out, line, QS_MAX_REG_MATCH, regm);
+      if(!replaced) {
+	fprintf(stderr, "ERROR, failed to substitute submatches (line=%lu)\n", nr);
+      } else {
+	printf("%s\n", replaced);
+        fflush(stdout);
+      }
+      apr_pool_destroy(subpool);
+    }
+  }
+
+  if(filename) {
+    fclose(file);
+  }
+  apr_pool_destroy(pool);
+  return 0;
+}
diff --git a/tools/src/qshead.c b/tools/src/qshead.c
new file mode 100644
index 0000000..49130ad
--- /dev/null
+++ b/tools/src/qshead.c
@@ -0,0 +1,132 @@
+/* -*-mode: c; indent-tabs-mode: nil; c-basic-offset: 2; -*-
+ */
+/**
+ * Utilities for the quality of service module mod_qos.
+ *
+ * qshead.c: Shows the beginning of a log file stopping at the provided pattern.
+ *
+ * See http://mod-qos.sourceforge.net/ for further
+ * details.
+ *
+ * Copyright (C) 2023 Pascal Buchbinder
+ *
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+static const char revision[] = "$Id: qshead.c 2654 2022-05-13 09:12:42Z pbuchbinder $";
+
+#include <stdio.h>
+#include <unistd.h>
+#include <string.h>
+#include <stdlib.h>
+#include <signal.h>
+
+#include "qs_util.h"
+
+static void usage(char *cmd, int man) {
+  if(man) {
+    //.TH [name of program] [section number] [center footer] [left footer] [center header]
+    printf(".TH %s 1 \"%s\" \"mod_qos utilities %s\" \"%s man page\"\n", qs_CMD(cmd), man_date,
+	   man_version, cmd);
+  }
+  printf("\n");
+  if(man) {
+    printf(".SH NAME\n");
+  }
+  qs_man_print(man, "%s - an utility reading from stdin and printing all"
+               " lines to stdout until"
+               " reaching the defined pattern.\n", cmd);
+  printf("\n");
+  if(man) {
+    printf(".SH SYNOPSIS\n");
+  }
+  qs_man_print(man, "%s%s -p <pattern>\n", man ? "" : "Usage: ", cmd);
+  printf("\n");
+  if(man) {
+    printf(".SH DESCRIPTION\n");
+  } else {
+    printf("Summary\n");
+  }
+  qs_man_print(man, " %s reads lines from stdin and prints them to stdout until a line contains\n", cmd);
+  qs_man_print(man, " the specified pattern (literal string).\n");
+  printf("\n");
+  if(man) {
+    printf(".SH OPTIONS\n");
+  } else {
+    printf("Options\n");
+  }
+  if(man) printf(".TP\n");
+  qs_man_print(man, "  -p <pattern>\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Search pattern (literal string).\n");
+  printf("\n");
+  if(man) {
+    printf(".SH SEE ALSO\n");
+    printf("qsdt(1), qsexec(1), qsfilter2(1), qsgeo(1), qsgrep(1), qslog(1), qslogger(1), qspng(1), qsre(1), qsrespeed(1), qsrotate(1), qssign(1) qstail(1)\n");
+    printf(".SH AUTHOR\n");
+    printf("Pascal Buchbinder, http://mod-qos.sourceforge.net/\n");
+  } else {
+    printf("See http://mod-qos.sourceforge.net/ for further details.\n");
+  }
+  if(man) {
+    exit(0);
+  } else {
+    exit(1);
+  }
+}
+
+int main(int argc, const char * const argv[]) {
+  char line[32768];
+  const char *pattern = NULL;
+  char *cmd = strrchr(argv[0], '/');
+  int status = 0;
+  if(cmd == NULL) {
+    cmd = (char *)argv[0];
+  } else {
+    cmd++;
+  }
+
+  argc--;
+  argv++;
+  while(argc >= 1) {
+    if(strcmp(*argv,"-p") == 0) {
+      if (--argc >= 1) {
+	pattern = *(++argv);
+      } 
+    } else if(strcmp(*argv,"-?") == 0) {
+      usage(cmd, 0);
+    } else if(strcmp(*argv,"-help") == 0) {
+      usage(cmd, 0);
+    } else if(strcmp(*argv,"--man") == 0) {
+      usage(cmd, 1);
+    }
+    argc--;
+    argv++;
+  }
+
+  if(pattern == NULL) {
+    usage(cmd, 0);
+  }
+
+  while(fgets(line, sizeof(line), stdin) != NULL) {
+    printf("%s", line);
+    if(strstr(line, pattern)) {
+      return status;
+    }
+  }
+  return status;
+}
diff --git a/tools/src/qslog.c b/tools/src/qslog.c
new file mode 100644
index 0000000..da476f8
--- /dev/null
+++ b/tools/src/qslog.c
@@ -0,0 +1,2681 @@
+/* -*-mode: c; indent-tabs-mode: nil; c-basic-offset: 2; -*-
+ */
+
+/**
+ * Utilities for the quality of service module mod_qos.
+ *
+ * qslog.c: Real time access log data correlation.
+ *
+ * See http://mod-qos.sourceforge.net/ for further
+ * details.
+ *
+ * Copyright (C) 2023 Pascal Buchbinder
+ *
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+static const char revision[] = "$Id: qslog.c 2654 2022-05-13 09:12:42Z pbuchbinder $";
+
+#include <stdio.h>
+#include <string.h>
+#include <sys/stat.h>
+#include <errno.h>
+#include <stdarg.h>
+#include <ctype.h>
+
+#include <stdlib.h>
+#include <unistd.h>
+#include <pthread.h>
+#include <pwd.h>
+
+#include <regex.h>
+#include <time.h>
+
+/* apr */
+#include <apr.h>
+#include <apr_portable.h>
+#include <apr_support.h>
+#include <apr_strings.h>
+
+#define PCRE2_CODE_UNIT_WIDTH 8
+#include <pcre2.h>
+
+#include "qs_util.h"
+
+/* ----------------------------------
+ * definitions
+ * ---------------------------------- */
+#define ACTIVE_TIME 600 /* how long is a client "active" (ip addresses seen in the log) */
+#define LOG_INTERVAL 60 /* log interval ist 60 sec, don't change this value */
+#define QS_GC_INTERVAL 10
+#define LOG_DET ".detailed"
+#define RULE_DELIM ':'
+#define MAX_CLIENT_ENTRIES 25000
+#define MAX_EVENT_ENTRIES  50000
+#define NUM_EVENT_TABLES   8
+#define QS_GENERATIONS 14
+#define EVENT_DELIM ','
+#define QSEVENTPATH "QSEVENTPATH" /* variable name to find event definitions */
+#define QSCOUNTERPATH "QSCOUNTERPATH" /* counter rule definitions */
+#define COUNTER_PATTERN "([a-zA-Z0-9_]+):([a-zA-Z0-9_]+)[-]([0-9]+)[*]([a-zA-Z0-9_]+)[/]([0-9]+)=([0-9]+)"
+
+/* ----------------------------------
+ * structures
+ * ---------------------------------- */
+
+typedef struct {
+  const char *name;
+  int limit;
+  int count;
+  int total;
+  time_t start;
+  int duration;
+  const char *inc;
+  const char *dec;
+  int decVal;
+} counter_rec_t;
+
+typedef struct {
+  unsigned long long lines;
+  unsigned long long ms;
+  unsigned long long pivot[21];
+} duration_t;
+
+typedef struct {
+  long request_count;
+  long status_1;
+  long status_2;
+  long status_3;
+  long status_4;
+  long status_5;
+  long long duration_count_ms;
+} url_rec_t;
+
+typedef struct {
+  long request_count;
+  long error_count;
+  long long byte_count;
+  long long duration;
+  long long duration_count_ms;
+  long duration_0;
+  long duration_1;
+  long duration_2;
+  long duration_3;
+  long duration_4;
+  long duration_5;
+  long duration_6;
+  long status_1;
+  long status_2;
+  long status_3;
+  long status_4;
+  long status_5;
+  long status_304;
+  long connections;
+  unsigned long max;
+  apr_table_t *events;
+  apr_table_t *counters;
+  apr_pool_t *pool;
+  long get;
+  long post;
+  long html;
+  long img;
+  long cssjs;
+  long other;
+  time_t start_s;
+  time_t end_s;
+  long firstLine;
+  long lastLine;
+} client_rec_t;
+
+typedef struct stat_rec_st {
+  // id
+  char *id;
+  regex_t preg;
+  struct stat_rec_st *next;
+
+  // counters
+  long line_count;
+  long long i_byte_count;
+  long long byte_count;
+  long long duration_count;
+  long long duration_count_ms;
+  long duration_49;
+  long duration_99;
+  long duration_499;
+  long duration_999;
+  long duration_0;
+  long duration_1;
+  long duration_2;
+  long duration_3;
+  long duration_4;
+  long duration_5;
+  long duration_6;
+  long connections;
+
+  unsigned long long sum;
+  unsigned long long average;
+  long average_count;
+  unsigned long long averAge;
+  long averAge_count;
+  unsigned long max;
+
+  duration_t total;
+
+  long status_1;
+  long status_2;
+  long status_3;
+  long status_4;
+  long status_5;
+
+  long qos_V;
+  long qos_v;
+  long qos_s;
+  long qos_d;
+  long qos_k;
+  long qos_t;
+  long qos_l;
+  long qos_ser;
+  long qos_a;
+  long qos_u;
+
+  apr_table_t *events;
+  apr_pool_t *pool;
+} stat_rec_t;
+
+typedef struct qs_event_st {
+  char       *id;    /**< id, e.g. ip address or client correlator string */
+  time_t     time;   /**< last update, used for expiration */
+  long       count;  /**< event count/updates */
+} qs_event_t;
+
+/* ----------------------------------
+ * global stat counter
+ * ---------------------------------- */
+static stat_rec_t* m_stat_rec;
+static stat_rec_t* m_stat_sub = NULL;
+
+static time_t m_qs_expiration = 60 * 10;
+
+static apr_table_t *m_ip_list[NUM_EVENT_TABLES];   /* IP session store */
+static int m_ip_log_max = 0;                       /* already reached store limit */
+static apr_table_t *m_user_list[NUM_EVENT_TABLES]; /* user session store */
+static int m_usr_log_max = 0;                      /* already reached store limit */
+static int m_hasGC = 0;                            /* sep. gc thread or not */
+static qs_event_t **m_gc_event_list = NULL;        /* list of entries to delete */
+
+/* output file */
+static FILE *m_f = NULL;
+static FILE *m_f2 = NULL;
+static char  m_file_name[MAX_LINE];
+static char  m_file_name2[MAX_LINE];
+static int   m_rotate = 0;
+static int   m_generations = QS_GENERATIONS;
+/* regex to search the time string */
+static regex_t m_trx_access;
+static regex_t m_trx_j;
+static regex_t m_trx_g;
+/* real time mode (default) or offline */
+static int   m_off = 0;
+static int   m_offline = 0;
+static int   m_offline_s = 0;
+static int   m_offline_data = 0;
+static char  m_date_str[MAX_LINE];
+static int   m_mem = 0;
+static int   m_avms = 0;
+static int   m_ct = 0;
+static int   m_customcounter = 0;
+static apr_table_t *m_client_entries = NULL;
+static int   m_max_entries = 0;
+static int   m_offline_count = 0;
+static apr_table_t *m_url_entries = NULL;
+static int   m_offline_url = 0;
+static int   m_offline_url_cropped = 0;
+static int   m_methods = 0;
+/* debug/offline */
+static long  m_lines = 0;
+static int   m_verbose = 0;
+/* enable/disable event counter */
+static int   m_hasEV = 0;
+
+/* events ----------------------------------------------------- */
+/*
+ * sets the expiration for events
+ */
+void qs_setExpiration(time_t sec) {
+  m_qs_expiration = sec;
+}
+
+/*
+ * creates a new event entry
+ */
+static qs_event_t *qs_newEvent(const char *id) {
+  qs_event_t *ev = calloc(sizeof(qs_event_t), 1);
+  ev->id = calloc(strlen(id) + 1, 1);
+  strcpy(ev->id, id);
+  qs_time(&ev->time);
+  ev->count = 1;
+  return ev;
+}
+
+/*
+ * deletes an event
+ */
+void qs_freeEvent(qs_event_t *ev) {
+  free(ev->id);
+  free(ev);
+}
+
+/**
+ * Defines in which of the NUM_EVENT_TABLES session stores
+ * the id shall be added.
+ *
+ * @param str Session ID to store
+ * @return The id of the storage table (0 <= n < NUM_EVENT_TABLES)
+ */
+static int qs_tableSelector(const char *str) {
+  int num = 0;
+  int len = strlen(str);
+  if(len > 3) {
+    if(str[len-1] == '=' ||
+       str[len-1] == '\'' ||
+       str[len-1] == '"') {
+      len--;
+    }
+  }
+  if(str[0] % 2 == 1) {
+    num += 1;
+  }
+  if(len > 1) {
+    if(str[len-1] % 2 == 1) {
+      num += 2;
+    }
+    if(len > 2) {
+      if(str[len-2] % 2 == 1) {
+        num += 4;
+      }
+    }
+  }
+  return num;
+}
+
+/**
+ * Inserts an event entry and deletes expired.
+ *
+ * @param l_qs_event Pointer to the event list.
+ * @param id Identifier, e.g. IP address or user tracking cookie
+ * @param type which counter is used (either 'I' or 'U')
+ * @return event counter (number of updates) for the provided id
+ */
+static long qs_insertEventT(apr_table_t **list0, const char *id, const char *type) {
+  qs_event_t *lp;
+  int select = qs_tableSelector(id);
+  apr_table_t *list = list0[select];
+  lp = (qs_event_t *)apr_table_get(list, id);
+  if(lp) {
+    // exists
+    qs_time(&lp->time);
+    lp->count++;
+    return lp->count;
+  }
+  if(apr_table_elts(list)->nelts >= MAX_EVENT_ENTRIES) {
+    if((type[0] == 'I' && m_ip_log_max == 0) ||
+       (type[0] == 'U' && m_usr_log_max == 0)) {
+      char time_string[1024];
+      time_t tm = time(NULL);
+      struct tm *ptr = localtime(&tm);
+      strftime(time_string, sizeof(time_string), "%a %b %d %H:%M:%S %Y", ptr);
+      fprintf(stderr, "[%s] [notice] qslog: reached event (%s) count limit\n",
+              time_string, type);
+      if(type[0] == 'I') {
+        m_ip_log_max = 1;
+      }
+      if(type[0] == 'U') {
+        m_usr_log_max = 1;
+      }
+    }
+    return 0;
+  }
+  lp = qs_newEvent(id);
+  apr_table_setn(list, lp->id, (char *)lp);
+  return lp->count;
+}
+
+/**
+ * deletes expired events
+ */
+static void gcTable(apr_table_t *list) {
+  int max = 0;
+  int i;
+  apr_table_entry_t *entry;
+  time_t gmt_time;
+  qs_time(&gmt_time);
+
+  if(m_hasGC) {
+    qs_csLock();
+  }
+  // collect expired events...
+  entry = (apr_table_entry_t *) apr_table_elts(list)->elts;
+  for(i = 0; i < apr_table_elts(list)->nelts; i++) {
+    qs_event_t *lp = (qs_event_t *)entry[i].val;    
+    if(lp->time < (gmt_time - m_qs_expiration)) {
+      m_gc_event_list[max] = lp;
+      max++;
+    }
+  }
+  // ...remove...
+  for(i = 0; i < max; i++) {
+    if(m_hasGC) {
+      /* we don't want to hold a lock for a long time
+         => temp release the lock letting the pipe-buffer recover */
+      if(i % 10 == 9) {
+        qs_csUnLock();
+        // wait 1ms
+        apr_sleep(1000);
+        qs_csLock();
+      }
+    }
+    apr_table_unset(list, m_gc_event_list[i]->id);
+  }
+  if(m_hasGC) {
+    qs_csUnLock();
+  }
+
+  // ...and delete them
+  for(i = 0; i < max; i++) {
+    qs_freeEvent(m_gc_event_list[i]);
+  }
+}
+
+/**
+ * Returns the number of events
+ *
+ * @param event table
+ * @return Number of entries
+ */
+static long qs_countEventT(apr_table_t **list) {
+  int count = 0;
+  int t;
+  if(!m_hasGC) {
+    for(t = 0; t < NUM_EVENT_TABLES; t++) {
+      gcTable(list[t]);
+    }
+  }
+  for(t = 0; t < NUM_EVENT_TABLES; t++) {
+    count += apr_table_elts(list[t])->nelts;
+  }
+  return count;
+}
+
+/**
+ * Calls the event table GC
+ */
+static void *gcThread(void *argv) {
+  int t;
+  m_hasGC = 1;
+  while(1) {
+    sleep(QS_GC_INTERVAL);
+    for(t = 0; t < NUM_EVENT_TABLES; t++) {
+      gcTable(m_ip_list[t]);
+      gcTable(m_user_list[t]);
+    }
+  }
+  return NULL;
+}
+
+/* ------------------------------------------------------------ */
+
+/**
+ * Helper to print an error message when terminating
+ * the program due to an unexpected error.
+ */
+static void qerror(const char *fmt,...) {
+  char buf[MAX_LINE];
+  va_list args;
+  time_t t = time(NULL);
+  char *time_string = ctime(&t);
+  va_start(args, fmt);
+  vsprintf(buf, fmt, args);
+  time_string[strlen(time_string) - 1] = '\0';
+  fprintf(stderr, "[%s] [error] qslog: %s\n", time_string, buf);
+  fflush(stderr);
+}
+
+/*
+ * Similar to standard strstr() but we ignore case in this version.
+ * see server/util.c
+ */
+static char *qsstrcasestr(const char *s1, const char *s2) {
+    char *p1, *p2;
+    if (*s2 == '\0') {
+        /* an empty s2 */
+        return((char *)s1);
+    }
+    while(1) {
+        for ( ; (*s1 != '\0') && (tolower(*s1) != tolower(*s2)); s1++);
+        if (*s1 == '\0') {
+            return(NULL);
+        }
+        /* found first character of s2, see if the rest matches */
+        p1 = (char *)s1;
+        p2 = (char *)s2;
+        for (++p1, ++p2; tolower(*p1) == tolower(*p2); ++p1, ++p2) {
+            if (*p1 == '\0') {
+                /* both strings ended together */
+                return((char *)s1);
+            }
+        }
+        if (*p2 == '\0') {
+            /* second string ended, a match */
+            break;
+        }
+        /* didn't find a match here, try starting at next character in s1 */
+        s1++;
+    }
+    return((char *)s1);
+}
+
+/*
+ * skip an element to the next space
+ */
+static char *skipElement(const char* line) {
+  char *p = (char *)line;
+  /* check for quotes (double or single) */
+  char delim = p[0];
+  if(delim == '\'' || delim == '\"') {
+    p++;
+    // read while we found an '" '" which is not escaped
+    while(p[0] != 0 &&
+          !(p[0] == delim && p[-1] != '\\' && (p[1] == '\0' || p[1] == ' '))) {
+      p++;
+    }
+    p++;
+  } else {
+    char *eq = NULL;
+    if(m_off) {
+      // offline mode: check for <name>='<value>' entry
+      eq = strstr(p, "='");
+      if(eq && (eq - p) < 10) {
+        // near hit
+        p = &eq[3];
+        while(p[0] != '\'' && p[0] != 0 && p[-1] != '\\') {
+          p++;
+        }
+        p++;
+      } else {
+        // something else...
+        eq=NULL;
+      }
+    }
+    if(!eq) {
+      while(p[0] != ' ' && p[0] != 0) {
+        p++;
+      }
+    }
+  }
+  while(p[0] == ' ') {
+    p++;
+  }
+  return p;
+}
+
+/**
+ * Cut fp
+ */
+static void qsNoFloat(char *s) {
+  char *pn = strchr(s, '.');
+  if(pn) {
+    pn[0] = '\0';
+  } else {
+    pn = strchr(s, ',');
+    if(pn) {
+      pn[0] = '\0';
+    }
+  }
+}
+
+/**
+ * Strip a number.
+ */
+static void stripNum(char **p) {
+  char *s = *p;
+  int len;
+  while(s && s[0] && (s[0] < '0' || s[0] > '9')) {
+    s++;
+  }
+  len = strlen(s);
+  while(len > 0 && (s[len] < '0' || s[len] > '9')) {
+    s[len] = '\0';
+    len--;
+  }
+  *p = s;
+}
+
+/**
+ * Get and cut an element.
+ *
+ * @param line Line to parse for the next element.
+ * @return Pointer to the next element.
+ */
+static char *cutNext(char **line) {
+  char *c = *line;
+  char *p = skipElement(*line);
+  char delim;
+  *line = p;
+  if(p[0]) {
+    p--; p[0] = '\0';
+  }
+  /* cut leading and tailing " */
+  delim = c[0];
+  if(delim == '\'' || delim == '\"') {
+    int len;
+    c++;
+    len = strlen(c);
+    while(len > 0 && c[strlen(c)-1] == delim) {
+      c[strlen(c)-1] = '\0';
+      len--;
+    }
+  }
+  return c;
+}
+
+/**
+ * Calculates the free system memory. Experimental code.
+ * Tested on Solaris (calling vmstat) and Linux (reading
+ * from /proc/meminfo).
+ *
+ * @param buf Buffer to write result to
+ * @sz Max. length of the buffer
+ */
+static void getFreeMem(char *buf, int sz) {
+  FILE *f = fopen("/proc/meminfo", "r");
+  int mem = 0;
+  buf[0] = '\0';
+  if(f) {
+    char line[MAX_LINE];
+    while(!qs_getLinef(line, sizeof(line), f)) {
+      if(strncmp(line, "MemFree: ", 9) == 0) {
+        char *c = &line[9];
+        char *e;
+        while(c[0] && ((c[0] == ' ') || (c[0] == '\t'))) c++;
+        e = c;
+        while(e[0] && (e[0] != ' ')) e++;
+        e[0] = '\0';
+        mem = mem + atoi(c);
+      }
+      if(strncmp(line, "Cached: ", 8) == 0) {
+        char *c = &line[8];
+        char *e;
+        while(c[0] && ((c[0] == ' ') || (c[0] == '\t'))) c++;
+        e = c;
+        while(e[0] && (e[0] != ' ')) e++;
+        e[0] = '\0';
+        mem = mem + atoi(c);
+      }
+    }
+    fclose(f);
+    snprintf(buf, sz, "%d", mem);
+  } else {
+    // non linux
+//#ifdef _SC_AVPHYS_PAGES
+//    long pageSize = sysconf(_SC_PAGESIZE);
+//    long freePages = sysconf(_SC_AVPHYS_PAGES);
+//    mem = pageSize * freePages / 1024;
+//    snprintf(buf, sz, "%d", mem);
+//#else
+    /* fallback using vmstat (experimental code) */
+    char vmstat[] = "/usr/bin/vmstat";
+    struct stat attr;
+    if(stat(vmstat, &attr) == 0) {
+      char command[1024];
+      char outfile[1024];
+      snprintf(outfile, sizeof(outfile), "/tmp/qslog.%d", getpid());
+      snprintf(command, sizeof(command), "%s 1 2 1>%s", vmstat, outfile);
+      system(command);
+      f = fopen(outfile, "r");
+      if(f) {
+        char line[MAX_LINE];
+        int i = 1;
+        while(!qs_getLinef(line, sizeof(line), f)) {
+          if(i == 4) {
+            // free memory only (ignores cache)
+            int j = 0;
+            char *p = line;
+            while(p && j < 4) {
+              p++;
+              p = strchr(p, ' ');
+              j++;
+            }
+            if(p && (j == 4)) {
+              char *e;
+              p++;
+              e = strchr(p, ' ');
+              if(e) {
+                e[0] = '\0';
+                snprintf(buf, sz, "%s", p);
+              }
+            }
+            break;
+          }
+          i++;
+        }
+        fclose(f);
+        unlink(outfile);
+      }
+    }
+//#endif
+  }
+}
+
+/* value names in csv output */
+#define NRS "r/s"
+#define NBS "b/s"
+#define NBIS "ib/s"
+#define NAV "av"
+#define NAVMS "avms"
+
+/**
+ * Writes the statistic entry stat_rec to the file.
+ *
+ * @param f File to write to
+ * @param timeStr Time string (prefix)
+ * @param stat_rec Data to write
+ * @offline Offline mode (less data, e.g. no load)
+ * @param main Indicates if it is the main log or a sub entry for the detailed log
+ * @param av Load
+ * @param mem Free memory
+ */
+static void printStat2File(FILE *f, char *timeStr, stat_rec_t *stat_rec,
+                           int offline, int main,
+                           double *av, const char *mem) {
+  char bis[256];
+  char esco[256];
+  char ip[256];
+  char usr[256];
+  char avms[256];
+  char custom[256];
+  bis[0] = '\0';
+  esco[0] = '\0';
+  avms[0] = '\0';
+  custom[0] = '\0';
+
+  m_ip_log_max = 0;
+  m_usr_log_max = 0;
+
+  if(stat_rec->i_byte_count != -1) {
+    sprintf(bis, NBIS";%lld;", stat_rec->i_byte_count/LOG_INTERVAL);
+  }
+  if(main && stat_rec->connections != -1) {
+    sprintf(esco, "esco;%ld;", stat_rec->connections);
+  }
+  if(m_avms) {
+    sprintf(avms, NAVMS";%lld;",
+            stat_rec->duration_count_ms/(stat_rec->line_count == 0 ? 1 : stat_rec->line_count));
+    // improve accuracy (rounding errors):
+    stat_rec->duration_count = stat_rec->duration_count_ms / 1000;
+  }
+  if(m_customcounter) {
+    // max len: 18446744073709551615
+    sprintf(custom, "s;%llu;a;%llu;A;%llu;M;%lu;",
+            stat_rec->sum,
+            stat_rec->average / (stat_rec->average_count == 0 ? 1 : stat_rec->average_count),
+            stat_rec->averAge / (stat_rec->averAge_count == 0 ? 1 : stat_rec->averAge_count),
+            stat_rec->max);
+  }
+  if(main) {
+    sprintf(ip, "ip;%ld;", qs_countEventT(m_ip_list));
+    sprintf(usr, "usr;%ld;", qs_countEventT(m_user_list));
+  } else {
+    ip[0] = '\0';
+    usr[0] = '\0';
+  }
+
+  fprintf(f, "%s;"
+          "%s"
+          NRS";%ld;"
+          "req;%ld;"
+          NBS";%lld;"
+          "%s"
+          "%s"
+          "1xx;%ld;"
+          "2xx;%ld;"
+          "3xx;%ld;"
+          "4xx;%ld;"
+          "5xx;%ld;"
+          "%s"
+          NAV";%lld;",
+          timeStr,
+          main ? "" : stat_rec->id,
+          stat_rec->line_count/LOG_INTERVAL,
+          stat_rec->line_count,
+          stat_rec->byte_count/LOG_INTERVAL,
+          bis,
+          esco,
+          stat_rec->status_1,
+          stat_rec->status_2,
+          stat_rec->status_3,
+          stat_rec->status_4,
+          stat_rec->status_5,
+          avms,
+          stat_rec->duration_count/(stat_rec->line_count == 0 ? 1 : stat_rec->line_count));
+  if(m_avms) {
+    fprintf(f,
+            "0-49ms;%ld;"
+            "50-99ms;%ld;"
+            "100-499ms;%ld;"
+            "500-999ms;%ld;",
+            stat_rec->duration_49,
+            stat_rec->duration_99,
+            stat_rec->duration_499,
+            stat_rec->duration_999);
+  }
+  fprintf(f,
+          "<1s;%ld;"
+          "1s;%ld;"
+          "2s;%ld;"
+          "3s;%ld;"
+          "4s;%ld;"
+          "5s;%ld;"
+          ">5s;%ld;"
+          "%s"
+          "%s"
+          ,
+          stat_rec->duration_0,
+          stat_rec->duration_1,
+          stat_rec->duration_2,
+          stat_rec->duration_3,
+          stat_rec->duration_4,
+          stat_rec->duration_5,
+          stat_rec->duration_6,
+          ip,
+          usr
+          );
+  if(m_hasEV) {
+    fprintf(f,
+            "qV;%ld;"
+            "qv;%ld;"
+            "qS;%ld;"
+            "qD;%ld;"
+            "qK;%ld;"
+            "qT;%ld;"
+            "qL;%ld;"
+            "qs;%ld;"
+            "qA;%ld;"
+            "qu;%ld;",
+            stat_rec->qos_V,
+            stat_rec->qos_v,
+            stat_rec->qos_s,
+            stat_rec->qos_d,
+            stat_rec->qos_k,
+            stat_rec->qos_t,
+            stat_rec->qos_l,
+            stat_rec->qos_ser,
+            stat_rec->qos_a,
+            stat_rec->qos_u);
+  }
+  fprintf(f, "%s",
+          custom);
+  stat_rec->line_count = 0;
+  stat_rec->byte_count = 0;
+  if(stat_rec->i_byte_count != -1) {
+    stat_rec->i_byte_count = 0;
+  }
+  if(main && (stat_rec->connections != -1)) {
+    stat_rec->connections = 0;
+  }
+  stat_rec->sum = 0;
+  stat_rec->average = 0;
+  stat_rec->average_count = 0;
+  stat_rec->averAge = 0;
+  stat_rec->averAge_count = 0;
+  stat_rec->max = 0;
+  stat_rec->status_1 = 0;
+  stat_rec->status_2 = 0;
+  stat_rec->status_3 = 0;
+  stat_rec->status_4 = 0;
+  stat_rec->status_5 = 0;
+  stat_rec->duration_count = 0;
+  stat_rec->duration_count_ms = 0;
+  stat_rec->duration_49 = 0;
+  stat_rec->duration_99 = 0;
+  stat_rec->duration_499 = 0;
+  stat_rec->duration_999 = 0;
+  stat_rec->duration_0 = 0;
+  stat_rec->duration_1 = 0;
+  stat_rec->duration_2 = 0;
+  stat_rec->duration_3 = 0;
+  stat_rec->duration_4 = 0;
+  stat_rec->duration_5 = 0;
+  stat_rec->duration_6 = 0;
+  stat_rec->qos_V = 0;
+  stat_rec->qos_v = 0;
+  stat_rec->qos_s = 0;
+  stat_rec->qos_d = 0;
+  stat_rec->qos_k = 0;
+  stat_rec->qos_t = 0;
+  stat_rec->qos_l = 0;
+  stat_rec->qos_ser = 0;
+  stat_rec->qos_a = 0;
+  stat_rec->qos_u = 0;
+  if(main) {
+    if(!offline) {
+      fprintf(f, "sl;%.2f;", av[0]);
+      if(m_mem) {
+        fprintf(f, "m;%s;", mem[0] ? mem : "-");
+      }
+    } else {
+      m_offline_data = 0;
+    }
+  }
+  if(apr_table_elts(stat_rec->events)->nelts > 0) {
+    int i;
+    apr_table_entry_t *entry = (apr_table_entry_t *) apr_table_elts(stat_rec->events)->elts;
+    for(i = 0; i < apr_table_elts(stat_rec->events)->nelts; i++) {
+      const char *eventName = entry[i].key;
+      int *eventVal = (int *)entry[i].val;
+      fprintf(f, "%s;%d;", eventName, *eventVal);
+      (*eventVal) = 0;
+    }
+  }
+  fprintf(f, "\n");
+}
+
+/**
+ * updates the counter by event or status conditions
+ */
+static void qs_updateCounter(apr_pool_t *pool, char *E, char *S, apr_table_t *counters) {
+  time_t ltime;
+  apr_table_entry_t *entry;
+  int i;
+  if(counters == NULL) {
+    return;
+  }
+  if(S == 0 && E == NULL) {
+    return;
+  }
+  qs_time(&ltime);
+  entry = (apr_table_entry_t *) apr_table_elts(counters)->elts;
+  for(i = 0; i < apr_table_elts(counters)->nelts; i++) {
+    counter_rec_t *c = (counter_rec_t *)entry[i].val;
+    if(c->start && ((c->start + c->duration) < ltime)) {
+      // expired
+      c->start = 0;
+      c->count = 0;
+    }
+  }
+  for(i = 0; i < apr_table_elts(counters)->nelts; i++) {
+    counter_rec_t *c = (counter_rec_t *)entry[i].val;
+    if(S) {
+      if((strncmp(c->name, "STATUS", 6) == 0) &&
+         (strstr(c->inc, S) != NULL)) {
+        if(c->start == 0) {
+          c->start = ltime;
+        }
+        c->count++;
+        if(c->count == c->limit) {
+          c->total++;
+        }
+      }
+    }
+    if(E) {
+      if(strstr(c->inc, E)) {
+        if(c->start == 0) {
+          c->start = ltime;
+        }
+        c->count++;
+        if(strstr(c->dec, E)) {
+          if(c->count > c->decVal) {
+            c->count = c->count - c->decVal;
+          } else {
+            c->count = 0;
+          }
+        }
+        if(c->count == c->limit) {
+          c->total++;
+        }
+      }
+    }
+  }
+}
+
+static void qs_updateEvents(apr_pool_t *pool, char *E, apr_table_t *events) {
+  if(!E[0]) {
+    return;
+  }
+  while(E) {
+    char *restore = NULL;
+    char *sep = strchr(E, EVENT_DELIM);
+    int *val;
+    if(sep) {
+      sep[0] = '\0';
+      restore = sep;
+      sep++;
+    }
+    if(isalnum(E[0])) {
+      val = (int *)apr_table_get(events, E);
+      if(val) {
+        (*val)++;
+      } else {
+        // new event
+        char *name = apr_pstrdup(pool, E);
+        val = apr_pcalloc(pool, sizeof(int));
+        (*val) = 1;
+        apr_table_setn(events, name, (char *)val);
+      }
+    }
+    E = sep;
+    if(restore) {
+      // supports multiple parsing of the event string
+      restore[0] = EVENT_DELIM;
+    }
+  }
+}
+
+/**
+ * Reads the counter rule file, each line contains:
+ * <name>:<event>-<n>*<event>/<duration>=<limit>
+ */
+static void qsInitCounter(apr_pool_t *pool, apr_table_t *counters) {
+  const char *envFile = getenv(QSCOUNTERPATH);
+  if(envFile != NULL) {
+    qs_regmatch_t regm[QS_MAX_REG_MATCH];
+    qs_regex_t *pcrestat = apr_palloc(pool, sizeof(qs_regex_t));
+    FILE *file = fopen(envFile, "r"); 
+    if(qs_regcomp(pcrestat, COUNTER_PATTERN, PCRE2_CASELESS) != 0) {
+      fprintf(stderr, "ERROR, could not compile '%s'\n", COUNTER_PATTERN);
+      exit(1);
+    }
+    apr_pool_pre_cleanup_register(pool, pcrestat, qs_pregfree);
+    if(file != NULL) {
+      char line[MAX_LINE];
+      while(!qs_getLinef(line, sizeof(line), file)) {
+        if(qs_regexec_len(pcrestat, line, strlen(line), QS_MAX_REG_MATCH, regm, 0) >= 0) {
+          counter_rec_t *c = apr_pcalloc(pool, sizeof(counter_rec_t));
+          c->name = apr_pstrndup(pool, &line[regm[1].rm_so], regm[1].rm_eo - regm[1].rm_so);
+          c->count = 0;
+          c->total = 0;
+          c->start = 0;
+          c->inc = apr_pstrndup(pool, &line[regm[2].rm_so], regm[2].rm_eo - regm[2].rm_so);
+          c->decVal = atoi(apr_pstrndup(pool, &line[regm[3].rm_so], regm[3].rm_eo - regm[3].rm_so));
+          c->dec = apr_pstrndup(pool, &line[regm[4].rm_so], regm[4].rm_eo - regm[4].rm_so);
+          c->duration = atoi(apr_pstrndup(pool, &line[regm[5].rm_so], regm[5].rm_eo - regm[5].rm_so));
+          c->limit = atoi(apr_pstrndup(pool, &line[regm[6].rm_so], regm[6].rm_eo - regm[6].rm_so));
+          if(m_verbose) {
+            fprintf(stderr, "%s : %s - (%d * %s) / %d = %d\n",
+                    c->name, c->inc, c->decVal, c->dec, c->duration, c->limit);
+          }
+          apr_table_setn(counters, c->name, (char *)c);
+        }
+      }
+      fclose(file);
+    }
+  }
+}
+
+/**
+ * Initializes the event table by the events specified within the
+ * file whose path is defined by the QSEVENTPATH environment
+ * variable.
+ * File contains event names, separated by comma and/or new line.
+ *
+ * @param pool To allocate memory
+ * @param events Table to init
+ */
+static void qsInitEvent(apr_pool_t *pool, apr_table_t *events) {
+  const char *envFile = getenv(QSEVENTPATH);
+  if(envFile != NULL) {
+    FILE *file = fopen(envFile, "r"); 
+    if(file != NULL) {
+      char line[MAX_LINE];
+      while(!qs_getLinef(line, sizeof(line), file)) {
+        char *p = line;
+        char *name;
+        int *val;
+        while(p && p[0]) {
+          /* file contains a list of known events (comma sep.
+             event names on one or multiple lines) */
+          char *n = strchr(p, EVENT_DELIM);
+          if(n) {
+            n[0] = '\0';
+            n++;
+          }
+          name = apr_pstrdup(pool, p);
+          val = apr_pcalloc(pool, sizeof(int));
+          (*val) = 0;
+          apr_table_setn(events, name, (char *)val);
+          p = n;
+        }
+      }
+      fclose(file);
+    }
+  }
+}
+
+/**
+ * Creates and init new status rec
+ *
+ * @param id Identification of the id
+ * @param pattern Pattern to match the log data line
+ * @return
+ */
+static stat_rec_t *createRec(apr_pool_t *pool, const char *id, const char *pattern) {
+  stat_rec_t *rec = calloc(sizeof(stat_rec_t), 1);
+  rec->id = calloc(strlen(id)+2, 1);
+  sprintf(rec->id, "%s;", id);
+  rec->id[strlen(id)+1] = '\0';
+  if(regcomp(&rec->preg, pattern, REG_EXTENDED)) {
+    qerror("failed to compile pattern %s", pattern);
+    exit(1);
+  }
+  rec->next = NULL;
+
+  rec->line_count = 0;
+  rec->i_byte_count = -1;
+  rec->byte_count = 0;
+  rec->duration_count = 0;
+  rec->duration_count_ms = 0;
+  rec->duration_49 = 0;
+  rec->duration_99 = 0;
+  rec->duration_499 = 0;
+  rec->duration_999 = 0;
+  rec->duration_0 = 0;
+  rec->duration_1 = 0;
+  rec->duration_2 = 0;
+  rec->duration_3 = 0;
+  rec->duration_4 = 0;
+  rec->duration_5 = 0;
+  rec->duration_6 = 0;
+  rec->connections = -1;
+
+  rec->sum = 0;
+  rec->average = 0;
+  rec->average_count = 0;
+  rec->averAge = 0;
+  rec->averAge_count = 0;
+  rec->max = 0;
+
+  rec->total.lines = 0;
+  rec->total.ms = 0;
+  {
+    int p = 0;
+    for(p = 0; p < 21; p++) {
+      rec->total.pivot[p] = 0;
+    }
+  }
+  
+  rec->status_1 = 0;
+  rec->status_2 = 0;
+  rec->status_3 = 0;
+  rec->status_4 = 0;
+  rec->status_5 = 0;
+
+  rec->qos_V = 0;
+  rec->qos_v = 0;
+  rec->qos_s = 0;
+  rec->qos_d = 0;
+  rec->qos_k = 0;
+  rec->qos_t = 0;
+  rec->qos_l = 0;
+  rec->qos_ser = 0;
+  rec->qos_a = 0;
+  rec->qos_u = 0;
+
+  rec->events = apr_table_make(pool, 300);
+  rec->pool = pool;
+  qsInitEvent(pool, rec->events);
+  return rec;
+}
+
+/**
+ * Retrieves the best matching record (longest match(
+ * 
+ * @param Parameter to match, e.g. URL
+ * @return Matching entry (NULL if no match)
+ */
+static stat_rec_t *getRec(const char *value) {
+  regmatch_t ma[1];
+  int len = 0;
+  stat_rec_t *r = m_stat_sub;
+  stat_rec_t *rec = NULL;
+  while(r) {
+    if(regexec(&r->preg, value, 1, ma, 0) == 0) {
+      int l = ma[0].rm_eo - ma[0].rm_so + 1;
+      if(l > len) {
+        // longest match
+        len = l;
+        rec = r;
+      }
+    }
+    r = r->next;
+  }
+  return rec;
+}
+
+/**
+ * writes all stat data to the out file
+ * an resets all counters.
+ *
+ * @param timeStr
+ */
+static void printAndResetStat(char *timeStr) {
+  stat_rec_t *r = m_stat_sub;
+  double av[1];
+  char mem[256];
+  if(!m_offline) {
+    getloadavg(av, 1);
+    if(m_mem) {
+      getFreeMem(mem, sizeof(mem));
+    } else {
+      mem[0] = '\0';
+    }
+  } else {
+    mem[0] = '\0';
+  }
+  qs_csLock();
+  printStat2File(m_f, timeStr, m_stat_rec, m_offline, 1, av, mem);
+  while(r) {
+    printStat2File(m_f2, timeStr, r, m_offline, 0, av, mem);
+    r = r->next;
+  }
+  qs_csUnLock();
+  fflush(m_f);
+  if(m_f2) {
+    fflush(m_f2);
+  }
+}
+
+/**
+ * Updates the per url records
+ */
+static void updateUrl(apr_pool_t *pool, char *R, char *S, long tmems) {
+  url_rec_t *url_rec;
+  char *marker;
+  if(R == NULL) {
+    return;
+  }
+  if(!isalpha(R[0])) {
+    fprintf(stdout, "A(%ld)", m_lines);
+    return;
+  }
+  marker = strchr(R, ' ');
+  if(marker == NULL) {
+    fprintf(stdout, "E(%ld)", m_lines);
+    return;
+  }
+  marker[0] = ';';
+  marker = strrchr(R, ' ');
+  if(marker) {
+    marker[0] = '\0';
+  }
+  marker = strchr(R, '?');
+  if(marker) {
+    marker[0] = '\0';
+  }
+  if(m_offline_url_cropped) {
+    char *root = strchr(R, '/');
+    marker = strrchr(R, '/');
+    if(marker && marker != root) {
+      marker[0] = '\0';
+    }
+  }
+  url_rec = (url_rec_t *)apr_table_get(m_url_entries, R);
+  if(url_rec == NULL) {
+    if(apr_table_elts(m_url_entries)->nelts >= MAX_CLIENT_ENTRIES) {
+      // limitation
+      if(!m_max_entries) {
+        fprintf(stderr, "\nreached max url entries (%d)\n", MAX_CLIENT_ENTRIES);
+        m_max_entries = 1;
+      }
+      return;
+    }
+    url_rec = apr_pcalloc(pool, sizeof(url_rec_t));
+    url_rec->request_count = 0;
+    url_rec->status_1 = 0;
+    url_rec->status_2 = 0;
+    url_rec->status_3 = 0;
+    url_rec->status_4 = 0;
+    url_rec->status_5 = 0;
+    url_rec->duration_count_ms = 0;
+    apr_table_setn(m_url_entries, apr_pstrdup(pool, R), (char *)url_rec);
+  }
+  url_rec->request_count++;
+  if(S) {
+    if(S[0] == '1') {
+      url_rec->status_1++;
+    } else if(S[0] == '1') {
+      url_rec->status_1++;
+    } else if(S[0] == '2') {
+      url_rec->status_2++;
+    } else if(S[0] == '3') {
+      url_rec->status_3++;
+    } else if(S[0] == '4') {
+      url_rec->status_4++;
+    } else if(S[0] == '5') {
+      url_rec->status_5++;
+    }
+  }
+  url_rec->duration_count_ms += tmems;
+}
+
+/**
+ * Updates the per client record
+ */
+static void updateClient(apr_pool_t *pool, char *T, char *t, char *D, char *S,
+                         char *BI, char *B, char *R, char *I, char *U, char *Q,
+                         char *E, char *k, char *C, char *M, char *ct, long tme, long tmems,
+                         char *m) {
+  client_rec_t *client_rec;
+  const char *id = I; // ip
+  if(id == NULL) {
+    id = U; // user
+  }
+  if(id == NULL) {
+    return;
+  }
+  client_rec = (client_rec_t *)apr_table_get(m_client_entries, id);
+  if(client_rec == NULL) {
+    char *tid;
+    if(apr_table_elts(m_client_entries)->nelts >= MAX_CLIENT_ENTRIES) {
+      // limitation: speed (table to big) and memory
+      if(!m_max_entries) {
+        fprintf(stderr, "\nreached max client entries (%d)\n", MAX_CLIENT_ENTRIES);
+        m_max_entries = 1;
+      }
+      return;
+    }
+    tid = calloc(strlen(id)+1, 1);
+    client_rec = calloc(sizeof(client_rec_t), 1);
+    strcpy(tid, id);
+    tid[strlen(id)] = '\0';
+    client_rec->request_count = 0;
+    client_rec->error_count = 0;
+    client_rec->byte_count = 0;
+    client_rec->duration = 0;
+    client_rec->duration_count_ms = 0;
+    client_rec->duration_0 = 0;
+    client_rec->duration_1 = 0;
+    client_rec->duration_2 = 0;
+    client_rec->duration_3 = 0;
+    client_rec->duration_4 = 0;
+    client_rec->duration_5 = 0;
+    client_rec->duration_6 = 0;
+    client_rec->status_1 = 0;
+    client_rec->status_2 = 0;
+    client_rec->status_3 = 0;
+    client_rec->status_4 = 0;
+    client_rec->status_5 = 0;
+    client_rec->status_304 = 0;
+    client_rec->connections = 0;
+    client_rec->max = 0;
+    client_rec->events = apr_table_make(pool, 100);
+    client_rec->counters = apr_table_make(pool, 10);
+    client_rec->pool = pool;
+    client_rec->get = 0;
+    client_rec->post = 0;
+    client_rec->html = 0;
+    client_rec->img = 0;
+    client_rec->cssjs = 0;
+    client_rec->other = 0;
+    qs_time(&client_rec->start_s);
+    client_rec->end_s = client_rec->start_s + 1; // +1 prevents div by 0
+    client_rec->firstLine = m_lines;
+    qsInitEvent(pool, client_rec->events);
+    qsInitCounter(pool, client_rec->counters);
+    apr_table_setn(m_client_entries, tid, (char *)client_rec);
+  } else {
+    qs_time(&client_rec->end_s);
+  }
+  client_rec->lastLine = m_lines;
+  client_rec->request_count++;
+  client_rec->duration += tme;
+  client_rec->duration_count_ms += tmems;
+  if(k != NULL) {
+    if(k[0] == '0' && k[1] == '\0') {
+      client_rec->connections++;
+    }
+  }
+  if(tme < 1) {
+    client_rec->duration_0++;
+  } else if(tme == 1) {
+    client_rec->duration_1++;
+  } else if(tme == 2) {
+    client_rec->duration_2++;
+  } else if(tme == 3) {
+    client_rec->duration_3++;
+  } else if(tme == 4) {
+    client_rec->duration_4++;
+  } else if(tme == 5) {
+    client_rec->duration_5++;
+  } else {
+    client_rec->duration_6++;
+  }
+  if(B != NULL) {
+    client_rec->byte_count += atol(B);
+  }
+  if(ct) {
+    if(qsstrcasestr(ct, "html")) {
+      client_rec->html++;
+    } else if(qsstrcasestr(ct, "image")) {
+      client_rec->img++;
+    } else if(qsstrcasestr(ct, "css")) {
+      client_rec->cssjs++;
+    } else if(qsstrcasestr(ct, "javascript")) {
+      client_rec->cssjs++;
+    } else {
+      client_rec->other++;
+    }
+  }
+  if(M && M[0]) {
+    long max = atol(M);
+    if(max > client_rec->max) {
+      client_rec->max = max;
+    }
+  }
+  if(m) {
+    if(strcasecmp(m, "get") == 0) {
+      client_rec->get++;
+    } else if(strcasecmp(m, "post") == 0) {
+      client_rec->post++;
+    }
+  }
+  if(S != NULL) {
+    if(strcmp(S, "200") != 0 && strcmp(S, "304") != 0 && strcmp(S, "302") != 0) {
+      client_rec->error_count++;
+    }
+    if(S[0] == '1') {
+      client_rec->status_1++;
+    } else if(S[0] == '1') {
+      client_rec->status_1++;
+    } else if(S[0] == '2') {
+      client_rec->status_2++;
+    } else if(S[0] == '3') {
+      client_rec->status_3++;
+      if(S[1] == '0' && S[2] == '4') {
+        client_rec->status_304++;
+      }
+    } else if(S[0] == '4') {
+      client_rec->status_4++;
+    } else if(S[0] == '5') {
+      client_rec->status_5++;
+    }
+  }
+  if(E != NULL) {
+    qs_updateEvents(client_rec->pool, E, client_rec->events);
+  }
+  qs_updateCounter(client_rec->pool, E, S, client_rec->counters);
+  return;
+}
+
+/**
+ * Updates standard record
+ */
+static void updateRec(stat_rec_t *rec, char *T, char *t, char *D, char *S,
+                      char *s, char *a, char *A,
+                      char *BI, char *B, char *R, char *I, char *U, char *Q,
+                      char *E, char *k, char *C, char *M, long tme, long tmems) {
+  if(Q != NULL) {
+    if(strchr(Q, 'V') != NULL) {
+      rec->qos_V++;
+    }
+    if(strchr(Q, 'v') != NULL) {
+      rec->qos_v++;
+    }
+    if(strchr(Q, 'S') != NULL) {
+      rec->qos_s++;
+    }
+    if(strchr(Q, 'D') != NULL) {
+      rec->qos_d++;
+    }
+    if(strchr(Q, 'K') != NULL) {
+      rec->qos_k++;
+    }
+    if(strchr(Q, 'T') != NULL) {
+      rec->qos_t++;
+    }
+    if(strchr(Q, 'L') != NULL) {
+      rec->qos_l++;
+    }
+    if(strchr(Q, 's') != NULL) {
+      rec->qos_ser++;
+    }
+    if(strchr(Q, 'A') != NULL) {
+      rec->qos_a++;
+    }
+    if(strchr(Q, 'u') != NULL) {
+      rec->qos_u++;
+    }
+  }
+  if(E != NULL) {
+    qs_updateEvents(rec->pool, E, rec->events);
+  }
+  if(I != NULL) {
+    /* update/store client IP */
+    qs_insertEventT(m_ip_list, I, "I");
+  }
+  if(U != NULL) {
+    /* update/store user */
+    qs_insertEventT(m_user_list, U, "U");
+  }
+  if(B != NULL) {
+    /* transferred bytes */
+    rec->byte_count += atoi(B);
+  }
+  if(BI != NULL) {
+    /* transferred bytes */
+    rec->i_byte_count += atoi(BI);
+  }
+  if(k != NULL) {
+    if(k[0] == '0' && k[1] == '\0') {
+      rec->connections++;
+    }
+  }
+  if(s != NULL) {
+    rec->sum += atol(s);
+  }
+  if(a != NULL && a[0]) {
+    rec->average += atol(a);
+    rec->average_count++;
+  }
+  if(A != NULL && A[0]) {
+    rec->averAge += atol(A);
+    rec->averAge_count++;
+  }
+  if(M && M[0]) {
+    long max = atol(M);
+    if(max > rec->max) {
+      rec->max = max;
+    }
+  }
+
+  if(S != NULL) {
+    if(S[0] == '1') {
+      rec->status_1++;
+    } else if(S[0] == '1') {
+      rec->status_1++;
+    } else if(S[0] == '2') {
+      rec->status_2++;
+    } else if(S[0] == '3') {
+      rec->status_3++;
+    } else if(S[0] == '4') {
+      rec->status_4++;
+    } else if(S[0] == '5') {
+      rec->status_5++;
+    } 
+  }
+  if(T != NULL || t != NULL || D != NULL) {
+    /* response duration */
+    rec->duration_count += tme;
+    rec->duration_count_ms += tmems;
+    if(m_offline_s) {
+      long min = 0;
+      long max = 50;
+      int p;
+      rec->total.lines++;
+      rec->total.ms += tmems;
+      for(p = 0; p < 20; p++) {
+        // 0ms <= time < 50ms etc.
+        if((min <= tmems) && (tmems < max)) {
+          rec->total.pivot[p]++;
+          break;
+        }
+        min = max;
+        max += 50;
+      }
+      if(tmems >= 1000) {
+        // time >= 1000ms (20x50ms)
+        rec->total.pivot[20]++;
+      }
+    }
+    if(m_avms) {
+      if(tmems < 49) {
+        rec->duration_49++;
+      } else if(50 <= tmems && tmems < 99) {
+        rec->duration_99++;
+      } else if(100 <= tmems && tmems < 499) {
+        rec->duration_499++;
+      } else if(500 <= tmems && tmems < 999) {
+        rec->duration_999++;
+      }
+    }
+    if(tme < 1) {
+      rec->duration_0++;
+    } else if(tme == 1) {
+      rec->duration_1++;
+    } else if(tme == 2) {
+      rec->duration_2++;
+    } else if(tme == 3) {
+      rec->duration_3++;
+    } else if(tme == 4) {
+      rec->duration_4++;
+    } else if(tme == 5) {
+      rec->duration_5++;
+    } else {
+      rec->duration_6++;
+    }
+  }
+  /* request counter */
+  rec->line_count++;
+}
+
+/*
+ * updates the counters based on the information
+ * found in the current access log line
+ *
+ * . = any string to skip till the next [space]
+ * T = duration
+ * B = bytes
+ *
+ * Example:
+ * 127.0.0.1 [03/Nov/2006:21:06:41 +0100] "GET /index.html HTTP/1.1" 200 2836 "Wget/1.9.1" 0
+ * .         .                     .      R                                   .            T
+ */
+static void updateStat(apr_pool_t *pool, const char *cstr, char *line) {
+  stat_rec_t *rec = NULL;
+  char *T = NULL; /* time */
+  char *t = NULL; /* time ms */
+  char *D = NULL; /* time us */
+  char *S = NULL; /* status */
+  char *BI = NULL; /* bytes in */
+  char *B = NULL; /* bytes */
+  char *R = NULL; /* request line */
+  char *I = NULL; /* client ip */
+  char *U = NULL; /* user */
+  char *Q = NULL; /* mod_qos event message */
+  char *k = NULL; /* connections (keep alive requests = 0) */
+  char *C = NULL; /* custom patter matching the config file */
+  char *s = NULL; /* sum */
+  char *a = NULL; /* average 1 */
+  char *A = NULL; /* average 2 */
+  char *M = NULL; /* max */
+  char *E = NULL; /* events */
+  char *ct = NULL; /* content type */
+  char *m = NULL; /* method */
+  const char *c = cstr;
+  char *l = line;
+  long tme;
+  long tmems;
+  if(!line[0]) return;
+  if(m_off) {
+    m_lines++;
+  }
+  while(c[0]) {
+    /* process known types */
+    if(c[0] == '.') {
+      if(l != NULL && l[0] != '\0') {
+        l = skipElement(l);
+      }
+    } else if(c[0] == 'T') {
+      if(l != NULL && l[0] != '\0') {
+        T = cutNext(&l);
+      }
+    } else if(c[0] == 't') {
+      if(l != NULL && l[0] != '\0') {
+        t = cutNext(&l);
+      }
+    } else if(c[0] == 'D') {
+      if(l != NULL && l[0] != '\0') {
+        D = cutNext(&l);
+      }
+    } else if(c[0] == 'S') {
+      if(l != NULL && l[0] != '\0') {
+        S = cutNext(&l);
+      }
+    } else if(c[0] == 'B') {
+      if(l != NULL && l[0] != '\0') {
+        B = cutNext(&l);
+      }
+    } else if(c[0] == 'i') {
+      if(l != NULL && l[0] != '\0') {
+        BI = cutNext(&l);
+      }
+    } else if(c[0] == 'k') {
+      if(l != NULL && l[0] != '\0') {
+        k = cutNext(&l);
+      }
+    } else if(c[0] == 'C') {
+      if(l != NULL && l[0] != '\0') {
+        C = cutNext(&l);
+      }
+    } else if(c[0] == 'c') {
+      if(l != NULL && l[0] != '\0') {
+        ct = cutNext(&l);
+      }
+    } else if(c[0] == 'm') {
+      if(l != NULL && l[0] != '\0') {
+        m = cutNext(&l);
+      }
+    } else if(c[0] == 'R') {
+      if(l != NULL && l[0] != '\0') {
+        R = cutNext(&l);
+      }
+    } else if(c[0] == 'I') {
+      if(l != NULL && l[0] != '\0') {
+        I = cutNext(&l);
+      }
+    } else if(c[0] == 'U') {
+      if(l != NULL && l[0] != '\0') {
+        U = cutNext(&l);
+      }
+    } else if(c[0] == 'Q') {
+      if(l != NULL && l[0] != '\0') {
+        Q = cutNext(&l);
+      }
+    } else if(c[0] == 's') {
+      if(l != NULL && l[0] != '\0') {
+        s = cutNext(&l);
+      }
+    } else if(c[0] == 'a') {
+      if(l != NULL && l[0] != '\0') {
+        a = cutNext(&l);
+      }
+    } else if(c[0] == 'A') {
+      if(l != NULL && l[0] != '\0') {
+        A = cutNext(&l);
+      }
+    } else if(c[0] == 'M') {
+      if(l != NULL && l[0] != '\0') {
+        M = cutNext(&l);
+      }
+    } else if(c[0] == 'E') {
+      if(l != NULL && l[0] != '\0') {
+        E = cutNext(&l);
+      }
+    } else if(c[0] == ' ') {
+      /* do nothing */
+    } else {
+      /* undefined/unknown char, skip it */
+      if(l != NULL && l[0] != '\0') {
+        l++;
+      }
+    }
+    c++;
+  }
+  if(C) {
+    rec = getRec(C);
+  }
+
+  qs_csLock();
+  if(B != NULL) {
+    /* transferred bytes */
+    stripNum(&B);
+  }
+  if(BI != NULL) {
+    /* transferred bytes */
+    stripNum(&BI);
+  }
+  if(k != NULL) {
+    stripNum(&k);
+  }
+  if(S != NULL) {
+    stripNum(&S);
+  }
+  if(s != NULL) {
+    stripNum(&s);
+    qsNoFloat(s);
+  }
+  if(a != NULL) {
+    stripNum(&a);
+    qsNoFloat(a);
+  }
+  if(A != NULL) {
+    stripNum(&A);
+    qsNoFloat(A);
+  }
+  if(M != NULL) {
+    stripNum(&M);
+    qsNoFloat(M);
+  }
+
+  /* request duration */
+  tme = 0;
+  tmems = 0;
+  if(T) {
+    stripNum(&T);
+    tme = atol(T);
+  }
+  if(t) {
+    stripNum(&t);
+    tmems= atol(t);
+    tme = tmems / 1000;
+  }
+  if(D) {
+    stripNum(&D);
+    tmems = atol(D);
+    tmems = tmems / 1000;
+    tme = tmems / 1000;
+  }
+
+  if(m_offline_count) {
+    updateClient(pool, T, t, D, S, BI, B, R, I, U, Q, E, k, C, M, ct, tme, tmems, m);
+  } else if(m_offline_url) {
+    if((tmems) == 0 && (tme > 0)) {
+      tmems = 1000 * tme;
+    }
+    updateUrl(pool, R, S, tmems);
+  } else {
+    updateRec(m_stat_rec, T, t, D, S, s, a, A, BI, B, R, I, U, Q, E, k, C, M, tme, tmems);
+    if(rec) {
+      updateRec(rec, T, t, D, S, s, a, A, BI, B, R, I, U, Q, E, k, C, M, tme, tmems);
+    }
+  }
+  qs_csUnLock();
+
+  if(m_verbose && m_off) {
+    printf("[%ld] I=[%s] U=[%s] B=[%s] i=[%s] S=[%s] T=[%ld](%ld) Q=[%s] E=[%s] k=[%s] R=[%s]\n", m_lines,
+           I == NULL ? "(null)" : I,
+           U == NULL ? "(null)" : U,
+           B == NULL ? "(null)" : B,
+           BI == NULL ? "(null)" : BI,
+           S == NULL ? "(null)" : S,
+           tme, tmems,
+           Q == NULL ? "(null)" : Q,
+           E == NULL ? "(null)" : E,
+           k == NULL ? "(null)" : k,
+           R == NULL ? "(null)" : R
+           );
+  }
+  line[0] = '\0';
+}
+
+/*
+ * convert month string to int
+ */
+static int mstr2i(const char *m) {
+  if(strcmp(m, "Jan") == 0) return 1;
+  if(strcmp(m, "Feb") == 0) return 2;
+  if(strcmp(m, "Mar") == 0) return 3;
+  if(strcmp(m, "Apr") == 0) return 4;
+  if(strcmp(m, "May") == 0) return 5;
+  if(strcmp(m, "Jun") == 0) return 6;
+  if(strcmp(m, "Jul") == 0) return 7;
+  if(strcmp(m, "Aug") == 0) return 8;
+  if(strcmp(m, "Sep") == 0) return 9;
+  if(strcmp(m, "Oct") == 0) return 10;
+  if(strcmp(m, "Nov") == 0) return 11;
+  if(strcmp(m, "Dec") == 0) return 12;
+  return 0;
+}
+
+/**
+ * Extracts the time from the log line using the 
+ * Apache access default time format (%t)
+ */
+static time_t getMinutesAccessLog(char *line, regmatch_t ma) {
+  time_t minutes = 0;
+  int buf_len = ma.rm_eo - ma.rm_so + 1;
+  char buf[buf_len];
+  strncpy(buf, &line[ma.rm_so], ma.rm_eo - ma.rm_so);
+  buf[ma.rm_eo - ma.rm_so] = '\0';
+  /* dd/MMM/yyyy:hh:mm:ss */
+  /* cut seconds */
+  buf[strlen(buf)-3] = '\0';
+  /* get minutes */
+  minutes = minutes + (atoi(&buf[strlen(buf)-2]));
+  /* cut minutes */
+  buf[strlen(buf)-3] = '\0';
+  /* get hours */
+  minutes = minutes + (atoi(&buf[strlen(buf)-2]) * 60);
+  
+  /* store date information */
+  {
+    char *year;
+    char *month;
+    char *day;
+    /* cut hours */
+    buf[strlen(buf)-3] = '\0';
+    year = &buf[strlen(buf)-4];
+    /* cut year */
+    buf[strlen(buf)-5] = '\0';
+    month = &buf[strlen(buf)-3];
+    /* cut month */
+    buf[strlen(buf)-4] = '\0';
+    day = buf;
+    snprintf(m_date_str, sizeof(m_date_str), "%s.%02d.%s", day, mstr2i(month), year);
+  }
+  return minutes;
+}
+
+/**
+ * Extracts the time from the log line using the 
+ * the time patterns "yyyy mm dd hh:mm:ss,mmm" or
+ * "yyyy mm dd hh:mm:ss.mmm"
+ */
+static time_t getMinutesJLog(char *line, regmatch_t ma) {
+  time_t minutes = 0;
+  int buf_len = ma.rm_eo - ma.rm_so + 1;
+  char buf[buf_len];
+  strncpy(buf, &line[ma.rm_so], ma.rm_eo - ma.rm_so);
+  buf[ma.rm_eo - ma.rm_so] = '\0';
+  /* yyyy mm dd hh:mm:ss,mmm */
+  /* cut seconds */
+  buf[strlen(buf)-7] = '\0';
+  /* get minutes */
+  minutes = minutes + (atoi(&buf[strlen(buf)-2]));
+  /* cut minutes */
+  buf[strlen(buf)-3] = '\0';
+  /* get hours */
+  minutes = minutes + (atoi(&buf[strlen(buf)-2]) * 60);
+  /* store date information */
+  {
+    char *year;
+    char *month;
+    char *day;
+    /* cut hours */
+    buf[strlen(buf)-3] = '\0';
+    day = &buf[strlen(buf)-2];
+    /* cut day */
+    buf[strlen(buf)-3] = '\0';
+    month = &buf[strlen(buf)-2];
+    /* cut month */
+    buf[strlen(buf)-3] = '\0';
+    year = buf;
+    snprintf(m_date_str, sizeof(m_date_str), "%s.%s.%s", day, month, year);
+  }
+  return minutes;
+}
+
+/*
+ * gets today's time in minutes from the access log line
+ */
+static time_t getMinutes(char *line) {
+  regmatch_t ma[2];
+  if(regexec(&m_trx_access, line, 1, ma, 0) == 0) {
+    return getMinutesAccessLog(line, ma[0]);
+  }
+  if(regexec(&m_trx_j, line, 1, ma, 0) == 0) {
+    return getMinutesJLog(line, ma[0]);
+  }
+  if(regexec(&m_trx_g, line, 2, ma, 0) == 0) {
+    time_t minutes = 0;
+    int len = ma[1].rm_eo - ma[1].rm_so;
+    char buf[len+1];
+    strncpy(buf, &line[ma[1].rm_so], len);
+    buf[len] = '\0';
+    /* hh:mm */
+    buf[2] = '\0';
+    minutes = atoi(buf) * 60;
+    minutes = minutes + atoi(&buf[3]);
+    return minutes;
+  }
+  // unknown format (not relevant for "-pu"/"-puc" but for "-p" mode)
+  if(m_offline_url == 0) {
+    fprintf(stdout, "F(%ld)", m_lines);
+  }
+  return 0;
+}
+
+/*
+ * reads from stdin and calls updateStat()
+ * => used for real time analysis
+ */
+static void readStdin(apr_pool_t *pool, const char *cstr) {
+  char line[MAX_LINE];
+  int line_len;
+  while(fgets(line, sizeof(line), stdin) != NULL) {
+    line_len = strlen(line) - 1;
+    while(line_len > 0) { // cut tailing CR/LF
+      if(line[line_len] >= ' ') {
+        break;
+      }
+      line[line_len] = '\0';
+      line_len--;
+    }
+    updateStat(pool, cstr, line);
+  }
+}
+
+/*
+ * reads from stdin and calls updateStat()
+ * and printAndResetStat()
+ * processes the time information from the
+ * access log lines
+ * => used for offline analysis
+ */
+static void readStdinOffline(apr_pool_t *pool, const char *cstr) {
+  char line[MAX_LINE];
+  char buf[32];
+  time_t unitTime = 0;
+  int line_len;
+  FILE *outdev = stdout;
+  if(m_offline_count || m_offline_url) {
+    outdev = stderr;
+  }
+  while(fgets(line, sizeof(line), stdin) != NULL) {
+    time_t l_time;
+    line_len = strlen(line) - 1;
+    while(line_len > 0) { // cut tailing CR/LF
+      if(line[line_len] >= ' ') {
+        break;
+      }
+      line[line_len] = '\0';
+      line_len--;
+    }
+    l_time = getMinutes(line);
+    m_offline_data = 1;
+    if(unitTime == 0) {
+      unitTime = l_time;
+      qs_setTime(unitTime * 60);
+    }
+    if(unitTime == l_time) {
+      updateStat(pool, cstr, line);
+    } if(l_time < unitTime) {
+      /* leap in time... */
+      updateStat(pool, cstr, line);
+      fprintf(outdev, "X");
+      fflush(outdev);
+      unitTime = 0;
+    } else {
+      if(l_time > unitTime) {
+        if(!m_verbose) {
+          if(m_f != stdout) {
+            fprintf(outdev, ".");
+            fflush(outdev);
+          }
+        }
+      }
+      while(l_time > unitTime) {
+        unitTime++;
+        snprintf(buf, sizeof(buf), "%s %.2ld:%.2ld:00", m_date_str, unitTime/60, unitTime%60);
+        if(m_offline) {
+          printAndResetStat(buf);
+        }
+        qs_setTime(unitTime * 60);;
+      }
+      updateStat(pool, cstr, line);
+    }
+  }
+  if(m_offline_data) {
+    snprintf(buf, sizeof(buf), "%s %.2ld:%.2ld:00", m_date_str, unitTime/60, unitTime%60);
+    if(m_offline) {
+      printAndResetStat(buf);
+    }
+  }
+}
+
+/*
+ * calls printAndResetStat() every minute
+ * => used for real time analysis
+ */
+static void *loggerThread(void *argv) {
+  char buf[1024];
+  while(1) {
+    struct tm *ptr;
+    time_t tm = time(NULL);
+    time_t w = tm / LOG_INTERVAL * LOG_INTERVAL + LOG_INTERVAL;
+    sleep(w - tm);
+
+    tm = time(NULL);
+    ptr = localtime(&tm);
+    strftime(buf, sizeof(buf), "%d.%m.%Y %H:%M:%S", ptr);
+
+    printAndResetStat(buf);
+    if(m_rotate && m_file_name[0]) {
+      strftime(buf, sizeof(buf), "%H:%M", ptr);
+      if(strcmp(buf, "23:59") == 0) {
+        char arch[MAX_LINE];
+        char arch2[MAX_LINE];
+        strftime(buf, sizeof(buf), "%Y%m%d%H%M%S", ptr);
+        snprintf(arch, sizeof(arch), "%s.%s", m_file_name, buf);
+        snprintf(arch2, sizeof(arch), "%s.%s", m_file_name2, buf);
+        if(fclose(m_f) != 0) {
+          qerror("failed to close file '%s': %s", m_file_name, strerror(errno));
+        }
+        if(rename(m_file_name, arch) != 0) {
+          qerror("failed to move file '%s': %s", arch, strerror(errno));
+        }
+        qs_deleteOldFiles(m_file_name, m_generations);
+        m_f = fopen(m_file_name, "a+");
+        if(m_f2) {
+          fclose(m_f2);
+          rename(m_file_name2, arch2);
+          qs_deleteOldFiles(m_file_name2, m_generations);
+          m_f2 = fopen(m_file_name2, "a+");
+        }
+      }
+    }
+  }
+  return NULL;
+}
+
+/**
+ * usage text
+ */
+static void usage(const char *cmd, int man) {
+  if(man) {
+    //.TH [name of program] [section number] [center footer] [left footer] [center header]
+    printf(".TH %s 1 \"%s\" \"mod_qos utilities %s\" \"%s man page\"\n", qs_CMD(cmd), man_date,
+           man_version, cmd);
+  }
+  printf("\n");
+  if(man) {
+    printf(".SH NAME\n");
+  }
+  qs_man_print(man, "%s - collects request statistics from access log data.\n", cmd);
+  printf("\n");
+
+  if(man) {
+    printf(".SH SYNOPSIS\n");
+  }
+  qs_man_print(man, "%s%s -f <format_string> -o <out_file> [-p[c|u[c]] [-v]] [-x [<num>]] [-u <name>] [-m] [-c <path>]\n", man ? "" : "Usage: ", cmd);
+  printf("\n");
+
+  if(man) {
+    printf(".SH DESCRIPTION\n");
+  } else {
+    printf("Summary\n");
+  }
+  qs_man_print(man, "%s is a real time access log analyzer. It collects the data from stdin.\n", cmd);
+  qs_man_print(man, "The output is written to the specified file every minute and includes the\n");
+  qs_man_println(man, "following entries:\n");
+  qs_man_println(man, "  - requests per second ("NRS")\n");
+  qs_man_println(man, "  - number of requests within measured time (req)\n");
+  qs_man_println(man, "  - bytes sent to the client per second ("NBS")\n");
+  qs_man_println(man, "  - bytes received from the client per second ("NBIS")\n");
+  qs_man_println(man, "  - response status codes within the last minute (1xx,2xx,3xx,4xx,5xx)\n");
+  qs_man_println(man, "  - average response duration ("NAV")\n");
+  qs_man_println(man, "  - average response duration in milliseconds ("NAVMS")\n");
+  qs_man_println(man, "  - distribution of response durations in seconds within the last minute\n");
+  qs_man_print(man, "    (<1s,1s,2s,3s,4s,5s,>5s)\n");
+  if(man) printf("\n");
+  qs_man_println(man, "  - distribution of response durations faster than a second within the last minute\n");
+  qs_man_print(man, "    (0-49ms,50-99ms,100-499ms,500-999ms)\n");
+  if(man) printf("\n");
+  qs_man_println(man, "  - number of established (new) connections within the measured time (esco)\n");
+  qs_man_println(man, "  - average system load (sl)\n");
+  qs_man_println(man, "  - free memory (m) (not available for all platforms)\n");
+  qs_man_println(man, "  - number of client ip addresses seen withn the last %d seconds (ip)\n", ACTIVE_TIME);
+  qs_man_println(man, "  - number of different users seen withn the last %d seconds (usr)\n", ACTIVE_TIME);
+  qs_man_println(man, "  - number of events identified by the 'E' format character\n");
+  qs_man_println(man, "  - number of mod_qos events within the last minute (qV=create session,\n");
+  qs_man_print(man, "    qv=VIP IP,qS=session pass, qD=access denied, qK=connection closed, qT=dynamic\n");
+  qs_man_print(man, "    keep-alive, qL=request/response slow down, qs=serialized request, \n");
+  qs_man_print(man, "    qA=connection abort, qU=new user tracking cookie)\n");
+  printf("\n");
+
+  if(man) {
+    printf(".SH OPTIONS\n");
+  } else {
+    printf("Options\n");
+  }
+  if(man) printf(".TP\n");
+  qs_man_print(man, "  -f <format_string>\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Defines the log data format and the positions of data\n");
+  qs_man_print(man, "     elements processed by this utility.\n");
+  qs_man_print(man, "     See to the 'LogFormat' directive of the httpd.conf file\n");
+  qs_man_print(man, "     to see the format definitions of the servers access log data.\n");
+  if(man) printf("\n");
+  qs_man_println(man, "     %s knows the following elements:\n", cmd);
+  qs_man_println(man, "     I defines the client ip address (%%h)\n");
+  qs_man_println(man, "     R defines the request line (%%r)\n");
+  qs_man_println(man, "     S defines HTTP response status code (%%s)\n");
+  qs_man_println(man, "     B defines the transferred bytes (%%b or %%O)\n");
+  qs_man_println(man, "     i defines the received bytes (%%I)\n");
+  qs_man_println(man, "     D defines the request duration in microseconds (%%D)\n");
+  qs_man_println(man, "     t defines the request duration in milliseconds (may be used instead of D)\n");
+  qs_man_println(man, "     T defines the request duration in seconds (may be used instead of D or t) (%%T)\n");
+  qs_man_println(man, "     k defines the number of keepalive requests on the connection (%%k)\n");
+  qs_man_println(man, "     U defines the user tracking id (%%{mod_qos_user_id}e)\n");
+  qs_man_println(man, "     Q defines the mod_qos_ev event message (%%{mod_qos_ev}e)\n");
+  qs_man_println(man, "     C defines the element for the detailed log (-c option), e.g. \"%%U\"\n");
+  qs_man_println(man, "     s arbitrary counter to add up (sum within a minute)\n");
+  qs_man_println(man, "     a arbitrary counter to build an average from (average per request)\n");
+  qs_man_println(man, "     A arbitrary counter to build an average from (average per request)\n");
+  qs_man_println(man, "     M arbitrary counter to measure the maximum value reached (peak)\n");
+  qs_man_println(man, "     E comma separated list of event strings\n");
+  qs_man_println(man, "     c content type (%%{content-type}o), available in -pc mode only\n");
+  qs_man_println(man, "     m request method (GET/POST) (%%m), available in -pc mode only\n");
+  qs_man_println(man, "     . defines an element to ignore (unknown string)\n");
+  if(man) printf("\n.TP\n");
+  qs_man_print(man, "  -o <out_file>\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Specifies the file to store the output to. stdout is used if this option\n");
+  qs_man_print(man, "     is not defined.\n");
+  if(man) printf("\n.TP\n");
+  qs_man_print(man, "  -p\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Used for post processing when reading the log data from a file (cat/pipe).\n");
+  qs_man_print(man, "     %s is started using it's offline mode (extracting the time stamps from\n", cmd);
+  qs_man_print(man, "     the log lines) in order to process existing log files.\n");
+  qs_man_print(man, "     The option \"-pc\" may be used alternatively if you want to gather request\n");
+  qs_man_print(man, "     information per client (identified by IP address (I) or user tracking id (U)\n");
+  qs_man_print(man, "     showing how many request each client has performed within the captured period\n");
+  qs_man_print(man, "     of time). \"-pc\" supports the format characters IURSBTtDkMEcm.\n");
+  qs_man_print(man, "     The option \"-pu\" collects statistics on a per URL level (supports format\n");
+  qs_man_print(man, "     characters RSTtD).\n");
+  qs_man_print(man, "     \"-puc\" is very similar to \"-pu\" but cuts the end (handler) of each URL.\n");
+  if(man) printf("\n.TP\n");
+  qs_man_print(man, "  -v\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Verbose mode.\n");
+  if(man) printf("\n.TP\n");
+  qs_man_print(man, "  -x [<num>]\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Rotates the output file once a day (move). You may specify the number of\n");
+  qs_man_print(man, "     rotated files to keep. Default are %d.\n", QS_GENERATIONS);
+  if(man) printf("\n.TP\n");
+  qs_man_print(man, "  -u <name>\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Becomes another user, e.g. www-data.\n");
+  if(man) printf("\n.TP\n");
+  qs_man_print(man, "  -m\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Calculates free system memory every minute.\n");
+  if(man) printf("\n.TP\n");
+  qs_man_print(man, "  -c <path>\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Enables the collection of log statistics for different request types.\n");
+  qs_man_print(man, "     'path' specifies the necessary rule file. Each rule consists of a rule\n");
+  qs_man_print(man, "     identifier and a regular expression to identify a request seprarated\n");
+  qs_man_print(man, "     by a colon, e.g., 01:^(/a)|(/c). The regular expressions are matched against\n");
+  qs_man_print(man, "     the log data element which has been identified by the 'C' format character.\n");
+
+  printf("\n");
+  if(man) {
+    printf(".SH VARIABLES\n");
+  } else {
+    printf("Variables\n");
+  }
+  qs_man_print(man, "The following environment variables are known to %s:\n", cmd);
+  if(man) printf("\n");
+  if(man) printf(".TP\n");
+  qs_man_print(man, "  "QSEVENTPATH"=<path>\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Defines a file containing a comma or new line separated list\n");
+  qs_man_print(man, "     of known event strings expected within the log filed identified\n");
+  qs_man_print(man, "     by the 'E' format character.\n");
+  if(man) printf("\n.TP\n");
+  qs_man_print(man, "  "QSCOUNTERPATH"=<path>\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Defines a file containing a by new line separated list of rules which\n");
+  qs_man_print(man, "     reflect possible QS_ClientEventLimitCount directive settings (for\n");
+  qs_man_print(man, "     simulation purpose / -pc option). The 'E' format character defines the event\n");
+  qs_man_print(man, "     string in the log to match (literal string) the 'event1' and 'event2' event\n");
+  qs_man_print(man, "     names against.\n");
+  printf("\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Rule syntax: <name>:<event1>-<n>*<event2>/<duration>=<limit>\n");
+  printf("\n");
+  qs_man_println(man, "     'name' defines the name you have given to the rule entry and is logged along with\n");
+  qs_man_print(man, "      with the number of times the 'limit' has been reached within the 'duration'.\n");
+  if(man) printf("\n");
+  qs_man_println(man, "     'event1' defines the variable name (if found in 'E') to increment the counter.\n");
+  qs_man_println(man, "     'event2' defines the variable name (if found in 'E') to decrement the counter (and\n");
+  qs_man_print(man, "      the parameter 'n' defines by how much).\n");
+  if(man) printf("\n");
+  qs_man_println(man, "     'duration' defines the measure interval (in seconds) used for the\n");
+  qs_man_print(man, "      QS_ClientEventLimitCount directive.\n");
+  if(man) printf("\n");
+  qs_man_println(man, "     'limit' defines the threshold (number) defined for the QS_ClientEventLimitCount\n");
+  qs_man_print(man, "      directive.\n");
+  if(man) printf("\n");
+  printf("\n");
+  qs_man_print(man, "     Note: If the 'name' parameter is prefixed by 'STATUS', the rule is applied against\n");
+  qs_man_print(man, "     the HTTP status code 'S' and the 'event1' string shall contain a list of relevant\n");
+  qs_man_print(man, "     status codes separated by an underscore (while 'event2' is ignored).\n");
+  printf("\n");
+  if(man) {
+    printf(".SH EXAMPLE\n");
+    printf("Configuration using pipped logging:\n");
+    printf("\n");
+  } else {
+    printf("Example configuration using pipped logging:\n");
+  }
+  qs_man_println(man, "  CustomLog \"|/usr/bin/%s -f ISBDQ -x -o /var/log/apache/stat.csv\" \"%%h %%>s %%b %%D %%{mod_qos_ev}e\"\n", cmd);
+  printf("\n");
+  if(man) {
+    printf("Post processing:\n");
+    printf("\n");
+  } else {
+    printf("Example for post processing:\n");
+  }
+  qs_man_println(man, "  LogFormat \"%%t %%h \\\"%%r\\\" %%>s %%b \\\"%%{User-Agent}i\\\" %%T\"\n");
+  qs_man_println(man, "  cat access.log | %s -f ..IRSB.T -o stat.csv -p\n", cmd);
+  printf("\n");
+  if(man) {
+    printf(".SH SEE ALSO\n");
+    printf("qsdt(1), qsexec(1), qsfilter2(1), qsgeo(1), qsgrep(1), qshead(1), qslogger(1), qspng(1), qsre(1), qsrespeed(1), qsrotate(1), qssign(1), qstail(1)\n");
+    printf(".SH AUTHOR\n");
+    printf("Pascal Buchbinder, http://mod-qos.sourceforge.net/\n");
+  } else {
+    printf("See http://mod-qos.sourceforge.net/ for further details.\n");
+  }
+  if(man) {
+    exit(0);
+  } else {
+    exit(1);
+  }
+}
+
+/**
+ * Loads the rule files. Each rule (pattern) is prefixed by an id.
+ *
+ * @param confFile Path to the rule file to load
+ * @return
+ */
+static stat_rec_t *loadRule(apr_pool_t *pool, const char *confFile) {
+  char line[MAX_LINE];
+  FILE *file = fopen(confFile, "r"); 
+  stat_rec_t *rec = NULL;
+  stat_rec_t *prev = NULL;
+  stat_rec_t *next = NULL;
+  if(file == NULL) {
+    qerror("could not read file '%s': ", confFile, strerror(errno));
+    exit(1);
+  }
+  while(!qs_getLinef(line, sizeof(line), file)) {
+    char *id = line;
+    char *p = strchr(line, RULE_DELIM);
+    if(p) {
+      p[0] = '\0';
+      p++;
+      if(m_verbose) {
+        printf("load rule %s: %s\n", id, p);
+      }
+      next = createRec(pool, id, p);
+      if(rec == NULL) {
+        // first record
+        rec = next;
+      }
+      if(prev) {
+        // has previous, append it to the list
+        prev->next = next;
+      } else {
+        // sole record, no next
+        rec->next = NULL;
+      }
+      // prev points now to the new record
+      prev = next;
+    }
+  }
+  fclose(file);
+  return rec;
+}
+
+int main(int argc, const char *const argv[]) {
+  const char *config = NULL;
+  const char *file = NULL;
+  const char *confFile = NULL;
+  const char *cmd = strrchr(argv[0], '/');
+  const char *username = NULL;
+  pthread_attr_t *tha = NULL;
+  pthread_t tid;
+  pthread_attr_t *thagc = NULL;
+  pthread_t tidgc;
+  apr_pool_t *pool;
+  int t;
+  apr_app_initialize(&argc, &argv, NULL);
+  apr_pool_create(&pool, NULL);
+  m_stat_rec = createRec(pool, "", "");
+
+  for(t = 0; t < NUM_EVENT_TABLES; t++) {
+    m_ip_list[t] = apr_table_make(pool, 15000);
+    m_user_list[t] = apr_table_make(pool, 15000);
+  }
+  m_gc_event_list = calloc(MAX_EVENT_ENTRIES, sizeof(qs_event_t *));
+
+  qs_csInitLock();
+  qs_setExpiration(ACTIVE_TIME);
+  if(cmd == NULL) {
+    cmd = argv[0];
+  } else {
+    cmd++;
+  }
+  argc--;
+  argv++;
+  while(argc >= 1) {
+    if(strcmp(*argv,"-f") == 0) { /* this is the format string */
+      if (--argc >= 1) {
+        config = *(++argv);
+        if(strchr(config, 'i')) {
+          // enable ib/s
+          m_stat_rec->i_byte_count = 0;
+        }
+        if(strchr(config, 'k')) {
+          // enable esco
+          m_stat_rec->connections = 0;
+        }
+        if(strchr(config, 'c')) {
+          // enable content type
+          m_ct = 1;
+        }
+        if(strchr(config, 'D') || strchr(config, 't')) {
+          // enable average duration in ms
+          m_avms = 1;
+        }
+        if(strchr(config, 'm')) {
+          m_methods = 1;
+        }
+        if(strchr(config, 's') || strchr(config, 'a') || strchr(config, 'A') || strchr(config, 'M')) {
+          // enable custom counter
+          m_customcounter = 1;
+        }
+        if(strchr(config, 'Q')) {
+          m_hasEV = 1;
+        }
+      }
+    } else if(strcmp(*argv,"-o") == 0) { /* this is the out file */
+      if (--argc >= 1) {
+        file = *(++argv);
+      }
+    } else if(strcmp(*argv,"-u") == 0) { /* switch user id */
+      if (--argc >= 1) {
+        username = *(++argv);
+      }
+    } else if(strcmp(*argv,"-c") == 0) { /* custom patterns (e.g. url pattern list, format: <id>':'<pattern>) */
+      if (--argc >= 1) {
+        confFile = *(++argv);
+      }
+    } else if(strcmp(*argv,"-p") == 0) {   /* activate offline analysis */
+      m_offline = 1;
+      qs_set2OfflineMode();
+    } else if(strcmp(*argv,"-ps") == 0) {   /* activate offline analysis (inckl. summary) */
+      m_offline = 1;
+      m_offline_s = 1;
+      qs_set2OfflineMode();
+    } else if(strcmp(*argv,"-pc") == 0) {  /* activate offline counting analysis */
+      m_offline_count = 1;
+      qs_set2OfflineMode();
+    } else if(strcmp(*argv,"-pu") == 0) {  /* activate offline url analysis */
+      m_offline_url = 1;
+      qs_set2OfflineMode();
+    } else if(strcmp(*argv,"-puc") == 0) { /* activate offline url analysis */
+      m_offline_url = 1;
+      m_offline_url_cropped = 1;
+      qs_set2OfflineMode();
+    } else if(strcmp(*argv,"-m") == 0) { /* activate memory usage */
+      m_mem = 1;
+    } else if(strcmp(*argv,"-v") == 0) {
+      m_verbose = 1;
+    } else if(strcmp(*argv,"-x") == 0) { /* activate log rotation */
+      m_rotate = 1;
+      if(argc > 1) {
+        if(*argv[1] >= '0' && *argv[1] <= '9') {
+          argc--;
+          argv++;
+          m_generations = atoi(*argv);
+        }
+      }
+    } else if(strcmp(*argv,"-h") == 0) {
+      usage(cmd, 0);
+    } else if(strcmp(*argv,"--help") == 0) {
+      usage(cmd, 0);
+    } else if(strcmp(*argv,"-?") == 0) {
+      usage(cmd, 0);
+    } else if(strcmp(*argv,"--man") == 0) {
+      usage(cmd, 1);
+    } else {
+      qerror("unknown option '%s'", *argv);
+      exit(1);
+    }
+    argc--;
+    argv++;
+  }
+  m_off = m_offline || m_offline_count || m_offline_url;
+  if(m_off) {
+    if(nice(10) == -1) {
+      fprintf(stderr, "ERROR, failed to change nice value: %s\n", strerror(errno));
+    }
+    /* init time pattern regex, std apache access log "dd/MMM/yyyy:hh:mm:ss" */
+    regcomp(&m_trx_access, 
+            "[0-9]{2}/[a-zA-Z]{3}/[0-9]{4}:[0-9]{2}:[0-9]{2}:[0-9]{2}",
+            REG_EXTENDED);
+    /* other time patterns: "yyyy mm dd hh:mm:ss,mmm" or "yyyy mm dd hh:mm:ss.mmm"
+       resp  "yyyy-mm-dd hh:mm:ss,mmm" or "yyyy-mm-dd hh:mm:ss.mmm" */
+    regcomp(&m_trx_j,
+            "[0-9]{4}[ -]{1}[0-9]{2}[ -]{1}[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2}[,.]{1}[0-9]{3}",
+            REG_EXTENDED);
+    /* fallback to generic " hh:mm:ss " pattern */
+    regcomp(&m_trx_g,
+            " ([0-9]{2}:[0-9]{2}):[0-9]{2} ",
+            REG_EXTENDED);
+  }
+
+  /*
+   * offline url mod
+   */
+  if(m_offline_url) {
+    int i;
+    apr_table_entry_t *entry;
+    m_url_entries = apr_table_make(pool, MAX_CLIENT_ENTRIES + 1);
+    if(config == NULL) usage(cmd, 0);
+    readStdinOffline(pool, config);
+    fprintf(stderr, ".\n");
+
+    m_f = stdout;
+    if(file) {
+      m_f = fopen(file, "a+");
+      if(!m_f) {
+        m_f = stdout;
+      }
+    }
+    entry = (apr_table_entry_t *) apr_table_elts(m_url_entries)->elts;
+    for(i = 0; i < apr_table_elts(m_url_entries)->nelts; i++) {
+      url_rec_t *url_rec = (url_rec_t *)entry[i].val;
+      fprintf(m_f, "req;%ld;"
+              "1xx;%ld;2xx;%ld;3xx;%ld;4xx;%ld;5xx;%ld;"
+              NAVMS";%lld;%s\n",
+              url_rec->request_count,
+              url_rec->status_1,
+              url_rec->status_2,
+              url_rec->status_3,
+              url_rec->status_4,
+              url_rec->status_5,
+              url_rec->request_count ? (url_rec->duration_count_ms / url_rec->request_count) : 0,
+              entry[i].key);
+      
+    }
+    if(file && m_f != stdout) {
+      fclose(m_f);
+    }
+    return 0;
+  }
+
+  /*
+   * offline count mode creates statistics
+   * on a per client basis (e.g. per source
+   * ip or user id using the user tracking
+   * feature of mod_qos)
+   */
+  if(m_offline_count) {
+    int i;
+    apr_table_entry_t *entry;
+    if(config == NULL) usage(cmd, 0);
+    m_client_entries = apr_table_make(pool, MAX_CLIENT_ENTRIES + 1);
+    readStdinOffline(pool, config);
+    fprintf(stderr, ".\n");
+    entry = (apr_table_entry_t *) apr_table_elts(m_client_entries)->elts;
+    m_f = stdout;
+    if(file) {
+      m_f = fopen(file, "a+");
+      if(!m_f) {
+        m_f = stdout;
+      }
+    }
+    for(i = 0; i < apr_table_elts(m_client_entries)->nelts; i++) {
+      client_rec_t *client_rec = (client_rec_t *)entry[i].val;
+      char esco[256];
+      char m[256];
+      /* ci (coverage index): low value indicates that we have seen the client
+                              at the end or beginning of the file (maybe not all
+                              requests due to log rotation) */
+      long coverage = m_lines ? (client_rec->firstLine * 100 / m_lines) : 0;
+      long coverageend = m_lines ? (100 - ((client_rec->lastLine * 100) / m_lines)) : 0;
+      if(coverageend < coverage) {
+        coverage = coverageend;
+      }
+      esco[0] = '\0';
+      if(m_stat_rec->connections != -1) {
+        sprintf(esco, "esco;%ld;", client_rec->connections);
+      }
+      m[0] = '\0';
+      if(m_methods) {
+        sprintf(m, "GET;%ld;POST;%ld;",
+                client_rec->get,
+                client_rec->post);
+      }
+      if(m_avms == 0) {
+        // no ms available
+        client_rec->duration_count_ms = 1000 * client_rec->duration;
+      } else {
+        // improve accuracy (rounding errors):
+        client_rec->duration = client_rec->duration_count_ms / 1000;
+      }
+      fprintf(m_f, "%s;req;%ld;errors;%ld;duration;%ld;bytes;%lld;"
+              "1xx;%ld;2xx;%ld;3xx;%ld;4xx;%ld;5xx;%ld;304;%ld;"
+              "av;%lld;"NAVMS";%lld;<1s;%ld;1s;%ld;2s;%ld;3s;%ld;4s;%ld;5s;%ld;>5s;%ld;"
+              "%s"
+              "%s"
+              "ci;%ld;",
+              entry[i].key,
+              client_rec->request_count,
+              client_rec->error_count,
+              client_rec->end_s - client_rec->start_s,
+              client_rec->byte_count,
+              client_rec->status_1,
+              client_rec->status_2,
+              client_rec->status_3,
+              client_rec->status_4,
+              client_rec->status_5,
+              client_rec->status_304,
+              client_rec->request_count ? (client_rec->duration / client_rec->request_count) : 0,
+              client_rec->request_count ? (client_rec->duration_count_ms / client_rec->request_count) : 0,
+              client_rec->duration_0,
+              client_rec->duration_1,
+              client_rec->duration_2,
+              client_rec->duration_3,
+              client_rec->duration_4,
+              client_rec->duration_5,
+              client_rec->duration_6,
+              esco,
+              m,
+              coverage);
+      if(m_customcounter) {
+        fprintf(m_f, "M;%ld;",
+                client_rec->max);
+      }
+      if(client_rec->counters) {
+        int c;
+        apr_table_entry_t *centry = (apr_table_entry_t *) apr_table_elts(client_rec->counters)->elts;
+        for(c = 0; c < apr_table_elts(client_rec->counters)->nelts; c++) {
+          counter_rec_t *cr = (counter_rec_t *)centry[c].val;
+          fprintf(m_f, "%s;%d;", cr->name, cr->total);
+        }
+      }
+      if(m_ct) {
+        fprintf(m_f, "html;%ld;css/js;%ld;img;%ld;other;%ld;",
+                client_rec->html,
+                client_rec->cssjs,
+                client_rec->img,
+                client_rec->other);
+      }
+      if(apr_table_elts(client_rec->events)->nelts > 0) {
+        int k;
+        apr_table_entry_t *client_entry = (apr_table_entry_t *) apr_table_elts(client_rec->events)->elts;
+        for(k = 0; k < apr_table_elts(client_rec->events)->nelts; k++) {
+          const char *eventName = client_entry[k].key;
+          int *eventVal = (int *)client_entry[k].val;
+          fprintf(m_f, "%s;%d;", eventName, *eventVal);
+          (*eventVal) = 0;
+        }
+      }
+      fprintf(m_f, "\n");
+    }
+    if(file && (m_f != stdout)) {
+      fclose(m_f);
+    }
+    return 0;
+  }
+
+  /* requires at least a format string */
+  if(config == NULL) usage(cmd, 0);
+
+  qs_setuid(username, cmd);
+
+  if(file) {
+    m_f = fopen(file, "a+"); 
+    if(m_f == NULL) {
+      qerror("could not open file for writing '%s': %s", file, strerror(errno));
+      exit(1);
+    }
+    if(strlen(file) > (sizeof(m_file_name) - strlen(".yyyymmddHHMMSS  ") - strlen(LOG_DET))) {
+      qerror("file name too long '%s'", file);
+      exit(1);
+    }
+    strcpy(m_file_name, file);
+  } else {
+    m_file_name[0] = '\0';
+    m_f = stdout;
+  }
+
+  if(confFile) {
+    if(file == NULL) {
+      qerror("option '-c' can only be used in conjunction with option '-o'");
+      exit(1);
+    }
+    snprintf(m_file_name2, sizeof(m_file_name2), "%s"LOG_DET, m_file_name);
+    if(strchr(config, 'C') == NULL) {
+      qerror("you need to add 'C' to the format string when enabling the pattern list (-c)");
+      exit(1);
+    }
+    m_stat_sub = loadRule(pool, confFile);
+    m_f2 = fopen(m_file_name2, "a+");
+    if(m_f == NULL) {
+      qerror("could not open file for writing '%s': %s", m_file_name2, strerror(errno));
+      exit(1);
+    }
+  }
+
+  /*
+   * Offline mode reads an existing log file
+   * adjusting a virtual clock based on
+   * the date string match of the log
+   * enties. */
+  if(m_offline) {
+    fprintf(stderr, "[%s]: offline mode\n", cmd);
+    m_date_str[0] = '\0';
+    readStdinOffline(pool, config);
+    if(!m_verbose) {
+      fprintf(stdout, "\n");
+    }
+    if(m_offline_s) {
+      int p;
+      int min = 0;
+      int max = 50;
+      printf("\n");
+      printf("      requests: %llu\n", m_stat_rec->total.lines);
+      printf("       average: %llums\n", m_stat_rec->total.ms/m_stat_rec->total.lines);
+      for(p = 0; p <20; p++) {
+        printf("%3dms - %4dms: %lld\n", min, max, m_stat_rec->total.pivot[p]);
+        min = max;
+        max += 50;
+      }
+      printf("1000ms+       : %lld\n", m_stat_rec->total.pivot[20]);
+    }
+  } else {
+    /* standard mode reads data from
+     * stdin and uses a separate thread
+     * to write the data every minute. 
+     */
+    pthread_create(&tid, tha, loggerThread, NULL);
+    pthread_create(&tidgc, thagc, gcThread, NULL);
+    readStdin(pool, config);
+  }
+  if(file && (m_f != stdout)) {
+    fclose(m_f);
+  }
+  return 0;
+}
diff --git a/tools/src/qslogger.c b/tools/src/qslogger.c
new file mode 100644
index 0000000..3a8a0d8
--- /dev/null
+++ b/tools/src/qslogger.c
@@ -0,0 +1,423 @@
+/* -*-mode: c; indent-tabs-mode: nil; c-basic-offset: 2; -*-
+ */
+/**
+ * Utilities for the quality of service module mod_qos.
+ *
+ * qslogger.c: Piped logging forwarding log data to syslog
+ *
+ * See http://mod-qos.sourceforge.net/ for further
+ * details.
+ *
+ * Copyright (C) 2023 Pascal Buchbinder
+ *
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+static const char revision[] = "$Id: qslogger.c 2654 2022-05-13 09:12:42Z pbuchbinder $";
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <string.h>
+#include <time.h>
+#include <sys/time.h>
+#include <errno.h>
+#include <regex.h>
+#include <syslog.h>
+
+#include <apr.h>
+#include <apr_lib.h>
+
+#include "qs_util.h"
+
+// [Wed Mar 28 22:40:41 2012] [warn] 
+#define QS_DEFAULTPATTERN "^\\[[0-9a-zA-Z :]+\\] \\[([a-z]+)\\] "
+
+#define QS_MAX_PATTERN_MA 2
+
+static int m_default_severity = LOG_NOTICE;
+
+/**
+ * Similar to standard strstr() but case insensitive and length limitation
+ * (string which is not 0 terminated).
+ *
+ * @param s1 String to search in
+ * @param s2 Pattern to ind
+ * @param len Length of s1
+ * @return pointer to the beginning of the substring s2 within s1, or NULL
+ *         if the substring is not found
+ */
+static const char *qs_strncasestr(const char *s1, const char *s2, int len) {
+  const char *e1 = &s1[len-1];
+  char *p1, *p2;
+  if (*s2 == '\0') {
+    /* an empty s2 */
+    return((char *)s1);
+  }
+  while(1) {
+    for ( ; (*s1 != '\0') && (s1 <= e1) && (apr_tolower(*s1) != apr_tolower(*s2)); s1++);
+    if (*s1 == '\0' || s1 > e1) {
+      return(NULL);
+    }
+    /* found first character of s2, see if the rest matches */
+    p1 = (char *)s1;
+    p2 = (char *)s2;
+    for (++p1, ++p2; (apr_tolower(*p1) == apr_tolower(*p2)) && (p1 <= e1); ++p1, ++p2) {
+      if((p1 > e1) && (*p2 != '\0')) {
+        // reached the end without match
+        return NULL;
+      }
+      if (*p2 == '\0') {
+        /* both strings ended together */
+        return((char *)s1);
+      }
+    }
+    if (*p2 == '\0') {
+      /* second string ended, a match */
+      break;
+    }
+    /* didn't find a match here, try starting at next character in s1 */
+    s1++;
+  }
+  return((char *)s1);
+}
+
+/**
+ * Rerurns the priority value
+ *
+ * @param priorityname Part of the log message to search the priority in
+ * @param len Length of the priority string
+ * @return Priority, LOG_NOTICE (see m_default_severity) if provided name is not recognized.
+ */ 
+static int qsgetprio(const char *priorityname, int len) {
+  int p = m_default_severity;
+  if(!priorityname) {
+    return p;
+  }
+  if(qs_strncasestr(priorityname, "alert", len)) {
+    p = LOG_ALERT;
+  } else if(qs_strncasestr(priorityname, "crit", len)) {
+    p = LOG_CRIT;
+  } else if(qs_strncasestr(priorityname, "debug", len)) {
+    p = LOG_DEBUG;
+  } else if(qs_strncasestr(priorityname, "emerg", len)) {
+    p = LOG_EMERG;
+  } else if(qs_strncasestr(priorityname, "err", len)) {
+    p = LOG_ERR;
+  } else if(qs_strncasestr(priorityname, "info", len)) {
+    p = LOG_INFO;
+  } else if(qs_strncasestr(priorityname, "notice", len)) {
+    p = LOG_NOTICE;
+  } else if(qs_strncasestr(priorityname, "panic", len)) {
+    p = LOG_EMERG;
+  } else if(qs_strncasestr(priorityname, "warn", len)) {
+    p = LOG_WARNING;
+  }
+  return p;
+}
+
+/**
+ * Extracts the severity of the message using the provided
+ * regular expression and determinest the priofity using
+ * qsgetprio().
+ *
+ * @param preg Regular expression to extract the severity
+ * @param line Log fline to extract the severity from
+ * @return Level or LOG_NOTICE (see m_default_severity) if level could not be determined.
+ */
+static int qsgetlevel(regex_t preg, const char *line) {
+  int level = m_default_severity;
+  regmatch_t ma[QS_MAX_PATTERN_MA];
+  if(regexec(&preg, line, QS_MAX_PATTERN_MA, ma, 0) == 0) {
+    int len = ma[1].rm_eo - ma[1].rm_so;
+    level = qsgetprio(&line[ma[1].rm_so], len);
+  }
+  return level;
+}
+
+/* entry within the facility table */
+typedef struct {
+  const char* name;
+  int f;
+} qs_f_t;
+
+/**
+ * Table of known facilities, see sys/syslog.h.
+ */
+static const qs_f_t qs_facilities[] = {
+#ifdef LOG_AUTHPRIV
+    { "authpriv", LOG_AUTHPRIV },
+#endif
+    { "auth", LOG_AUTH },
+    { "cron", LOG_CRON },
+    { "daemon", LOG_DAEMON },
+#ifdef LOG_FTP
+    { "ftp", LOG_FTP },
+#endif
+    { "kern", LOG_KERN },
+    { "lpr", LOG_LPR },
+    { "mail", LOG_MAIL },
+    { "news", LOG_NEWS },
+    { "security", LOG_AUTH },
+    { "syslog", LOG_SYSLOG },
+    { "user", LOG_USER },
+    { "uucp", LOG_UUCP },
+    { "local0", LOG_LOCAL0 },
+    { "local1", LOG_LOCAL1 },
+    { "local2", LOG_LOCAL2 },
+    { "local3", LOG_LOCAL3 },
+    { "local4", LOG_LOCAL4 },
+    { "local5", LOG_LOCAL5 },
+    { "local6", LOG_LOCAL6 },
+    { "local7", LOG_LOCAL7 },
+    { NULL, -1 }
+};
+
+/**
+ * Determines the facility (user input).
+ *
+ * @param facilityname
+ * @return The facility id or LOG_DAEMON if the provided 
+ *         string is unknown.
+ */
+static int qsgetfacility(const char *facilityname) {
+  int f = LOG_DAEMON;
+  const qs_f_t *facilities = qs_facilities;
+  if(!facilityname) {
+    return f;
+  }
+  while(facilities->name) {
+    if(strcasecmp(facilityname, facilities->name) == 0) {
+      f = facilities->f;
+      break;
+    }
+    facilities++;
+  }
+  return f;
+}
+
+/**
+ * Usage message (or man page)
+ *
+ * @param cmd
+ * @param man
+ */
+static void usage(const char *cmd, int man) {
+  if(man) {
+    //.TH [name of program] [section number] [center footer] [left footer] [center header]
+    printf(".TH %s 1 \"%s\" \"mod_qos utilities %s\" \"%s man page\"\n", qs_CMD(cmd), man_date,
+	   man_version, cmd);
+  }
+  printf("\n");
+  if(man) {
+    printf(".SH NAME\n");
+  }
+  qs_man_print(man, "%s - another shell command interface to the system log module (syslog).\n", cmd);
+  printf("\n");
+  if(man) {
+    printf(".SH SYNOPSIS\n");
+  }
+  qs_man_print(man, "%s%s [-t <tag>] [-f <facility>] [-l <level>] [-x <prefix>] [-r <expression>] [-d <level>] [-u <name>] [-p]\n",  man ? "" : "Usage: ", cmd);
+  printf("\n");
+  if(man) {
+    printf(".SH DESCRIPTION\n");
+  } else {
+    printf("Summary\n");
+  }
+  qs_man_print(man, "Use this utility to forward log messages to the systems syslog\n");
+  qs_man_print(man, "facility, e.g., to forward the messages to a remote host.\n");
+  qs_man_print(man, "It reads data from stdin.\n");
+  printf("\n");
+  if(man) {
+    printf(".SH OPTIONS\n");
+  } else {
+    printf("Options\n");
+  }
+  if(man) printf("\n.TP\n");
+  qs_man_print(man, "  -t <tag>\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Defines the tag name which shall be used to define the origin\n");
+  qs_man_print(man, "     of the messages, e.g. 'httpd'.\n");
+  if(man) printf("\n.TP\n");
+  qs_man_print(man, "  -f <facility>\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Defines the syslog facility. Default is 'daemon'.\n");
+  if(man) printf("\n.TP\n");
+  qs_man_print(man, "  -u <name>\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Becomes another user, e.g. www-data.\n");
+  if(man) printf("\n.TP\n");
+  qs_man_print(man, "  -l <level>\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Defines the minimal severity a message must have in order to\n");
+  qs_man_print(man, "     be forwarded. Default is 'DEBUG' (forwarding everything).\n");
+  if(man) printf("\n.TP\n");
+  qs_man_print(man, "  -x <prefix>\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Allows you to add a prefix (literal string) to every message.\n");
+  if(man) printf("\n.TP\n");
+  qs_man_print(man, "  -r <expression>\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Specifies a regular expression which shall be used to\n");
+  qs_man_print(man, "     determine the severity (syslog level) for each log line.\n");
+  qs_man_print(man, "     The default pattern '"QS_DEFAULTPATTERN"' can\n");
+  qs_man_print(man, "     be used for Apache error log messages but you may configure\n");
+  qs_man_print(man, "     your own pattern matching other log formats. Use brackets\n");
+  qs_man_print(man, "     to define the pattern enclosing the severity string.\n");
+  qs_man_print(man, "     Default level (if severity can't be determined) is defined by the\n");
+  qs_man_print(man, "     option '-d' (see below).\n");
+  if(man) printf("\n.TP\n");
+  qs_man_print(man, "  -d <level>\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     The default severity if the specified pattern (-r) does not\n");
+  qs_man_print(man, "     match and the message's severity can't be determined. Default\n");
+  qs_man_print(man, "     is 'NOTICE'.\n");
+  if(man) printf("\n.TP\n");
+  qs_man_print(man, "  -p\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Writes data also to stdout (for piped logging).\n");
+  printf("\n");
+  if(man) {
+    printf(".SH EXAMPLE\n");
+  } else {
+    printf("Example:\n");
+  }
+  qs_man_println(man, "  ErrorLog \"|/usr/bin/%s -t apache -f local7\"\n", cmd);
+  printf("\n");
+  if(man) {
+    printf(".SH SEE ALSO\n");
+    printf("qsdt(1), qsexec(1), qsfilter2(1), qsgeo(1), qsgrep(1), qshead(1), qslog(1), qspng(1), qsre(1), qsrespeed(1), qsrotate(1), qssign(1), qstail(1)\n");
+    printf(".SH AUTHOR\n");
+    printf("Pascal Buchbinder, http://mod-qos.sourceforge.net/\n");
+  } else {
+    printf("See http://mod-qos.sourceforge.net/ for further details.\n");
+  }
+  if(man) {
+    exit(0);
+  } else {
+    exit(1);
+  }
+}
+
+int main(int argc, const char * const argv[]) {
+  int line_len;
+  char *line = calloc(1, MAX_LINE_BUFFER+1);
+  const char *cmd = strrchr(argv[0], '/');
+  int pass = 0;
+  const char *tag = NULL;
+  int facility = LOG_DAEMON;
+  int severity = LOG_DEBUG;
+  int level = LOG_INFO;
+  const char *regexpattern = QS_DEFAULTPATTERN;
+  const char *username = NULL;
+  const char *prefix = NULL;
+  regex_t preg;
+  if(cmd == NULL) {
+    cmd = (char *)argv[0];
+  } else {
+    cmd++;
+  }
+
+  argc--;
+  argv++;
+  while(argc >= 1) {
+    if(strcmp(*argv, "-p") == 0) {
+      pass = 1;
+    } else if(strcmp(*argv, "-f") == 0) {
+      if (--argc >= 1) {
+	const char *facilityname = *(++argv);
+        facility = qsgetfacility(facilityname);
+      }
+    } else if(strcmp(*argv, "-l") == 0) {
+      if (--argc >= 1) {
+	const char *severityname = *(++argv);
+        severity = qsgetprio(severityname, strlen(severityname));
+      }
+    } else if(strcmp(*argv, "-x") == 0) {
+      if (--argc >= 1) {
+	prefix = *(++argv);
+      }
+    } else if(strcmp(*argv,"-u") == 0) { /* switch user id */
+      if (--argc >= 1) {
+        username = *(++argv);
+      }
+    } else if(strcmp(*argv, "-d") == 0) {
+      if (--argc >= 1) {
+	const char *severityname = *(++argv);
+        m_default_severity = qsgetprio(severityname, strlen(severityname));
+      }
+    } else if(strcmp(*argv, "-t") == 0) {
+      if (--argc >= 1) {
+	tag = *(++argv);
+      }
+    } else if(strcmp(*argv, "-r") == 0) {
+      if (--argc >= 1) {
+	regexpattern = *(++argv);
+      }
+    } else if(strcmp(*argv,"-h") == 0) {
+      usage(cmd, 0);
+    } else if(strcmp(*argv,"--help") == 0) {
+      usage(cmd, 0);
+    } else if(strcmp(*argv,"-?") == 0) {
+      usage(cmd, 0);
+    } else if(strcmp(*argv,"--man") == 0) {
+      usage(cmd, 1);
+    } else {
+      usage(cmd, 0);
+    }
+    argc--;
+    argv++;
+  }
+
+  if(regcomp(&preg, regexpattern, REG_EXTENDED)) {
+    fprintf(stderr, "[%s] failed to compile pattern %s", cmd, regexpattern);
+    exit(1);
+  }
+
+  qs_setuid(username, cmd);
+
+  openlog(tag ? tag : getlogin(), 0, facility);
+
+  // start reading from stdin
+  while(fgets(line, MAX_LINE_BUFFER, stdin) != NULL) {
+    line_len = strlen(line) - 1;
+    while(line_len > 0) { // cut tailing CR/LF
+      if(line[line_len] >= ' ') {
+	break;
+      }
+      line[line_len] = '\0';
+      line_len--;
+    }
+    // severity is determined using the regular expression provided by the user
+    level = qsgetlevel(preg, line);
+    if(level <= severity) {
+      // send message
+      if(prefix) {
+        syslog(level, "%s%s", prefix, line);
+      } else {
+        syslog(level, "%s", line);
+      }
+    }
+    if(pass) {
+      printf("%s\n", line);
+      fflush(stdout);
+    }
+  }
+  free(line);
+  closelog();
+  return 0;
+}
diff --git a/tools/src/qspng.c b/tools/src/qspng.c
new file mode 100644
index 0000000..6d11f21
--- /dev/null
+++ b/tools/src/qspng.c
@@ -0,0 +1,784 @@
+/**
+ * Utilities for the quality of service module mod_qos.
+ *
+ * qspng.c: Tool to draw graph from qslog output.
+ *
+ * See http://mod-qos.sourceforge.net/ for further
+ * details.
+ *
+ * Copyright (C) 2023 Pascal Buchbinder
+ *
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+static const char revision[] = "$Id: qspng.c 2654 2022-05-13 09:12:42Z pbuchbinder $";
+
+#include <stdio.h>
+#include <string.h>
+
+#include <stdlib.h>
+#include <unistd.h>
+#include <png.h>
+
+//#include <config.h>
+
+#include "qs_util.h"
+#include "char.h"
+
+#define HUGE_STRING_LEN 1024
+#define X_SAMPLE_RATE 3
+/* width */
+#define X_COUNTS 60 * 24 / X_SAMPLE_RATE // 24 hours, every 3th sample
+/* height */
+#define Y_COUNTS 100
+/* border */
+#define XY_BORDER 20
+
+typedef struct {
+  const char* param;
+  const char* name;
+  int   r;
+  int   g;
+  int   b;
+} qs_png_elt_t;
+
+/* known graph types */
+static const qs_png_elt_t qs_png_elts[] = {
+  { "r/s", "requests per second",  20, 30, 130, },
+  { "req", "requests per minute",  20, 30, 130, },
+  { "b/s", "bytes per second (out)",     30, 45, 130 },
+  { "ib/s", "bytes per second (in)",     30, 45, 125 },
+  { "esco", "established connections per minute", 40, 95, 140 },
+  { "av", "average response time", 40, 95, 140 },
+  { "avms", "average response time in milliseconds", 45, 95, 135 },
+  { "0-49ms", "requests duration 0-49ms", 45, 100, 180 },
+  { "50-99ms", "requests duration 50-99ms", 45, 100, 180 },
+  { "100-499ms", "requests duration 100-499ms", 45, 100, 180 },
+  { "500-999ms", "requests duration 500-999ms", 45, 100, 180 },
+  { "<1s", "requests faster than 1 second", 35, 95, 180 },
+  { "1s", "requests faster or equal than 1 second", 35, 90, 180 },
+  { "2s", "requests with 2 seconds response time", 30, 85, 180 },
+  { "3s", "requests with 3 seconds response time", 25, 90, 180 },
+  { "4s", "requests with 4 seconds response time", 25, 95, 180 },
+  { "5s", "requests with 5 seconds response time", 15, 90, 180 },
+  { ">5s","requests slower than 5 seconds", 35, 90, 185 },
+  { "1xx","requests with HTTP status 1xx",   50, 70, 150 },
+  { "2xx","requests with HTTP status 2xx",   50, 70, 150 },
+  { "3xx","requests with HTTP status 3xx",   50, 70, 150 },
+  { "4xx","requests with HTTP status 4xx",   50, 70, 150 },
+  { "5xx","requests with HTTP status 5xx",   50, 70, 150 },
+  { "ip", "IP addresses",          55, 60, 150 },
+  { "usr","active users",          55, 66, 150 },
+  { "qV", "created VIP sessions",  55, 50, 155 },
+  { "qS", "session pass",          55, 75, 160 },
+  { "qD", "access denied",         55, 70, 170 },
+  { "qK", "connection closed",      55, 60, 145 },
+  { "qT", "dynamic keep-alive",    55, 55, 153 },
+  { "qL", "slow down",             55, 65, 140 },
+  { "qA", "connection aborts",     55, 50, 175 },
+  { "qs", "serialization",         55, 40, 175 },
+  { "qu", "start user tracking",   55, 45, 175 },
+  { "sl", "system load",           25, 60, 175 },
+  { "m", "free memory", 35, 90, 185 },
+  { NULL, NULL, 0, 0, 0 }
+};
+
+typedef struct qs_png_conf_st {
+  char *path;
+  char *param;
+} qs_png_conf;
+
+
+/************************************************************************
+ * Functions
+ ***********************************************************************/
+
+/**
+ * Read the stat_log data line by line
+ *
+ * @param s IN buffer to store line to
+ * @param n IN buffer size
+ * @param f IN file descriptor
+ *
+ * @return 1 on EOF, else 0
+ */
+static int qs_png_getline(char *s, int n, FILE *f) {
+  register int i = 0;
+  while (1) {
+    s[i] = (char) fgetc(f);
+    if (s[i] == CR) {
+      s[i] = fgetc(f);
+    }
+    if ((s[i] == 0x4) || (s[i] == LF) || (i == (n - 1))) {
+      s[i] = '\0';
+      return (feof(f) ? 1 : 0);
+    }
+    ++i;
+  }
+}
+
+/* png io callback (should write to buff/bio/bucket when using in apache) */
+void lp_write_data(png_structp png_ptr, png_bytep data, png_size_t length) {
+  FILE *f = png_get_io_ptr(png_ptr);
+  fwrite(data, length, 1, f);
+}
+
+/* png io callback (not used) */
+void lp_flush_data(png_structp png_ptr) {
+  png_get_io_ptr(png_ptr);
+  fprintf(stderr, "flush\n");
+}
+
+/**
+ * Writes a single char to the graph
+ *
+ * @param x IN x position
+ * @param y IN y position
+ * @param row_pointers IN start pointer (0/0)
+ * @param n IN char to write
+ */
+static void qs_png_write_char(int x, int y, png_bytep *row_pointers, char n) {
+  int ix, iy;
+  int *f = &s_X[0][0];
+  switch(n) {
+  case 'a': f = &s_a[0][0]; break;
+  case 'b': f = &s_b[0][0]; break;
+  case 'c': f = &s_c[0][0]; break;
+  case 'd': f = &s_d[0][0]; break;
+  case 'e': f = &s_e[0][0]; break;
+  case 'f': f = &s_f[0][0]; break;
+  case 'g': f = &s_g[0][0]; break;
+  case 'h': f = &s_h[0][0]; break;
+  case 'i': f = &s_i[0][0]; break;
+  case 'j': f = &s_j[0][0]; break;
+  case 'k': f = &s_k[0][0]; break;
+  case 'l': f = &s_l[0][0]; break;
+  case 'm': f = &s_m[0][0]; break;
+  case 'n': f = &s_n[0][0]; break;
+  case 'o': f = &s_o[0][0]; break;
+  case 'p': f = &s_p[0][0]; break;
+  case 'q': f = &s_q[0][0]; break;
+  case 'r': f = &s_r[0][0]; break;
+  case 's': f = &s_s[0][0]; break;
+  case 't': f = &s_t[0][0]; break;
+  case 'u': f = &s_u[0][0]; break;
+  case 'v': f = &s_v[0][0]; break;
+  case 'w': f = &s_w[0][0]; break;
+  case 'x': f = &s_x[0][0]; break;
+  case 'y': f = &s_y[0][0]; break;
+  case 'z': f = &s_z[0][0]; break;
+  case ' ': f = &s_SP[0][0]; break;
+  case '_': f = &s_US[0][0]; break;
+  case '(': f = &s_BRO[0][0]; break;
+  case ')': f = &s_BRC[0][0]; break;
+  case '<': f = &s_LT[0][0]; break;
+  case '>': f = &s_GT[0][0]; break;
+  case '-': f = &s_MI[0][0]; break;
+  case '/': f = &s_SL[0][0]; break;
+  case ';': f = &s_SC[0][0]; break;
+  case ',': f = &s_CM[0][0]; break;
+  case ':': f = &s_CO[0][0]; break;
+  case '.': f = &s_DT[0][0]; break;
+  case '\'': f = &s_SQ[0][0]; break;
+  case 'A': f = &s_a[0][0]; break;
+  case 'B': f = &s_b[0][0]; break;
+  case 'C': f = &s_c[0][0]; break;
+  case 'D': f = &s_d[0][0]; break;
+  case 'E': f = &s_e[0][0]; break;
+  case 'F': f = &s_f[0][0]; break;
+  case 'G': f = &s_g[0][0]; break;
+  case 'H': f = &s_h[0][0]; break;
+  case 'I': f = &s_i[0][0]; break;
+  case 'J': f = &s_j[0][0]; break;
+  case 'K': f = &s_k[0][0]; break;
+  case 'L': f = &s_l[0][0]; break;
+  case 'M': f = &s_M[0][0]; break;
+  case 'N': f = &s_n[0][0]; break;
+  case 'O': f = &s_o[0][0]; break;
+  case 'P': f = &s_p[0][0]; break;
+  case 'Q': f = &s_q[0][0]; break;
+  case 'R': f = &s_r[0][0]; break;
+  case 'S': f = &s_s[0][0]; break;
+  case 'T': f = &s_t[0][0]; break;
+  case 'U': f = &s_u[0][0]; break;
+  case 'V': f = &s_v[0][0]; break;
+  case 'W': f = &s_w[0][0]; break;
+  case 'X': f = &s_x[0][0]; break;
+  case 'Y': f = &s_y[0][0]; break;
+  case 'Z': f = &s_z[0][0]; break;
+  case '0': f = &s_0[0][0]; break;
+  case '1': f = &s_1[0][0]; break;
+  case '2': f = &s_2[0][0]; break;
+  case '3': f = &s_3[0][0]; break;
+  case '4': f = &s_4[0][0]; break;
+  case '5': f = &s_5[0][0]; break;
+  case '6': f = &s_6[0][0]; break;
+  case '7': f = &s_7[0][0]; break;
+  case '8': f = &s_8[0][0]; break;
+  case '9': f = &s_9[0][0]; break;
+  }
+  /* print the char matrix */
+  for(iy = 0; iy < S_H_MAX; iy++) {
+    png_byte* row = row_pointers[y+iy];
+    for(ix = 0; ix < S_W_MAX; ix++) {
+      png_byte* ptr = &(row[(x+ix)*4]);
+      if(f[iy*S_W_MAX + ix] == 1) {
+        /* foreground */
+	ptr[0] = 0;
+	ptr[1] = 0;
+	ptr[2] = 0;
+      } else {
+        /* background */
+	ptr[0] = 250;
+	ptr[1] = 250;
+	ptr[2] = 255;
+      }
+    }
+  }
+}
+
+/**
+ * Writes a single digit 0..9.
+ * You should normally use either qs_png_write_int() or qs_png_write_int().
+ *
+ * @param x IN x position
+ * @param y IN y position
+ * @param row_pointers IN start pointer (0/0)
+ * @param n IN number to write
+ */
+static void qs_png_write_digit(int x, int y, png_bytep *row_pointers, int n) {
+  char f = 'X';
+  if(n == 0) f = '0';
+  if(n == 1) f = '1';
+  if(n == 2) f = '2';
+  if(n == 3) f = '3';
+  if(n == 4) f = '4';
+  if(n == 5) f = '5';
+  if(n == 6) f = '6';
+  if(n == 7) f = '7';
+  if(n == 8) f = '8';
+  if(n == 9) f = '9';
+  qs_png_write_char(x, y, row_pointers, f);
+}
+
+/**
+ * Writes a string to the graph.
+ *
+ * @param x IN x position
+ * @param y IN y position
+ * @param row_pointers IN start pointer (0/0)
+ * @param n IN string to write
+ */
+static void qs_png_write_string(int x, int y, png_bytep *row_pointers, const char *n) {
+  int i = 0;
+  int offset = 0;
+  while(n[i] != '\0') {
+    qs_png_write_char(x+offset, y, row_pointers, n[i]);
+    i++;
+    offset = offset + S_W_MAX;
+  }
+}
+
+/**
+ * Writes a number (int) to the graph (1:1).
+ *
+ * @param x IN x position
+ * @param y IN y position
+ * @param row_pointers IN start pointer (0/0)
+ * @param n IN number to write
+ */
+static void qs_png_write_int(int x, int y, png_bytep *row_pointers, int n) {
+  char num_str[HUGE_STRING_LEN];
+  snprintf(num_str, sizeof(num_str), "%d", n);
+  qs_png_write_string(x, y, row_pointers, num_str);
+}
+
+/**
+ * Writes a number (long) to the graph using k,M for big numbers.
+ *
+ * @param x IN x position
+ * @param y IN y position
+ * @param row_pointers IN start pointer (0/0)
+ * @param n IN string to write
+ */
+static void qs_png_write_long(int x, int y, png_bytep *row_pointers, long n) {
+  char num_str[HUGE_STRING_LEN];
+  snprintf(num_str, sizeof(num_str), "%ld", n);
+  if(n >= 1000) {
+    snprintf(num_str, sizeof(num_str), "%ldk", n/1000);
+  }
+  if(n >= 1000000) {
+    snprintf(num_str, sizeof(num_str), "%ldM", n/1000000);
+  }
+  qs_png_write_string(x, y, row_pointers, num_str);
+}
+
+/**
+ * Labels the graph (min,max,title).
+ *
+ * @param width IN size (x axis) of the graph
+ * @param height IN size (y axis) of the graph
+ * @param border IN border size around the graph
+ * @param row_pointers IN start pointer (0/0)
+ * @param max IN max y value
+ * @param name IN title
+ */
+static void qs_png_label(int width, int height, int border,
+                           png_bytep *row_pointers, long max,
+                           const char *name) {
+  /* MAX */
+  int i;
+  int step = height/5;
+  int c = 5;
+  for(i = 0; i < height; i = i + step) {
+    qs_png_write_long(1, border - (S_W_MAX/2) + i, row_pointers, max/5*c);
+    c--;
+  }
+
+  /* MIN */
+  qs_png_write_int(1, height + border - (S_W_MAX/2), row_pointers, 0);
+
+  /* title */
+  {
+    char buf[HUGE_STRING_LEN];
+    snprintf(buf, sizeof(buf), "%s", name);
+    qs_png_write_string(XY_BORDER, XY_BORDER/2-S_H_MAX/2, row_pointers, buf);
+  }
+                        
+}
+
+static void lp_init(int width, int height, int border, png_bytep **start) {
+  png_bytep *row_pointers;
+  int b_width = width + (2 * border);
+  int b_height = height + (2 * border);
+  int x, y;
+  
+  /* alloc memory */
+  row_pointers = (png_bytep*) malloc(sizeof(png_bytep) * b_height);
+  for(y=0; y<b_height; y++) {
+    row_pointers[y] = (png_byte*) malloc(b_width * 4);
+  }
+  
+  /* background */
+  for(y=0; y<b_height; y++) {
+    png_byte* row = row_pointers[y];
+    for(x=0; x<b_width; x++) {
+      png_byte* ptr = &(row[x*4]);
+      ptr[0] = 250;
+      ptr[1] = 250;
+      ptr[2] = 255;
+      ptr[3] = 250;
+    }
+  }
+  for(y=border; y<b_height-border; y++) {
+    png_byte* row = row_pointers[y];
+    for(x=border; x<b_width-border; x++) {
+      png_byte* ptr = &(row[x*4]);
+      ptr[0] = 245;
+      ptr[1] = 245;
+      ptr[2] = 250;
+    }
+  }
+  *start = row_pointers;
+}
+
+/**
+ * "Main" png function:
+ * - reads the data from the file
+ * - draws the curve
+ * - labels the x axis
+ *
+ * @param width IN size (x axis) of the graph
+ * @param height IN size (y axis) of the graph
+ * @param border IN border size around the graph
+ * @param row_pointers IN start pointer (0/0)
+ * @param stat_log IN file descriptor to the input file
+ * @param name IN title
+ * @param c_r IN color red (0..255)
+ * @param c_g IN color green (0..255)
+ * @param c_b IN color blue (0..255)
+ */
+static long qs_png_draw(int width, int height, int border,
+                          png_bytep *row_pointers, FILE *stat_log, const char *name,
+                          int c_r, int c_g, int c_b) {
+  int x, y;
+  long req[width];         // values
+  long max_req[width];     // values
+  int hours[width];        // time marks on x axis
+  long tmp[X_SAMPLE_RATE]; // used to build average over multiple samples
+  int sample = 1;          // sample rate counter (1 to X_SAMPLE_RATE) 
+
+  int i = 0;
+  char line[HUGE_STRING_LEN];
+
+  long peak = 0;           // max of all values
+  double scale = 1;        // scaling factor (height x scale = unit)
+
+  int hour = -1;           // detect "new" hour
+  char date_str[32] = "";  // string storing the first day (if fist value is at 00h)
+
+  long ret;
+  for(x=0; x<width; x++) hours[x] = 0;
+  /* reads the file and resample measure points to width of the graph */
+  while(!qs_png_getline(line, sizeof(line), stat_log) && i < width) {
+    char *p = strstr(line, name);
+    req[i] = 0;
+    max_req[i] = 0;
+    if(p && ((p - line) > 8)) {
+      char *e;
+      p=p+strlen(name);
+      e = strchr(p,';');
+      if(e) e[0] = '\0';
+      e = strchr(p, '.'); /** sl uses fp value */
+      if(e) e[0] = '\0';
+      tmp[sample-1] = atol(p);
+    } else {
+      tmp[sample-1] = 0;
+    }
+    /* hour (stat_log time format: %d.%m.%Y %H:%M:%S (19 char)) */
+    p = strchr(line, ';');
+    if(p && (p-line == 19 )) {
+      p = p - 6;
+      p[0] = '\0';
+      p = p - 2;
+      hours[i] = atoi(p);
+    }
+    /* use the defined sample rate */
+    if(sample == X_SAMPLE_RATE) {
+      int j;
+      int max_value = 0;
+      for(j = 0; j < X_SAMPLE_RATE; j++) {
+	req[i] = req[i] + tmp[j];
+        if(max_value < tmp[j]) {
+          max_value = tmp[j];
+        }
+      }
+      max_req[i] = max_value;
+      if(max_req[i] > peak) peak = max_req[i];
+      /* build average */
+      req[i] = req[i] / X_SAMPLE_RATE;
+      sample = 1;
+      i++;
+      /* and store the current date (%d.%m.%Y (10 char)) if the
+         first value is at 00h */
+      if(hours[i] == 0 && i == 1) {
+        p = strchr(line, ' ');
+        if(p && (p-line == 10)) {
+          p[0] = '\0';
+          strcpy(date_str, line);
+        }
+      }
+    } else {
+      sample++;
+    }
+  }
+  /* calculate y axis scaling (1:1 are height pixels) */
+  if(peak < 10) {
+    scale = 0.1;
+  } else {
+    while((peak / scale) > height) {
+      if(scale < 8) {
+        scale = scale * 2;
+      } else {
+        if(scale == 8) {
+          scale = 10;
+        } else {
+          scale = scale * 10;
+        }
+      }
+    }
+  }
+
+  /* draw the curve */
+  for(x=0; x<i; x++) {
+    /* max */
+    for(y=0; y<(max_req[x]/scale); y++) {
+      png_byte* row = row_pointers[height-y-1+border];
+      png_byte* ptr = &(row[x*4+(4*border)]);
+      ptr[0] = c_r + 75;
+      ptr[1] = c_g + 75;
+      ptr[2] = c_b + 75;
+    }
+    /* average */
+    for(y=0; y<(req[x]/scale); y++) {
+      png_byte* row = row_pointers[height-y-1+border];
+      png_byte* ptr = &(row[x*4+(4*border)]);
+      ptr[0] = c_r;
+      ptr[1] = c_g;
+      ptr[2] = c_b;
+    }
+    /* label the x axis */
+    if(hour != hours[x]) {
+      hour = hours[x];
+      for(y=0; y<(height); y=y+3) {
+	png_byte* row = row_pointers[y+border];
+	png_byte* ptr = &(row[x*4+(4*border)]);
+	ptr[0] = 50;
+	ptr[1] = 50;
+	ptr[2] = 50;
+      }
+      if(hour%2 == 0) {
+        qs_png_write_digit(x-S_W_MAX+border, height + border + 1, row_pointers, hour/10);
+	qs_png_write_digit(x-S_W_MAX+border+S_W_MAX, height + border + 1, row_pointers, hour%10);
+	qs_png_write_char(x-S_W_MAX+border+2*S_W_MAX, height + border + 1, row_pointers, 'h');
+      }
+    }
+  }
+
+  /* print date */
+  qs_png_write_string(border, height+border+2+S_H_MAX, row_pointers, date_str);
+
+  /* horizontal lines every 1/4 height */
+  for(y=(height/5); y<height; y=y+height/5) {
+    png_byte* row = row_pointers[y+border];
+    for(x=0; x<i; x=x+3) {
+      png_byte* ptr = &(row[x*4+(4*border)]);
+      ptr[0] = 50;
+      ptr[1] = 50;
+      ptr[2] = 50;
+    }
+  }
+
+  ret = scale * height;
+  return ret;
+}
+
+
+static void usage(char *cmd, int man) {
+  if(man) {
+    //.TH [name of program] [section number] [center footer] [left footer] [center header]
+    printf(".TH %s 1 \"%s\" \"mod_qos utilities %s\" \"%s man page\"\n", qs_CMD(cmd), man_date,
+	   man_version, cmd);
+  }
+  printf("\n");
+  if(man) {
+    printf(".SH NAME\n");
+    qs_man_print(man, "%s - an utility to draw a png graph from qslog(1) output data.\n", cmd);
+  } else {
+    qs_man_print(man, "Utility to draw a png graph from qslog output data.\n");
+  }
+  printf("\n");
+  if(man) {
+    printf(".SH SYNOPSIS\n");
+  }
+  qs_man_print(man, "%s%s -i <stat_log_file> -p <parameter> -o <out_file> [-10]\n", man ? "" : "Usage: ", cmd);
+  printf("\n");
+  if(man) {
+    printf(".SH DESCRIPTION\n");
+  } else {
+    printf("Summary\n");
+  }
+  qs_man_print(man, "%s is a tool to generate png (portable network graphics)\n", cmd);
+  qs_man_print(man, "raster images files from semicolon separated data generated by the\n");
+  qs_man_print(man, "qslog utility. It reads up to the first 1440 entries (24 hours)\n");
+  qs_man_print(man, "and prints a graph using the values defined by the 'parameter' \n");
+  qs_man_print(man, "name.\n");
+  printf("\n");
+  if(man) {
+    printf(".SH OPTIONS\n");
+  } else {
+    printf("Options\n");
+  }
+  if(man) printf(".TP\n");
+  qs_man_print(man, "  -i <stats_log_file>\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Input file to read data from.\n");
+  if(man) printf("\n.TP\n");
+  qs_man_print(man, "  -p <parameter>\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Parameter name, e.g. r/s or usr.\n");
+  if(man) printf("\n.TP\n");
+  qs_man_print(man, "  -o <out_file>\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Output file name, e.g. stat.png.\n");
+  printf("\n");
+  if(man) {
+    printf(".SH SEE ALSO\n");
+    printf("qsdt(1), qsexec(1), qsfilter2(1), qsgeo(1), qsgrep(1), qshead(1), qslogger(1), qslog(1), qsre(1), qsrespeed(1), qsrotate(1), qssign(1), qstail(1)\n");
+    printf(".SH AUTHOR\n");
+    printf("Pascal Buchbinder, http://mod-qos.sourceforge.net/\n");
+  } else {
+    printf("\n");
+    printf("See http://mod-qos.sourceforge.net/ for further details.\n");
+  }
+  if(man) {
+    exit(0);
+  } else {
+    exit(1);
+  }
+}
+
+int main(int argc, char **argv) {
+  int y;
+  int width, height, b_width, b_height;
+  png_byte color_type;
+  png_byte bit_depth;
+
+  int scale;
+
+  png_structp png_ptr;
+  png_infop info_ptr;
+
+  png_bytep *row_pointers;
+
+  char *infile = NULL;
+  FILE *f;
+  FILE *stat_log;
+
+  char *cmd = strrchr(argv[0], '/');
+  const char *param = NULL;
+  const char *name = "";
+  char *out = NULL;
+  int c_r = 20;
+  int c_g = 50;
+  int c_b = 175;
+  const qs_png_elt_t* elt;
+
+  if(cmd == NULL) {
+    cmd = argv[0];
+  } else {
+    cmd++;
+  }
+
+  while(argc >= 1) {
+    if(strcmp(*argv,"-i") == 0) {
+      if (--argc >= 1) {
+	infile = *(++argv);
+      } 
+    } else if(strcmp(*argv,"-p") == 0) {
+      if (--argc >= 1) {
+	param = *(++argv);
+	name = param;
+      }
+    } else if(strcmp(*argv,"-o") == 0) {
+      if (--argc >= 1) {
+	out = *(++argv);
+      }
+    } else if(strcmp(*argv,"-h") == 0) {
+      usage(cmd, 0);
+    } else if(strcmp(*argv,"--help") == 0) {
+      usage(cmd, 0);
+    } else if(strcmp(*argv,"-?") == 0) {
+      usage(cmd, 0);
+    } else if(strcmp(*argv,"--man") == 0) {
+      usage(cmd, 1);
+    }
+    argc--;
+    argv++;
+  }
+  
+  
+  if(infile == NULL || param == NULL || out == NULL) usage(cmd, 0);
+  for(elt = qs_png_elts; elt->param != NULL ; ++elt) {
+    if(strcmp(elt->param, param) == 0) {
+      name = elt->name;
+      c_r = elt->r;
+      c_g = elt->g;
+      c_b = elt->b;
+    }
+  }
+
+  stat_log = fopen(infile, "r"); 
+  if(stat_log == NULL) {
+    fprintf(stderr,"[%s]: ERROR, could not open input file <%s>\n", cmd, infile);
+    exit(1);
+  }
+
+  f = fopen(out, "wb"); 
+  if(f == NULL) {
+    fprintf(stderr,"[%s]: ERROR, could not open output file <%s>\n", cmd, out);
+    exit(1);
+  }
+
+  png_ptr = png_create_write_struct(PNG_LIBPNG_VER_STRING, NULL, NULL, NULL);
+  if(png_ptr == NULL) {
+    fprintf(stderr,"[%s]: ERROR, could not create png struct\n", cmd);
+    exit(1);
+  }
+  info_ptr = png_create_info_struct(png_ptr);
+  if(info_ptr == NULL) {
+    fprintf(stderr,"[%s]: ERROR, could not create png information struct\n", cmd);
+    exit(1);
+  }
+  if(setjmp(png_jmpbuf(png_ptr))) {
+    fprintf(stderr,"[%s]: ERROR, could not init png struct\n", cmd);
+    exit(1);
+  }
+  png_set_write_fn(png_ptr, f, lp_write_data, NULL);
+
+  /* write header */
+  if(setjmp(png_jmpbuf(png_ptr))) {
+    fprintf(stderr,"[%s]: ERROR, could not write png header\n", cmd);
+    exit(1);
+  }
+
+  color_type = PNG_COLOR_TYPE_RGB_ALPHA;
+  bit_depth = 8;
+  width = X_COUNTS;
+  height = Y_COUNTS;
+  b_width = width + (2 * XY_BORDER);
+  b_height = height + (2 * XY_BORDER);
+
+  png_set_IHDR(png_ptr, info_ptr,
+	       b_width, b_height,
+	       bit_depth,
+	       color_type,
+	       PNG_INTERLACE_NONE,
+	       PNG_COMPRESSION_TYPE_BASE, PNG_FILTER_TYPE_BASE);
+  png_write_info(png_ptr, info_ptr);
+
+  /* write bytes */
+  if(setjmp(png_jmpbuf(png_ptr))) {
+    fprintf(stderr,"[%s]: ERROR, could not write png data\n", cmd);
+    exit(1);
+  }
+
+  /* alloc and background */
+  lp_init(width, height, XY_BORDER, &row_pointers);
+
+  /* paint */
+  {
+    char buf[HUGE_STRING_LEN];
+    snprintf(buf, sizeof(buf), ";%s;", param);
+    scale = qs_png_draw(width, height, XY_BORDER, row_pointers,
+			stat_log, buf, c_r, c_g, c_b);
+  }
+
+  /* min/max/title label */
+  qs_png_label(width, height, XY_BORDER, row_pointers, scale,
+	       name);
+
+
+  /* done, write image */
+  png_write_image(png_ptr, row_pointers);
+  /* end write */
+  if(setjmp(png_jmpbuf(png_ptr))) {
+    fprintf(stderr,"[%s]: ERROR, could not write png data\n", cmd);
+    exit(1);
+  }
+  png_write_end(png_ptr, NULL);
+
+  /* cleanup heap allocation */
+  for(y=0; y<height; y++) {
+    free(row_pointers[y]);
+  }
+  free(row_pointers);
+
+  fclose(f);
+  fclose(stat_log);
+  return 0;
+}
diff --git a/tools/src/qsre.c b/tools/src/qsre.c
new file mode 100644
index 0000000..53187b8
--- /dev/null
+++ b/tools/src/qsre.c
@@ -0,0 +1,226 @@
+/**
+ * qsre.c: pcre expression match test tool
+ *
+ * See http://mod-qos.sourceforge.net/ for further
+ * details.
+ *
+ * Copyright (C) 2023 Pascal Buchbinder
+ *
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+static const char revision[] = "$Id: qsre.c 2654 2022-05-13 09:12:42Z pbuchbinder $";
+
+/* system */
+#include <stdio.h>
+#include <string.h>
+
+#include <stdlib.h>
+#include <unistd.h>
+#include <time.h>
+
+/* apr */
+#include <apr.h>
+#include <apr_strings.h>
+#include <apr_time.h>
+#include <apr_general.h>
+#include <apr_lib.h>
+#include <apr_portable.h>
+#include <apr_support.h>
+
+#define PCRE2_CODE_UNIT_WIDTH 8
+#include <pcre2.h>
+
+#include "qs_util.h"
+
+#define QS_OVECCOUNT 100
+
+
+static void usage(const char *cmd, int man) {
+  if(man) {
+    //.TH [name of program] [section number] [center footer] [left footer] [center header]
+    printf(".TH %s 1 \"%s\" \"mod_qos utilities %s\" \"%s man page\"\n", qs_CMD(cmd), man_date,
+	   man_version, cmd);
+  }
+  printf("\n");
+
+  if(man) {
+    printf(".SH NAME\n");
+  }
+  qs_man_print(man, "%s matches a regular expression against test strings.\n", cmd);
+  printf("\n");
+
+  if(man) {
+    printf(".SH SYNOPSIS\n");
+  }
+  qs_man_print(man, "%s%s <string>|<path> <pcre>|<path>\n", man ? "" : "Usage: ", cmd);
+  printf("\n");
+
+  if(man) {
+    printf(".SH DESCRIPTION\n");
+  } else {
+    printf("Summary\n");
+  }
+  qs_man_print(man, "Regular expression test tool.\n");
+  qs_man_print(man, "The provided regular expression (pcre, caseless matching, \".\" matches anything\n");
+  qs_man_print(man, "incl. newline) is appplied against the provided test strings to verify if the\n");
+  qs_man_print(man, "pattern matches.\n");
+  printf("\n");
+
+  if(man) {
+    printf(".SH OPTIONS\n");
+  } else {
+    printf("Options\n");
+  }
+  if(man) printf(".TP\n");
+  qs_man_print(man, "  <string>|<path>\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     The first argument either defines a single test string of a path to\n");
+  qs_man_print(man, "     a file containing either multiple test strings or a test pattern with\n");
+  qs_man_print(man, "     newline characters (text).\n");
+  if(man) printf("\n.TP\n");
+  qs_man_print(man, "  <pcre>|<path>\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     The second argument either defines a regular expression or a path to\n");
+  qs_man_print(man, "     a file containing the expression.\n");
+  printf("\n");
+
+  if(man) {
+    printf(".SH SEE ALSO\n");
+    printf("qsdt(1), qsexec(1), qsfilter2(1), qsgeo(1), qsgrep(1), qshead(1), qslog(1), qslogger(1), qspng(1), qsrespeed(1), qsrotate(1), qssign(1), qstail(1)\n");
+    printf(".SH AUTHOR\n");
+    printf("Pascal Buchbinder, http://mod-qos.sourceforge.net/\n");
+  } else {
+    printf("See http://mod-qos.sourceforge.net/ for further details.\n");
+  }
+  if(man) {
+    exit(0);
+  } else {
+    exit(1);
+  }
+}
+
+static int rmatch(const char *line, qs_regex_t *preg) {
+  qs_regmatch_t regm[QS_MAX_REG_MATCH];
+  int rc_c = -1;
+  do {
+    int rc = qs_regexec_len(preg, line, strlen(line), QS_MAX_REG_MATCH, regm, 0);
+    if(rc >= 0) {
+      int ix;
+      rc_c = 0;
+      printf("[%.*s]", regm[0].rm_eo - regm[0].rm_so, &line[regm[0].rm_so]);
+      for(ix = 1; ix < rc; ix++) {
+	printf(" $%d=%.*s", ix, regm[ix].rm_eo - regm[ix].rm_so, &line[regm[ix].rm_so]);
+      }
+      line = &line[regm[0].rm_eo];
+    } else {
+      line = NULL;
+    }
+  } while(line && line[0]);
+  return rc_c;
+}
+
+int main(int argc, const char *const argv[]) {
+  const char *errptr = NULL;
+  int erroffset;
+  qs_regex_t *preg;
+  int rc_c = -1;
+  const char *line;
+  const char *in;
+  const char *pattern;
+  FILE *file;
+  apr_pool_t *pool;
+  char *raw = "";
+  int linenr = 0;
+
+  const char *cmd = strrchr(argv[0], '/');
+
+  apr_app_initialize(&argc, &argv, NULL);
+  apr_pool_create(&pool, NULL);
+  if(cmd == NULL) {
+    cmd = (char *)argv[0];
+  } else {
+    cmd++;
+  }
+
+  argc--;
+  argv++;
+  if(argc != 2) {
+    if(argc  == 1 && strcmp(argv[0], "--man") == 0) {
+      usage(cmd, 1);
+    } else {
+      usage(cmd, 0);
+    }
+  }
+  in = argv[0];
+  pattern = argv[1];
+
+  file = fopen(pattern, "r");
+  if(file) {
+    char readline[MAX_LINE];
+    if(fgets(readline, MAX_LINE-1, file) != NULL) {
+      int len = strlen(readline);
+      while(len > 0 && readline[len] < 32) {
+	readline[len] = '\0';
+	len--;
+      }
+      pattern = apr_pstrdup(pool, readline);
+    }
+    fclose(file);
+  }
+  printf("expression: %s\n", pattern);
+
+  preg = apr_palloc(pool, sizeof(qs_regex_t));
+  if(qs_regcomp(preg, pattern, PCRE2_DOTALL|PCRE2_CASELESS) != 0) {
+    fprintf(stderr, "ERROR, rule <%s> could not compile regular expression\n", pattern);
+    exit(1);
+  }
+  apr_pool_pre_cleanup_register(pool, preg, qs_pregfree);
+
+  file = fopen(in, "r");
+  if(file) {
+    char readline[MAX_LINE];
+    while(fgets(readline, MAX_LINE-1, file) != NULL) {
+      int len = strlen(readline);
+      linenr++;
+      printf("line %.3d: ", linenr);
+      raw = apr_pstrcat(pool, raw, readline, NULL);
+      while(len > 0 && readline[len] < 32) {
+	readline[len] = '\0';
+	len--;
+      }
+      if(readline[0] >= 32 && strlen(readline) > 0) {
+	line = readline;
+	rc_c = rmatch(line, preg);
+      }
+      printf("\n");
+    }
+    fclose(file);
+    printf("entire content match:\n");
+    rc_c = rmatch(raw, preg);
+    printf("\n");
+  } else {
+    line = in;
+    rc_c = rmatch(line, preg);
+    printf("\n");
+  }
+  if(rc_c < 0) {
+    printf("no match\n");
+    return 2;
+  }
+  return 0;
+}
diff --git a/tools/src/qsrespeed.c b/tools/src/qsrespeed.c
new file mode 100644
index 0000000..dc949f1
--- /dev/null
+++ b/tools/src/qsrespeed.c
@@ -0,0 +1,308 @@
+/**
+ * Utility for the quality of service module mod_qos.
+ *
+ * qsrespeed.c: tool to measure the processing time
+ *              of regular expressions
+ *
+ * See http://mod-qos.sourceforge.net/ for further
+ * details.
+ *
+ * Copyright (C) 2023 Pascal Buchbinder
+ *
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+static const char revision[] = "$Revision: 2654 $";
+
+/* system */
+#include <stdio.h>
+#include <string.h>
+
+#include <stdlib.h>
+#include <unistd.h>
+#include <time.h>
+
+/* apr */
+#include <apr.h>
+#include <apr_strings.h>
+#include <apr_time.h>
+#include <apr_general.h>
+#include <apr_lib.h>
+#include <apr_portable.h>
+#include <apr_support.h>
+
+#define PCRE2_CODE_UNIT_WIDTH 8
+#include <pcre2.h>
+
+#include "qs_util.h"
+
+#define LOOPS 100
+
+typedef struct {
+  qs_regex_t *preg;
+} rule_t;
+
+static void usage(const char *cmd, int man) {
+    if(man) {
+    //.TH [name of program] [section number] [center footer] [left footer] [center header]
+    printf(".TH %s 1 \"%s\" \"mod_qos utilities %s\" \"%s man page\"\n", qs_CMD(cmd), man_date,
+	   man_version, cmd);
+  }
+  printf("\n");
+
+  if(man) {
+    printf(".SH NAME\n");
+  }
+  qs_man_print(man, "Tool to compare / estimate the processing time for (Perl-compatible)\n");
+  qs_man_print(man, "regular expressions (PCRE).\n");
+  printf("\n");
+  
+  if(man) {
+    printf(".SH SYNOPSIS\n");
+  }
+  qs_man_print(man, "%s%s <path>\n", man ? "" : "Usage: ", cmd);
+  printf("\n");
+
+  if(man) {
+    printf(".SH DESCRIPTION\n");
+  } else {
+    printf("Summary\n");
+  }
+  qs_man_print(man, "%s loads regular expressions from the provided file and matches\n", cmd);
+  qs_man_print(man, "them against a built-in set of strings measuring the time needed to\n");
+  qs_man_print(man, "process them. It's a benchmark too to judge the expressions you have\n");
+  qs_man_print(man, "defined regarding the potential CPU consumption.\n");
+  printf("\n");
+
+  if(man) {
+    printf(".SH OPTIONS\n");
+  } else {
+    printf("Options\n");
+  }
+  if(man) printf(".TP\n");
+  qs_man_print(man, "  <path>\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Defines the input file to process. The file consists a list of\n");
+  qs_man_print(man, "     (separated by a newline character) regular expressions to test\n");
+  printf("\n");
+
+  if(man) {
+    printf(".SH SEE ALSO\n");
+    printf("qsdt(1), qsexec(1), qsfilter2(1), qsgeo(1), qsgrep(1), qshead(1), qslog(1), qslogger(1), qspng(1), qsre(1), qsrotate(1), qssign(1), qstail(1)\n");
+    printf(".SH AUTHOR\n");
+    printf("Pascal Buchbinder, http://mod-qos.sourceforge.net/\n");
+  } else {
+    printf("See http://mod-qos.sourceforge.net/ for further details.\n");
+  }
+  if(man) {
+    exit(0);
+  } else {
+    exit(1);
+  }
+}
+
+typedef struct {
+  const char* string;
+  int len;
+} qs_r_t;
+
+int main(int argc, const char *const argv[]) {
+  int datalen=0;
+  qs_r_t data[] = {
+    { "Emma", 0 },
+    { "Buchschacher", 0 },
+    { "Schafhauserstrasse 60, 8000 Zürich", 0 },
+    { "128128127136178267893209807237276365235", 0 },
+    { "/get/application/data/index/list/all/data", 0 },
+    { "05.03.1978", 0 },
+    { "888 888-888-777", 0 },
+    { "name=value&id=kAfBFLJaBQB-AAABBQAAAAZgAAAA9--DwnTUWct-AAA2&host=me.main.org&key=121213122aaaaaaaaaaMMMM123&tex=emb+ed", 0 },
+    { "<x:ml><node attribute=\"value\" attr2=\"99999999\">text shows_this!</node></x:ml>", 0 },
+    { "<html lang=\"en\"><meta charset=\"utf-8\"><meta property=\"og:type\"               content=\"website\"></html>", 0 },
+    { "lajksdfhjklasdhfaskdjfhklasjdlfaksdhfasjkdflsajkdflkdflhdjklfadhfksdjfhklasjdhfskljdfhsklajdhflskjdfhlskjhdflksjdhlfksjdhfjklsdhfklsdhfklsjdhklshlksfhdklfhslkdfhlskhdklsjhdflskfhlsh", 0 },
+    { "ajksdfhjklasdhfaskdjfhklasjdlfaksdhfasjkdflsajkdflkdflhdjklfadhfksdjfhklasjdhfskljdfhsklajdhflskjdfhlskjhdflksjdhlfksjdhfjklsdhfklsdhfklsjdhklshlksfljsdahsdznvztbasmuiwmereizfrbizvnsdmovosduvnuztbvzucxzvmpmvdzubtfrmeirmrnbewrJHJSBNUAIMSODMAINBSUDTAZSUDIOASMDNBAGZDTSZBUANIMOINSAUBZDGTZUIOIMSKNABJDHT9807765243567283992039209376526368799230827836526789 ç%&/\"(><<<-.,:;)*=)()(&%\"ç", 0 },
+    { "text/html,application/xhtml+xm…plication/xml;q=0.9,*/*;q=0.8", 0 },
+    { "Accept-Language: fr-CH, fr;q=0.9, en;q=0.8, de;q=0.7, *;q=0.5", 0},
+    { "Hm_lvt_ef1299edab2ff5d2f13e859…d=GA1.2.1594867574.1516566392", 0 },
+    { "If-Modified-Since", 0 },
+    { "Fri, 05 Jan 2018 02:34:41 GMT", 0 },
+    { "[Wed Feb 28 22:08:09 2018] [notice] Apache/2.2.34 (Unix) mod_ssl/2.2.34 OpenSSL/1.0.2g mod_qos/11.52 configured -- resuming normal operations", 0 },
+    { "127.0.0.1 - - [28/Feb/2018:21:03:37 +0100] \"GET /console?action=inclimit&address=194.31.217.21&event=QS_Limit HTTP/1.1\" 200 52 \"-\" 0 - - - id=wWkYPUtmBQARFAABEAAAAAAX-yQgC5d2 - - #5230", 0 },
+    { "2013/11/07 17:44:07 [error] 4640#0: *55 auth_token_module(014): request not authorized: invalid signature, client: 127.0.0.1, server: localhost, request: \"GET /app/index.html?req=1 HTTP/1.1\", host: \"127.0.0.1:8204\" 000000000002#IPhzBRn7cuuGdqBI7T4OSIjXx7JGliUokCk8dFIU9n0=", 0 },
+    { "2010 12 04 20:46:45.118 dispatch   IWWWauthCo 07148.4046314384 3-ERROR :  AuthsessClient_1_0::execute: no valid 000000000002#5jYHrFBotkZwAs5EyfVQVgNZb3M=", 0 },
+    { "2011-09-01 07:37:17,275 main            org.apache.catalina.startup.Catalina     INFO  Server startup in 5770 ms 000000000002#LQ/h2UbJ2HzdZyf8BqnB7TB8LZM=", 0 },
+    { "2010-04-14 20:18:37,464 | INFO  | org.hibernate.cfg         ::getInputStream:1081  resource: /hibernate.cfg.xml 000000000002#9lpZof9jvdMRrIebCM7rbKzJ7aY=", 0 },
+    { "http://mod-qos.sourceforge.net/", 0 },
+    { "Mozilla/5.0 (X11; Ubuntu; Linu…) Gecko/20100101 Firefox/57.0", 0 },
+    { "           Whether 'tis nobler in the mind to suffer The slings and arrows of outrageous fortune, Or to take arms against a sea of troubles, And by opposing end them? To die: to sleep; No more; and by a sleep to say we end The heart-ache and the thousand natural shocks That flesh is heir to, 'tis a consummation Devoutly to be wish'd.", 0 },
+    { "To be, or not to be: that is the question:    Whether 'tis nobler in the mind to suffer The slings and arrows of outrageous fortune, Or to take arms against a sea of troubles, And by opposing end them? To die: to sleep; No more; and by a sleep to say we end The heart-ache and the thousand natural shocks That flesh is heir to, 'tis a consummation Devoutly to be wish'd. To die, to sleep; To sleep: perchance to dream: ay, there's the rub; For in that sleep of death what dreams may come When we have shuffled off this mortal coil, Must give us pause: there's the respect That makes calamity of so long life; For who would bear the whips and scorns of time, The oppressor's wrong, the proud man's contumely, The pangs of despised love, the law's delay, The insolence of office and the spurns That patient merit of the unworthy takes, When he himself might his quietus make With a bare bodkin? who would fardels bear, To grunt and sweat under a weary life, But that the dread of something after death, The undiscover'd country from whose bourn No traveller returns, puzzles the will And makes us rather bear those ills we have Than fly to others that we know not of? Thus conscience does make cowards of us all; And thus the native hue of resolution Is sicklied o'er with the pale cast of thought, And enterprises of great pith and moment With this regard their currents turn awry, And lose the name of action.--Soft you now! The fair Ophelia! Nymph, in thy orisonsBe all my sins remember'd.", 0 },
+    { "{\n" \
+  "    \"_to\": \"1.2.3.4:5678\",\n"		\
+  "    \"_line\": 63546230,\n"						\
+  "    \"profile_image_url\": \"http://a3.twimg.com/profile_images/852841481/Untitled_3_normal.jpg\",\n" \
+  "    \"created_at\": \"Sat, 08 May 2010 21:46:23 +0000\",\n"		\
+  "    \"from_user\": \"pelchiie\",\n"					\
+  "    \"metadata\": {\n"						\
+  "        \"result_type\": \"recent\"\n"				\
+  "    },\n"								\
+  "    \"to_user_id\": null,\n"						\
+  "    \"text\": \"twitter is dead today.\",\n"				\
+  "    \"id\": 13630378882,\n"						\
+  "    \"from_user_id\": 12621761,\n"					\
+  "    \"geo\": null,\n"						\
+  "    \"iso_language_code\": \"en\",\n"				\
+  "    \"source\": \"<a href=\\\"http://twitter.com/\\\">web</a>\"\n"	\
+      "}", 0 },
+    { NULL, 0 }
+  };
+
+  int i;
+  FILE *file;
+  char readline[MAX_LINE];
+
+  const char *cmd = strrchr(argv[0], '/');
+
+  apr_pool_t *pool;
+  apr_table_t *rules;
+  long long start;
+  long long end;
+  struct timeval tv;
+  static char ver[80];
+
+  const char *filename = NULL;
+
+  if(cmd == NULL) {
+    cmd = (char *)argv[0];
+  } else {
+    cmd++;
+  }
+
+  apr_app_initialize(&argc, &argv, NULL);
+  apr_pool_create(&pool, NULL);
+  rules = apr_table_make(pool, 100);
+
+  argc--;
+  argv++;
+  while(argc >= 1) {
+    if(strcmp(*argv,"-h") == 0) {
+      usage(cmd, 0);
+    } else if(strcmp(*argv,"--help") == 0) {
+      usage(cmd, 0);
+    } else if(strcmp(*argv,"-?") == 0) {
+      usage(cmd, 0);
+    } else if(strcmp(*argv,"--man") == 0) {
+      usage(cmd, 1);
+    } else {
+      filename = *argv;
+    }
+    argc--;
+    argv++;
+  }
+
+
+  {
+    // init
+    qs_r_t *d = data;
+    while(d->string) {
+      d->len = strlen(d->string);
+      datalen += d->len;
+      d++;
+    }
+  }
+
+  if(filename == NULL) {
+    usage(cmd, 0);
+  }
+
+  file = fopen(filename, "r");
+  if(!file) {
+    fprintf(stderr, "ERROR, failed to open the log file '%s'\n", filename);
+    exit(1);
+  }
+  while(fgets(readline, MAX_LINE-1, file) != NULL) {
+    char *p;
+    int len = strlen(readline);
+    rule_t *rule = apr_pcalloc(pool, sizeof(rule_t));
+
+    while(len > 0 && readline[len] < 32) {
+      readline[len] = '\0';
+      len--;
+    }
+    if((strlen(readline) > 0) &&
+       (readline[0] != CR) &&
+       (readline[0] != LF)) {
+
+      p = readline;
+
+      rule->preg = apr_palloc(pool, sizeof(qs_regex_t));
+      if(qs_regcomp(rule->preg, p, PCRE2_DOTALL|PCRE2_CASELESS) != 0) {
+	printf("failed to compile pattern [%s]\n", p);
+	exit(1);
+      }
+      apr_pool_pre_cleanup_register(pool, rule->preg, qs_pregfree);
+      apr_table_addn(rules, apr_pstrdup(pool, p), (char *)rule);
+    }
+  }
+
+
+  { // per rule
+      int k;
+      apr_table_entry_t *entry = (apr_table_entry_t *)apr_table_elts(rules)->elts;
+      for(k = 0; k < apr_table_elts(rules)->nelts; k++) {
+	rule_t* rule = (rule_t *)entry[k].val;
+	gettimeofday(&tv, NULL);
+	start = tv.tv_sec * 1000000 + tv.tv_usec;
+	for(i = 0; i < LOOPS; i++) {
+	  qs_r_t *d = data;
+	  while(d->string) {
+	    qs_regexec_len(rule->preg, d->string, d->len, 0, NULL, 0);
+	    d++;
+	  }
+	}
+	gettimeofday(&tv, NULL);
+	end = tv.tv_sec * 1000000 + tv.tv_usec;
+	printf("%lld usec for %s\n", (end - start)/LOOPS, entry[k].key);	
+      }
+  }
+
+  // all rules
+  gettimeofday(&tv, NULL);
+  start = tv.tv_sec * 1000000 + tv.tv_usec;
+  for(i = 0; i < LOOPS; i++) {
+    const qs_r_t *d = data;
+    while(d->string) {
+      int k;
+      apr_table_entry_t *entry = (apr_table_entry_t *)apr_table_elts(rules)->elts;
+      for(k = 0; k < apr_table_elts(rules)->nelts; k++) {
+	rule_t* rule = (rule_t *)entry[k].val;
+	qs_regexec_len(rule->preg, d->string, d->len, 0, NULL, 0);
+      }
+      d++;
+    }
+  }
+  gettimeofday(&tv, NULL);
+  end = tv.tv_sec * 1000000 + tv.tv_usec;
+  pcre2_config(PCRE2_CONFIG_VERSION, ver);
+  printf("match all rules (%d) against the test variables (%lu strings, %d characters) took: %lld usec (%s/PCRE %s)\n",
+	 apr_table_elts(rules)->nelts,
+	 sizeof(data)/sizeof(qs_r_t)-1,
+	 datalen,
+	 (end - start) / LOOPS,
+	 revision, ver);
+  return 0;
+
+}
diff --git a/tools/src/qsrotate.c b/tools/src/qsrotate.c
new file mode 100644
index 0000000..213a2e4
--- /dev/null
+++ b/tools/src/qsrotate.c
@@ -0,0 +1,522 @@
+/**
+ * Utilities for the quality of service module mod_qos.
+ *
+ * qsrotate.c: Log rotation tool.
+ *
+ * See http://mod-qos.sourceforge.net/ for further
+ * details.
+ *
+ * Copyright (C) 2023 Pascal Buchbinder
+ *
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+static const char revision[] = "$Id: qsrotate.c 2654 2022-05-13 09:12:42Z pbuchbinder $";
+
+#include <stdio.h>
+#include <string.h>
+
+#include <errno.h>
+#include <fcntl.h>
+#include <dirent.h>
+
+#include <stdlib.h>
+#include <unistd.h>
+
+#include <pthread.h>
+
+#include <time.h>
+#include <zlib.h>     
+
+#include <signal.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <sys/stat.h>
+
+#include "qs_util.h"
+
+#define HUGE_STR       1024
+
+//yyyy-mm-dd<sp>hh-mm-ss<sp>
+#define TME_STR_LEN    20
+
+/* global variables used by main and support thread */
+static int m_force_rotation = 0;
+static time_t m_tLogEnd = 0;
+static time_t m_tRotation = 86400; /* default are 24h */
+static int m_nLogFD = -1;
+static int m_generations = -1;
+static mode_t m_mode = 0660;
+static char *m_file_name = NULL;
+static long m_messages = 0;
+static char *m_cmd = NULL;
+static int m_compress = 0;
+static int m_stdout = 0;
+static int m_timestamp = 0;
+static char time_string[TME_STR_LEN];
+static long m_counter = 0;
+static long m_limit = 2147483648 - (128 * 1024);
+static int m_offset = 0;
+static int m_offset_enabled = 0;
+
+static void usage(char *cmd, int man) {
+  if(man) {
+    //.TH [name of program] [section number] [center footer] [left footer] [center header]
+    printf(".TH %s 1 \"%s\" \"mod_qos utilities %s\" \"%s man page\"\n", qs_CMD(cmd), man_date,
+	   man_version, cmd);
+  }
+  printf("\n");
+  if(man) {
+    printf(".SH NAME\n");
+  }
+  qs_man_print(man, "%s - a log rotation tool (similar to Apache's rotatelogs).\n", cmd);
+  printf("\n");
+  if(man) {
+    printf(".SH SYNOPSIS\n");
+  }
+  qs_man_print(man, "%s%s -o <file> [-s <sec> [-t <hours>]] [-b <bytes>] [-f] [-z] [-g <num>] [-u <name>] [-m <mask>] [-p] [-d]\n", man ? "" : "Usage: ", cmd);
+  printf("\n");
+  if(man) {
+    printf(".SH DESCRIPTION\n");
+  } else {
+    printf("Summary\n");
+  }
+  qs_man_print(man, "%s reads from stdin (piped log) and writes the data to the provided\n", cmd);
+  qs_man_print(man, "file rotating the file after the specified time.\n");
+  printf("\n");
+  if(man) {
+    printf(".SH OPTIONS\n");
+  } else {
+    printf("Options\n");
+  }
+  if(man) printf(".TP\n");
+  qs_man_print(man, "  -o <file>\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Output log file to write the data to (use an absolute path).\n");
+  if(man) printf("\n.TP\n");
+  qs_man_print(man, "  -s <sec>\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Rotation interval in seconds, default are 86400 seconds.\n");
+  if(man) printf("\n.TP\n");
+  qs_man_print(man, "  -t <hours>\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Offset to UTC (enables also DST support), default is 0.\n");
+  if(man) printf("\n.TP\n");
+  qs_man_print(man, "  -b <bytes>\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     File size limitation (default/max. are %ld bytes, min. are 1048576 bytes).\n", m_limit);
+  if(man) printf("\n.TP\n");
+  qs_man_print(man, "  -f\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Forced log rotation at the specified interval even no data is written.\n");
+  if(man) printf("\n.TP\n");
+  qs_man_print(man, "  -z\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Compress (gzip) the rotated file.\n");
+  if(man) printf("\n.TP\n");
+  qs_man_print(man, "  -g <num>\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Generations (number of files to keep).\n");
+  if(man) printf("\n.TP\n");
+  qs_man_print(man, "  -u <name>\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Become another user, e.g. www-data.\n");
+  qs_man_print(man, "  -m <mask>\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     File permission which is either 600, 640, 660 (default) or 664.\n");
+  if(man) printf("\n.TP\n");
+  qs_man_print(man, "  -p\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Writes data also to stdout (for piped logging).\n");
+  qs_man_print(man, "  -d\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Line-by-line data reading prefixing every line with a timestamp.\n");
+  printf("\n");
+  if(man) {
+    printf(".SH EXAMPLE\n");
+  } else {
+    printf("Example:\n");
+  }
+  qs_man_println(man, "  TransferLog \"|/usr/bin/%s -f -z -g 3 -o /var/log/apache/access.log -s 86400\"\n", cmd);
+  printf("\n");
+  qs_man_print(man, "The name of the rotated file will be /dest/filee.YYYYmmddHHMMSS\n");
+  qs_man_print(man, "where YYYYmmddHHMMSS is the system time at which the data has been\n");
+  qs_man_print(man, "rotated.\n");
+  printf("\n");
+  if(man) {
+    printf(".SH NOTE\n");
+  } else {
+    printf("Notes:\n");
+  }
+  qs_man_println(man, " - Each %s instance must use an individual file.\n", cmd);
+  qs_man_println(man, " - You may trigger a file rotation manually by sending the signal USR1\n");
+  qs_man_print(man, "   to the process.\n");
+  printf("\n");
+  if(man) {
+    printf(".SH SEE ALSO\n");
+    printf("qsdt(1), qsexec(1), qsfilter2(1), qsgeo(1), qsgrep(1), qshead(1), qslog(1), qslogger(1), qsre(1), qsrespeed(1), qspng(1), qssign(1), qstail(1)\n");
+    printf(".SH AUTHOR\n");
+    printf("Pascal Buchbinder, http://mod-qos.sourceforge.net/\n");
+  } else {
+    printf("See http://mod-qos.sourceforge.net/ for further details.\n");
+  }
+  if(man) {
+    exit(0);
+  } else {
+    exit(1);
+  }
+}
+
+static time_t get_now() {
+  time_t now = time(NULL);
+  if(m_offset_enabled) {
+    struct tm lcl = *localtime(&now);
+    if(lcl.tm_isdst) {
+      now += 3600;
+    }
+    now += m_offset;
+  }
+  return now;
+}
+
+static int openFile(const char *cmd, const char *file_name) {
+  int m_nLogFD = open(file_name, O_WRONLY | O_CREAT | O_APPEND, m_mode);
+  /* error while opening log file */
+  if(m_nLogFD < 0) {
+    fprintf(stderr,"[%s]: ERROR, failed to open file <%s>\n", cmd, file_name);
+  }
+  return m_nLogFD;
+}
+
+/**
+ * Compress method called by a child process (forked)
+ * used to compress the rotated file.
+ *
+ * @param cmd Command name (used when logging errors)
+ * @param arch Path to the file to compress. File gets renamed to <arch>.gz
+ */
+static void compressThread(const char *cmd, const char *arch) {
+  gzFile *outfp;
+  int infp;
+  char dest[HUGE_STR+20];
+  char buf[HUGE_STR];
+  int len;
+  snprintf(dest, sizeof(dest), "%s.gz", arch);
+  /* low prio */
+  if(nice(10) == -1) {
+    fprintf(stderr, "[%s]: WARNING, failed to change nice value: %s\n", cmd, strerror(errno));
+  }
+  if((infp = open(arch, O_RDONLY)) == -1) {
+    /* failed to open file, can't compress it */
+    fprintf(stderr,"[%s]: ERROR, could not open file for compression <%s>\n", cmd, arch);
+    return;
+  }
+  if((outfp = gzopen(dest,"wb")) == NULL) {
+    fprintf(stderr,"[%s]: ERROR, could not open file for compression <%s>\n", cmd, dest);
+    close(infp);
+    return;
+  }
+  chmod(dest, m_mode);
+  while((len = read(infp, buf, sizeof(buf))) > 0) {
+    gzwrite(outfp, buf, len);
+  }
+  gzclose(outfp);
+  close(infp);
+  /* done, delete the old file */
+  unlink(arch);
+}
+
+void sigchild(int signo) {
+  pid_t pid;
+  int stat;   
+  while((pid=waitpid(-1,&stat,WNOHANG)) > 0) {
+  }
+}
+
+void writeTimestamp() {
+  time_t tm = time(NULL);
+  struct tm *ptr = localtime(&tm);
+  strftime(time_string, TME_STR_LEN, "%Y-%m-%d %H:%M:%S ", ptr);
+  write(m_nLogFD, time_string, TME_STR_LEN);
+}
+
+/**
+ * Rotates a file
+ *
+ * @param cmd Command name to be used in log messages
+ * @param now
+ * @param file_name Name of the file to rotate (rename)
+ * @param messages Number of lines/buffers which had been read
+ */
+static void rotate(const char *cmd, time_t now,
+		   const char *file_name, long *messages) {
+  int rc;
+  char arch[HUGE_STR+20];
+  char tmb[20];
+  struct tm *ptr = localtime(&now);
+  strftime(tmb, sizeof(tmb), "%Y%m%d%H%M%S", ptr);
+  snprintf(arch, sizeof(arch), "%s.%s", file_name, tmb);
+
+  /* set next rotation time */
+  m_tLogEnd = ((now / m_tRotation) * m_tRotation) + m_tRotation;
+  // reset byte counter
+  m_counter = 0;
+  
+  /* rename current file */
+  if(m_nLogFD >= 0) {
+    close(m_nLogFD);
+    rename(file_name, arch);
+  }
+  
+  /* open new file */
+  m_nLogFD = openFile(cmd, file_name);
+  if(m_nLogFD < 0) {
+    /* opening a new file has failed!
+       try to reopen and clear the last file */
+    char msg[HUGE_STR];
+    snprintf(msg, sizeof(msg), "ERROR while writing to file, %ld messages lost\n", *messages);
+    fprintf(stderr,"[%s]: ERROR, while writing to file <%s>\n", cmd, file_name);
+    rename(arch,  file_name);
+    m_nLogFD = openFile(cmd, file_name);
+    if(m_nLogFD > 0) {
+      rc = ftruncate(m_nLogFD, 0);
+      rc = write(m_nLogFD, msg, strlen(msg));
+    }
+  } else {
+    *messages = 0;
+    if(m_compress || (m_generations != -1)) {
+      signal(SIGCHLD,sigchild);
+      if(fork() == 0) {
+	if(m_compress) {
+	  compressThread(cmd, arch);
+	}
+	if(m_generations != -1) {
+	  qs_deleteOldFiles(file_name, m_generations);
+	}
+	exit(0);
+      }
+    }
+  }
+}
+
+/**
+ * Separate thread which initiates file rotation even no
+ * log data is written.
+ *
+ * @param argv (not used)
+ */
+static void *forcedRotationThread(void *argv) {
+  time_t now;
+  time_t n;
+  while(1) {
+    qs_csLock();
+    now = get_now();
+    if(now > m_tLogEnd) {
+      rotate(m_cmd, now, m_file_name, &m_messages);
+    }
+    qs_csUnLock();
+    now = get_now();
+    n = 1 + m_tLogEnd - now;
+    sleep(n);
+  }
+  return NULL;
+}
+
+void handle_signal1(int signal) {
+  rotate(m_cmd, get_now(), m_file_name, &m_messages);
+  return;
+}
+
+int main(int argc, char **argv) {
+  char *username = NULL;
+  int rc;
+  char *buf;
+  int nRead, nWrite;
+  time_t now;
+  struct stat st;
+  long sizeLimit = 0;
+
+  pthread_attr_t *tha = NULL;
+  pthread_t tid;
+  struct sigaction sa;
+ 
+  char *cmd = strrchr(argv[0], '/');
+
+  sa.sa_handler = &handle_signal1;
+  sa.sa_flags = SA_RESTART;
+   
+  if(cmd == NULL) {
+    cmd = argv[0];
+  } else {
+    cmd++;
+  }
+  m_cmd = calloc(1, strlen(cmd)+1);
+  strcpy(m_cmd, cmd); // copy as we can't pass it when forking
+
+  while(argc >= 1) {
+    if(strcmp(*argv,"-o") == 0) {
+      if (--argc >= 1) {
+	m_file_name = *(++argv);
+      }
+    } else if(strcmp(*argv,"-u") == 0) {
+      if (--argc >= 1) {
+	username = *(++argv);
+      }
+    } else if(strcmp(*argv,"-s") == 0) {
+      if (--argc >= 1) {
+	m_tRotation = atoi(*(++argv));
+      } 
+    } else if(strcmp(*argv,"-t") == 0) {
+      if (--argc >= 1) {
+	m_offset = atoi(*(++argv));
+	m_offset = m_offset * 3600;
+	m_offset_enabled = 1;
+      } 
+    } else if(strcmp(*argv,"-g") == 0) {
+      if (--argc >= 1) {
+	m_generations = atoi(*(++argv));
+      } 
+    } else if(strcmp(*argv,"-b") == 0) {
+      if (--argc >= 1) {
+	sizeLimit = atol(*(++argv));
+      } 
+    } else if(strcmp(*argv,"-m") == 0) {
+      if (--argc >= 1) {
+	int mode = atoi(*(++argv));
+	if(mode == 600) {
+	  m_mode = 0600;
+	} else if(mode == 640) {
+	  m_mode = 0640;
+	} else if(mode == 660) {
+	  m_mode = 0660;
+	} else if(mode == 664) {
+	  m_mode = 0664;
+	}
+      } 
+    } else if(strcmp(*argv,"-z") == 0) {
+      m_compress = 1;
+    } else if(strcmp(*argv,"-p") == 0) {
+      m_stdout = 1;
+    } else if(strcmp(*argv,"-d") == 0) {
+      m_timestamp = 1;
+      memset(time_string, 32, TME_STR_LEN);
+    } else if(strcmp(*argv,"-f") == 0) {
+      m_force_rotation = 1;
+    } else if(strcmp(*argv,"-h") == 0) {
+      usage(m_cmd, 0);
+    } else if(strcmp(*argv,"--help") == 0) {
+      usage(m_cmd, 0);
+    } else if(strcmp(*argv,"-?") == 0) {
+      usage(m_cmd, 0);
+    } else if(strcmp(*argv,"--man") == 0) {
+      usage(m_cmd, 1);
+    }
+
+    argc--;
+    argv++;
+  }
+
+  if(m_file_name == NULL) usage(m_cmd, 0);
+  if(sizeLimit > 0 && sizeLimit < m_limit && sizeLimit >= (1024 * 1024)) {
+    m_limit = sizeLimit;
+  } else if(sizeLimit > 0 && sizeLimit < (1024 * 1024)) {
+    m_limit = 1024 * 1024;
+  }
+
+  if(stat(m_file_name, &st) == 0) {
+    m_counter = st.st_size;
+  }
+
+  sigaction(SIGUSR1, &sa, NULL);
+  qs_setuid(username, m_cmd);
+  
+  /* set next rotation time */
+  now = get_now();
+  m_tLogEnd = ((now / m_tRotation) * m_tRotation) + m_tRotation;
+  /* open file */
+  m_nLogFD = openFile(m_cmd, m_file_name);
+  if(m_nLogFD < 0) {
+    /* startup did not success */
+    exit(2);
+  }
+
+  if(m_force_rotation) {
+    qs_csInitLock();
+    pthread_create(&tid, tha, forcedRotationThread, NULL);
+  }
+
+  buf = calloc(1, MAX_LINE_BUFFER+1);
+  for(;;) {
+    if(m_timestamp) {
+      // low perf line-by-line read
+      if(fgets(buf, MAX_LINE_BUFFER, stdin) == NULL) {
+	exit(3);
+      } else {
+	nRead = strlen(buf);
+	if(m_force_rotation) {
+	qs_csLock();                       // >@CTR1
+      }
+	m_counter += (nRead + TME_STR_LEN);
+	now = get_now();
+	writeTimestamp();
+	nWrite = write(m_nLogFD, buf, nRead);
+      }
+    } else {
+      // normal/fast buffer read/process
+      nRead = read(0, buf, MAX_LINE_BUFFER);
+      if(nRead == 0) exit(3);
+      if(nRead < 0) if(errno != EINTR) exit(4);
+      if(m_force_rotation) {
+	qs_csLock();                         // >@CTR1
+      }
+      m_counter += nRead;
+      now = get_now();
+      /* write data if we have a file handle (else continue but drop log data,
+	 re-try to open the file at next rotation time) */
+      if(m_nLogFD >= 0) {
+	do {
+	  nWrite = write(m_nLogFD, buf, nRead);
+	  if(m_stdout) {
+	    printf("%.*s", nRead, buf);
+	  }
+	} while (nWrite < 0 && errno == EINTR);
+      }
+      m_messages++;
+      if(nWrite != nRead) {
+	if(m_nLogFD >= 0) {
+	  char msg[HUGE_STR];
+	  snprintf(msg, sizeof(msg), "ERROR while writing to file, %ld messages lost\n", m_messages);
+	  /* error while writing data, try to delete the old file and continue ... */
+	  rc = ftruncate(m_nLogFD, 0);
+	  rc = write(m_nLogFD, msg, strlen(msg));
+	  m_messages = 0;
+	}
+      }
+    }
+    // end buffer or line read
+    if((now > m_tLogEnd) || (m_counter > m_limit)) {
+      /* rotate! */
+      rotate(m_cmd, now, m_file_name, &m_messages);
+    }
+    if(m_force_rotation) {
+      qs_csUnLock();                         // <@CTR1
+    }
+  }
+  memset(buf, 0, MAX_LINE_BUFFER);
+  free(buf);
+  return 0;
+}
diff --git a/tools/src/qssign.c b/tools/src/qssign.c
new file mode 100644
index 0000000..6ea7021
--- /dev/null
+++ b/tools/src/qssign.c
@@ -0,0 +1,799 @@
+/**
+ * Utilities for the quality of service module mod_qos.
+ *
+ * qssign.c: Log data signing tool to ensure data integrity.
+ *
+ * See http://mod-qos.sourceforge.net/ for further
+ * details.
+ *
+ * Copyright (C) 2023 Pascal Buchbinder
+ *
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+static const char revision[] = "$Id: qssign.c 2654 2022-05-13 09:12:42Z pbuchbinder $";
+
+#include <stdio.h>
+#include <unistd.h>
+#include <string.h>
+#include <stdlib.h>
+#include <regex.h>
+#include <signal.h>
+
+/* openssl */
+#include <openssl/evp.h>
+#include <openssl/hmac.h>
+
+/* apr/apr-util */
+#define QS_USEAPR 1
+#include <apr.h>
+#include <apr_base64.h>
+#include <apr_pools.h>
+#include <apr_strings.h>
+#include <apr_thread_proc.h>
+#include <apr_file_io.h>
+#include <apr_time.h>
+
+#define PCRE2_CODE_UNIT_WIDTH 8
+#include <pcre2.h>
+
+#include "qs_util.h"
+#include "qs_apo.h"
+
+#define SEQDIG "12"
+#define QS_END   "qssign---end-of-data"
+#define QS_START "qssign---------start"
+
+static const char *m_start_fmt = "";
+static const char *m_end_fmt = "";
+static long m_nr = 1;
+static int  m_logend = 0;
+static void (*m_end)(const char *, int) = NULL;
+static int m_end_pos = 0;
+static const char *m_sec = NULL;
+static const EVP_MD *m_evp;
+static qs_regex_t *m_filter = NULL;
+
+typedef struct {
+  const char* start_fmt;
+  const char* end_fmt;
+  const char* pattern;
+  const char* test;
+} qos_p_t;
+
+#define severity "[A-Z]+"
+
+static const qos_p_t pattern[] = {
+  {
+    "%s | INFO  | "QS_START,
+    "%s | INFO  | "QS_END,
+    "^[0-9]{4}[-][0-9]{2}[-][0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2},[0-9]{3}[ ]+[|][ ]+"severity"[ ]+[|][ ]+[a-zA-Z0-9]+",
+    "2010-04-14 20:18:37,464 | INFO  | org.hibernate.cfg.Configuration"
+  },
+  {
+    "%s INFO  "QS_START,
+    "%s INFO  "QS_END,
+    "^[0-9]{4}[-][0-9]{2}[-][0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2},[0-9]{3}[ ]+"severity"[ ]+",
+    "2011-08-30 07:27:22,738 INFO  loginId='test'"
+  },
+  {
+    "%s qssign          start                                    INFO  "QS_START,
+    "%s qssign          end                                      INFO  "QS_END,
+    "^[0-9]{4}[-][0-9]{2}[-][0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2},[0-9]{3}[ ]+[a-zA-Z0-9\\.-]+[ ]+[a-zA-Z0-9\\.-]+[ ]+"severity"[ ]+",
+    "2011-09-01 07:37:17,275 main            org.apache.catalina.startup.Catalina     INFO  Server"
+  },
+  {
+    "%s INFO  "QS_START,
+    "%s INFO  "QS_END,
+    "^[0-9]{4}[-][0-9]{2}[-][0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2},[0-9]{3}[ ]+",
+    "2011-08-30 07:27:22,738 "
+  },
+  { NULL, NULL, NULL }
+};
+
+/**
+ * Writes the signed log line to stdout.
+ *
+ * @param line Data to sign
+ * @param line_size Length of the data
+ * @param sec Secret
+ * @param sec_len Length of the secret
+ */
+static void qs_write(char *line, int line_size, const char *sec, int sec_len) {
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
+  HMAC_CTX hmac;
+  HMAC_CTX *hmac_p = &hmac;
+#else
+  HMAC_CTX *hmac_p;
+#endif
+  unsigned char data[HMAC_MAX_MD_CBLOCK];
+  unsigned int len;
+  char *m;
+  int data_len;
+  sprintf(&line[strlen(line)], " %."SEQDIG"ld", m_nr);
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
+  HMAC_CTX_init(hmac_p);
+#else
+  hmac_p = HMAC_CTX_new();
+#endif
+  HMAC_Init_ex(hmac_p, sec, sec_len, m_evp, NULL);
+  HMAC_Update(hmac_p, (const unsigned char *)line, strlen(line));
+  HMAC_Final(hmac_p, data, &len);
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
+  HMAC_CTX_cleanup(hmac_p);
+#else
+  HMAC_CTX_free(hmac_p);
+#endif
+  m = calloc(1, apr_base64_encode_len(len) + 1);
+  data_len = apr_base64_encode(m, (char *)data, len);
+  m[data_len] = '\0';
+  printf("%s#%s\n", line, m);
+  fflush(stdout);
+  free(m);
+  m_nr++;
+  return;
+}
+
+/*
+ * [Fri Dec 03 07:37:40 2010] [notice] .........
+ */
+static void qs_end_apache_err(const char *sec, int start) {
+  int sec_len = strlen(sec);
+  char line[MAX_LINE];
+  int dig = atoi(SEQDIG);
+  /* <data> ' ' <sequence number> '#' <hmac>*/
+  int line_size = sizeof(line) - 1 - dig - 1 - (2*HMAC_MAX_MD_CBLOCK) - 1;
+  char time_string[1024];
+  time_t tm = time(NULL);
+  struct tm *ptr = localtime(&tm);
+  strftime(time_string, sizeof(time_string), "%a %b %d %H:%M:%S %Y", ptr);
+  if(start) {
+    sprintf(line, "[%s] [notice] "QS_START, time_string);
+  } else {
+    sprintf(line, "[%s] [notice] "QS_END, time_string);
+  }
+  qs_write(line, line_size, sec, sec_len);
+  return;
+}
+
+/*
+ * 12.12.12.12 - - [03/Dec/2010:07:36:51 +0100] ...............
+ */
+static void qs_end_apache_acc(const char *sec, int start) {
+  int sec_len = strlen(sec);
+  char line[MAX_LINE];
+  int dig = atoi(SEQDIG);
+  /* <data> ' ' <sequence number> '#' <hmac>*/
+  int line_size = sizeof(line) - 1 - dig - 1 - (2*HMAC_MAX_MD_CBLOCK) - 1;
+  char time_string[1024];
+  time_t tm = time(NULL);
+  struct tm *ptr = localtime(&tm);
+  char sign;
+  int timz;
+  apr_time_exp_t xt;
+  apr_time_exp_lt(&xt, apr_time_now());
+  timz = xt.tm_gmtoff;
+  if(timz < 0) {
+    timz = -timz;
+    sign = '-';
+  } else {
+    sign = '+';
+  }
+  strftime(time_string, sizeof(time_string), "%d/%b/%Y:%H:%M:%S", ptr);
+  if(start) {
+    sprintf(line, "0.0.0.0 - - [%s %c%.2d%.2d] "QS_START, time_string, sign, timz / (60*60), (timz % (60*60)) / 60);
+  } else {
+    sprintf(line, "0.0.0.0 - - [%s %c%.2d%.2d] "QS_END, time_string, sign, timz / (60*60), (timz % (60*60)) / 60);
+  }
+  qs_write(line, line_size, sec, sec_len);
+  return;
+}
+
+/*
+ * 2010 12 03 17:00:30.425 qssign     end        0.0              5-NOTICE:  ..............
+ */
+static void qs_end_nj(const char *sec, int start) {
+  int sec_len = strlen(sec);
+  char line[MAX_LINE];
+  int dig = atoi(SEQDIG);
+  /* <data> ' ' <sequence number> '#' <hmac>*/
+  int line_size = sizeof(line) - 1 - dig - 1 - (2*HMAC_MAX_MD_CBLOCK) - 1;
+  char time_string[1024];
+  time_t tm = time(NULL);
+  struct tm *ptr = localtime(&tm);
+  char buf[1024];
+  int i;
+  for(i = 0; i < m_end_pos; i++) {
+    buf[i] = ' ';
+  }
+  buf[i] = '\0';
+  strftime(time_string, sizeof(time_string), "%Y %m %d %H:%M:%S.000", ptr);
+  if(start) {
+    sprintf(line, "%s qssign     start      0.0%s 5-NOTICE:  "QS_START, time_string, buf);
+  } else {
+    sprintf(line, "%s qssign     end        0.0%s 5-NOTICE:  "QS_END, time_string, buf);
+  }
+  qs_write(line, line_size, sec, sec_len);
+  return;
+}
+
+/*
+ * 2010-04-14 20:18:37,464 ... (using m_fmt)
+ */
+static void qs_end_lj(const char *sec, int start) {
+  int sec_len = strlen(sec);
+  char line[MAX_LINE];
+  int dig = atoi(SEQDIG);
+  /* <data> ' ' <sequence number> '#' <hmac>*/
+  int line_size = sizeof(line) - 1 - dig - 1 - (2*HMAC_MAX_MD_CBLOCK) - 1;
+  char time_string[1024];
+  time_t tm = time(NULL);
+  struct tm *ptr = localtime(&tm);
+  strftime(time_string, sizeof(time_string), "%Y-%m-%d %H:%M:%S,000", ptr);
+  if(start) {
+    sprintf(line, m_start_fmt, time_string);
+  } else {
+    sprintf(line, m_end_fmt, time_string);
+  }
+  qs_write(line, line_size, sec, sec_len);
+  return;
+}
+
+/*
+ * Dec  6 04:00:06 localhost kernel:
+ */
+static void qs_end_lx(const char *sec, int start) {
+  char hostname[1024];
+  int len = sizeof(hostname);
+  int sec_len = strlen(sec);
+  char line[MAX_LINE];
+  int dig = atoi(SEQDIG);
+  /* <data> ' ' <sequence number> '#' <hmac>*/
+  int line_size = sizeof(line) - 1 - dig - 1 - (2*HMAC_MAX_MD_CBLOCK) - 1;
+  char time_string[1024];
+  time_t tm = time(NULL);
+  struct tm *ptr = localtime(&tm);
+  strftime(time_string, sizeof(time_string), "%b %e %H:%M:%S", ptr);
+  if(gethostname(hostname, len) != 0) {
+    hostname[0] = '-';
+    hostname[1] = '\0';
+  }
+  if(start) {
+    sprintf(line, "%s %s qssign: "QS_START, time_string, hostname);
+  } else {
+    sprintf(line, "%s %s qssign: "QS_END, time_string, hostname);
+  }
+  qs_write(line, line_size, sec, sec_len);
+  return;
+}
+
+/*
+ * 2013/11/13 17:38:41 [error] 6577#0: *1 open()
+ */
+static void qs_end_ngx(const char *sec, int start) {
+  int sec_len = strlen(sec);
+  char line[MAX_LINE];
+  int dig = atoi(SEQDIG);
+  /* <data> ' ' <sequence number> '#' <hmac>*/
+  int line_size = sizeof(line) - 1 - dig - 1 - (2*HMAC_MAX_MD_CBLOCK) - 1;
+  char time_string[1024];
+  time_t tm = time(NULL);
+  struct tm *ptr = localtime(&tm);
+  strftime(time_string, sizeof(time_string), "%Y/%m/%d %H:%M:%S", ptr);
+  if(start) {
+    sprintf(line, "%s [notice] 0#0: "QS_END, time_string);
+  } else {
+    sprintf(line, "%s [notice] 0#0: "QS_END, time_string);
+  }
+  qs_write(line, line_size, sec, sec_len);
+  return;
+}
+
+void qs_signal_exit(int e) {
+  if(m_logend && (m_end != NULL)) {
+    m_end(m_sec, 0);
+  }
+  exit(0);
+}
+
+/**
+ * Tries to find out a suitable log line format which is used
+ * to log sign end messages (so let the verifier known, that the
+ * data ends nothing has been cut off).
+ *
+ * Sets the format to global variables.
+ *
+ * known pattern
+ * - [Fri Dec 03 07:37:40 2010] [notice] .........
+ * - 12.12.12.12 - - [03/Dec/2010:07:36:51 +0100] ...............
+ * - 2010 12 03 17:00:30.425 qssign     end        0.0              5-NOTICE:  ..............
+ *                                                 46  <- var ->    63      71
+ * - Dec  6 04:00:06 localhost kernel:
+ * - some 2010-12-03 17:00:30,425 ...
+ *
+ * @param s
+ */
+static void qs_set_format(char *s) {
+  regex_t r_apache_err; 
+  regex_t r_apache_acc;
+  regex_t r_nj;
+  regex_t r_lx;
+  regex_t r_ngx;
+  if(regcomp(&r_apache_err,
+	     "^\\[[a-zA-Z]{3} [a-zA-Z]{3} [0-9]+ [0-9]+:[0-9]+:[0-9]+ [0-9]+\\] \\[[a-zA-Z]+\\] ",
+	     REG_EXTENDED) != 0) {
+    fprintf(stderr, "failed to compile regex (err)\n");
+    exit(1);
+  }
+  if(regcomp(&r_apache_acc,
+	     "^[0-9.]+ [a-zA-Z0-9\\@_\\.\\-]+ [a-zA-Z0-9\\@_\\.\\-]+ \\[[0-9]+/[a-zA-Z]{3}/[0-9:]+[0-9\\+ ]+\\] ",
+	     REG_EXTENDED) != 0) {
+    fprintf(stderr, "failed to compile regex (acc)\n");
+    exit(1);
+  }
+  if(regcomp(&r_nj,
+	     "^[0-9]{4} [0-9]{2} [0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2}\\.[0-9]{3} [a-zA-Z0-9]+[ ]+.*[A-Z]+[ ]*:",
+	     REG_EXTENDED) != 0) {
+    fprintf(stderr, "failed to compile regex (nj)\n");
+    exit(1);
+  }
+  if(regcomp(&r_lx,
+	     "^[a-zA-Z]{3}[ ]+[0-9]+[ ]+[0-9]{2}:[0-9]{2}:[0-9]{2}[ ]+[a-zA-Z0-9_\\.\\-]+[ ]+[a-zA-Z0-9_\\.\\-]+:",
+	     REG_EXTENDED) != 0) {
+    fprintf(stderr, "failed to compile regex (lx)\n");
+    exit(1);
+  }
+  if(regcomp(&r_ngx,
+	     "^[0-9]{4}/[0-9]{2}/[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2} \\[[a-z]+\\] [0-9]+#[0-9]+: ",
+	     REG_EXTENDED) != 0) {
+    fprintf(stderr, "failed to compile regex (ngx)\n");
+    exit(1);
+  }
+    
+
+  if(regexec(&r_apache_err, s, 0, NULL, 0) == 0) {
+    m_end = &qs_end_apache_err;
+  } else if(regexec(&r_apache_acc, s, 0, NULL, 0) == 0) {
+    m_end = &qs_end_apache_acc;
+  } else if(regexec(&r_nj, s, 0, NULL, 0) == 0) {
+    char *dp = strstr(s, ": ");
+    if(dp) {
+      /* calculate the "var" size, see comment above */
+      m_end_pos = dp - s - 47 - 8 - 3;
+      if((m_end_pos < 0) || (m_end_pos > 1000)) {
+	m_end_pos = 0;
+      }
+    }
+    m_end = &qs_end_nj;
+  } else if(regexec(&r_lx, s, 0, NULL, 0) == 0) {
+    m_end = &qs_end_lx;    
+  } else if(regexec(&r_ngx, s, 0, NULL, 0) == 0) {
+    m_end = &qs_end_ngx;    
+  }
+  // search within the generic yyyy-mm-dd hh-mm-ss,mmm patterns
+  if(!m_end) {
+    const qos_p_t *p = pattern;
+    while(p->end_fmt) {
+      regex_t r_j;
+      if(regcomp(&r_j, p->pattern, REG_EXTENDED) != 0) {
+	fprintf(stderr, "failed to compile regex (%s)\n", p->pattern);
+	exit(1);
+      }
+      if(regexec(&r_j, s, 0, NULL, 0) == 0) {
+	m_start_fmt = p->start_fmt;
+	m_end_fmt = p->end_fmt;
+	m_end = &qs_end_lj;      
+	break;
+      }
+      p++;
+    }
+  }
+  /* default (apache error log format) */
+  if(m_end == NULL) {
+    m_end = &qs_end_apache_err;
+  }
+  return;
+}
+
+/**
+ * Process the data from stdin.
+ *
+ * @param sec Passphrase
+ */
+static void qs_sign(const char *sec) {
+  int sec_len = strlen(sec);
+  char *line = calloc(1, MAX_LINE_BUFFER+1);
+  int dig = atoi(SEQDIG);
+  /* <data> ' ' <sequence number> '#' <hmac>*/
+  int line_size = MAX_LINE_BUFFER - 1 - dig - 1 - (2*HMAC_MAX_MD_CBLOCK) - 1;
+  int line_len;
+  while(fgets(line, MAX_LINE_BUFFER, stdin) != NULL) {
+    line_len = strlen(line) - 1;
+    while(line_len > 0) { // cut tailing CR/LF
+      if(line[line_len] >= ' ') {
+	break;
+      }
+      line[line_len] = '\0';
+      line_len--;
+    }
+    if(m_logend && (m_end == NULL)) {
+      qs_set_format(line);
+      m_end(m_sec, 1);
+    }
+    if(m_filter != NULL && qs_regexec_len(m_filter, line, line_len, 0, NULL, 0) >= 0) {
+      printf("%s\n", line);
+      fflush(stdout);
+    } else {
+      qs_write(line, line_size, sec, sec_len);
+    }
+  }
+  return;
+}
+
+static int isSpecialLine(const char *line, const char *marker) {
+  char *se_marker = strstr(line, marker);
+  if(se_marker != NULL) {
+    /* QS_END/START + " " + SEQDIG */
+    int sz = strlen(marker) + 1 + atoi(SEQDIG);
+    if(sz == (strlen(line) - (se_marker - line))) {
+      return 1;
+    }
+  }
+  return 0;
+}
+
+static long qs_verify(const char *sec) {
+  int end_seen = 0;
+  int sec_len = strlen(sec);
+  long err = 0; // errors
+  long lineNumber = 0; // line number of the file / input data
+  char *line = calloc(1, MAX_LINE_BUFFER+1);
+  int line_size = MAX_LINE_BUFFER;
+  int line_len;
+  m_nr = -1;        // expected sequence number (start with any)
+  long nr_alt = -1; // alternatively expected sequence number (if a line was injected)
+  long nr_alt_lineNumber = -1;
+  long nr_usr1_lineNumber = -1; // we may have lines written by a prev. qssign binary (while graceful restart)
+  while(fgets(line, line_size, stdin) != NULL) {
+    int valid = 0;
+    long msgSeqNr = 0;
+    int isOldProcess = 0;
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
+    HMAC_CTX hmac;
+    HMAC_CTX *hmac_p = &hmac;
+#else
+    HMAC_CTX *hmac_p;
+#endif
+    unsigned char data[HMAC_MAX_MD_CBLOCK];
+    unsigned int len;
+    char *m;
+    int data_len;
+    char *sig;
+    char *seq;
+    line_len = strlen(line) - 1;
+    while(line_len > 0) { // cut tailing CR/LF
+      if(line[line_len] >= ' ') {
+	break;
+      }
+      line[line_len] = '\0';
+      line_len--;
+    }
+    sig = strrchr(line, '#');
+    seq = strrchr(line, ' ');
+    lineNumber++;
+    if(seq && sig) {
+      sig[0] = '\0';
+      sig++;
+      /* verify hmac */
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
+      HMAC_CTX_init(hmac_p);
+#else
+      hmac_p = HMAC_CTX_new();
+#endif
+      HMAC_Init_ex(hmac_p, sec, sec_len, m_evp, NULL);
+      HMAC_Update(hmac_p, (const unsigned char *)line, strlen(line));
+      HMAC_Final(hmac_p, data, &len);
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
+      HMAC_CTX_cleanup(hmac_p);
+#else
+      HMAC_CTX_free(hmac_p);
+#endif
+      m = calloc(1, apr_base64_encode_len(len) + 1);
+      data_len = apr_base64_encode(m, (char *)data, len);
+      m[data_len] = '\0';
+      if(strcmp(m, sig) != 0) {
+	err++;
+	fprintf(stderr, "ERROR on line %ld: invalid signature\n", lineNumber);
+	/* message may be modified/corrupt or inserted: next line may have
+	   the next sequence number (modified) or the same (inserted) */
+	nr_alt = m_nr + 1;
+	nr_alt_lineNumber = lineNumber + 1;
+      } else {
+	valid = 1;
+      }
+      free(m);
+      /* verify sequence */
+      seq++;
+      msgSeqNr = atol(seq);
+      if(msgSeqNr == 0) {
+	err++;
+	fprintf(stderr, "ERROR on line %ld: invalid sequence\n", lineNumber);
+      } else {
+	if(m_nr != -1) {
+	  if(lineNumber == nr_alt_lineNumber) {
+	    // last line was modified
+	    if(m_nr != msgSeqNr) {
+	      // and therefore, we also accept the next sequence number
+	      m_nr = nr_alt;
+	    }
+	    nr_alt = -1;
+	    nr_alt_lineNumber = -1;
+	  }
+	  if(valid && isSpecialLine(line, QS_START)) {
+	    // new start line (graceful restart)
+	    // we expect now msg number 1
+	    // but still acept the old until we get the end marker
+	    nr_usr1_lineNumber = m_nr;
+	    m_nr = 1; 
+	  }
+	  if(valid && nr_usr1_lineNumber == msgSeqNr) {
+	    // msg from old process is okay...
+	    nr_usr1_lineNumber++;
+	    isOldProcess = 1;
+	  } else {
+	    if(m_nr != msgSeqNr) {
+	      if(msgSeqNr == 1) {
+		if(!end_seen) {
+		  err++;
+		  fprintf(stderr, "ERROR on line %ld: wrong sequence, server restart? (expect %."SEQDIG"ld)\n",
+			  lineNumber, m_nr);
+		}
+	      } else {
+		err++;
+		fprintf(stderr, "ERROR on line %ld: wrong sequence (expect %."SEQDIG"ld)\n", lineNumber, m_nr);
+	      }
+	    } else {
+	      // well done - this is the sequence number we expect
+	    }
+	  }
+	} else if(m_logend) {
+	  // log should (if not rotated) start with message 1
+	  if(msgSeqNr != 1) {
+	    fprintf(stderr, "NOTICE: log starts with sequence %."SEQDIG"ld, log rotation?"
+		    " (expect %."SEQDIG"d)\n", msgSeqNr, 1);
+	  }
+	}
+	if(valid && !isOldProcess) {
+	  // adjust
+	  m_nr = msgSeqNr;
+	}
+      }
+    } else {
+      err++;
+      fprintf(stderr, "ERROR on line %ld: missing signature/sequence\n", lineNumber);
+    }
+    end_seen = 0;
+    if(valid) {
+      if(!isOldProcess) {
+	m_nr++;
+      }
+      if(isSpecialLine(line, QS_END)) {
+	if(nr_usr1_lineNumber == -1) {
+	  end_seen = 1;
+	} else {
+	  nr_usr1_lineNumber = -1; // no more messages from an old process
+	}
+      }
+    }
+  }
+  if(m_logend && !end_seen) {
+    fprintf(stderr, "NOTICE: no end marker seen, log rotation? (expect %."SEQDIG"ld)\n", m_nr);
+  }
+  return err;
+}
+
+static void usage(char *cmd, int man) {
+  if(man) {
+    //.TH [name of program] [section number] [center footer] [left footer] [center header]
+    printf(".TH %s 1 \"%s\" \"mod_qos utilities %s\" \"%s man page\"\n", qs_CMD(cmd), man_date,
+	   man_version, cmd);
+  }
+  printf("\n");
+  if(man) {
+    printf(".SH NAME\n");
+  }
+  qs_man_print(man, "%s - an utility to sign and verify the integrity of log data.\n", cmd);
+  printf("\n");
+  if(man) {
+    printf(".SH SYNOPSIS\n");
+  }
+  qs_man_print(man, "%s%s -s|S <secret> [-e] [-v] [-u <name>] [-f <regex>] [-a 'sha1'|'sha256']\n", man ? "" : "Usage: ", cmd);
+  printf("\n");
+  if(man) {
+    printf(".SH DESCRIPTION\n");
+  } else {
+    printf("Summary\n");
+  }
+  qs_man_print(man, "%s is a log data integrity check tool. It reads log data\n", cmd);
+  qs_man_print(man, "from stdin (pipe) and writes the data to stdout adding a sequence\n");
+  qs_man_print(man, "number and signature to ever log line.\n");
+  printf("\n");
+  if(man) {
+    printf(".SH OPTIONS\n");
+  } else {
+    printf("Options\n");
+  }
+  if(man) printf(".TP\n");
+  qs_man_print(man, "  -s <secret>\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Passphrase used to calculate signature.\n");
+  if(man) printf("\n.TP\n");
+  qs_man_print(man, "  -S <program>\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Specifies a program which writes the passphrase to stdout.\n");
+  if(man) printf("\n.TP\n");
+  qs_man_print(man, "  -e\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Writes start/end marker when starting/stopping data signing.\n");
+  if(man) printf("\n.TP\n");
+  qs_man_print(man, "  -v\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Verification mode checking the integrity of signed data.\n");
+  if(man) printf("\n.TP\n");
+  qs_man_print(man, "  -u <name>\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Becomes another user, e.g. www-data.\n");
+  if(man) printf("\n.TP\n");
+  qs_man_print(man, "  -f <regex>\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Filter pattern (case sensitive regular expression) for messages\n");
+  qs_man_print(man, "     which do not need to be signed.\n");
+  if(man) printf("\n.TP\n");
+  qs_man_print(man, "  -a 'sha1'|'sha256'\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Specifies the algorithm to use. Default is sha1.\n");
+  printf("\n");
+  if(man) {
+    printf(".SH EXAMPLE\n");
+    printf("Sign:\n");
+    printf("\n");
+  } else {
+    printf("Example (sign):\n");
+  }
+  qs_man_println(man, " TransferLog \"|/usr/bin/%s -s password -e |/usr/bin/qsrotate -o /var/log/apache/access.log\"\n", cmd);
+  printf("\n");
+  if(man) {
+    printf("\n");
+    printf("Verify:\n");
+    printf("\n");
+  } else {
+    qs_man_print(man, "Example (verify):\n");
+  }
+  qs_man_println(man, " cat access.log | %s -s password -v\n", cmd);
+  printf("\n");
+  if(man) {
+    printf(".SH SEE ALSO\n");
+    printf("qsdt(1), qsexec(1), qsfilter2(1), qsgeo(1), qsgrep(1), qshead(1), qslog(1), qslogger(1), qspng(1), qsre(1), qsrespeed(1), qsrotate(1), qstail(1)\n");
+    printf(".SH AUTHOR\n");
+    printf("Pascal Buchbinder, http://mod-qos.sourceforge.net/\n");
+  } else {
+    printf("See http://mod-qos.sourceforge.net/ for further details.\n");
+  }
+  if(man) {
+    exit(0);
+  } else {
+    exit(1);
+  }
+}
+
+int main(int argc, const char * const argv[]) {
+  apr_pool_t *pool;
+  int verify = 0;
+  char *cmd = strrchr(argv[0], '/');
+  const char *username = NULL;
+  const char *filter = NULL;
+  if(cmd == NULL) {
+    cmd = (char *)argv[0];
+  } else {
+    cmd++;
+  }
+  apr_app_initialize(&argc, &argv, NULL);
+  apr_pool_create(&pool, NULL);
+  m_evp = EVP_sha1();
+  argc--;
+  argv++;
+  while(argc >= 1) {
+    if(strcmp(*argv,"-s") == 0) {
+      if (--argc >= 1) {
+	m_sec = *(++argv);
+      }
+    } else if(strcmp(*argv,"-S") == 0) {
+      if (--argc >= 1) {
+	m_sec = qs_readpwd(pool, *(++argv));
+      } 
+    } else if(strcmp(*argv,"-v") == 0) {
+      verify = 1;
+    } else if(strcmp(*argv,"-e") == 0) {
+      m_logend = 1;
+    } else if(strcmp(*argv,"-u") == 0) { /* switch user id */
+      if (--argc >= 1) {
+        username = *(++argv);
+      }
+    } else if(strcmp(*argv,"-f") == 0) { /* filter */
+      if (--argc >= 1) {
+        filter = *(++argv);
+      }
+    } else if(strcmp(*argv,"-a") == 0) { /* set alg */
+      if (--argc >= 1) {
+        const char *alg = *(++argv);
+	if(strcasecmp(alg, "SHA256") == 0) {
+	  m_evp = EVP_sha256();
+	} else if(strcasecmp(alg, "SHA1") != 0) {
+	  m_evp = NULL;
+	}
+      } else {
+	m_evp = NULL;
+      }
+    } else if(strcmp(*argv,"-?") == 0) {
+      usage(cmd, 0);
+    } else if(strcmp(*argv,"-help") == 0) {
+      usage(cmd, 0);
+    } else if(strcmp(*argv,"--help") == 0) {
+      usage(cmd, 0);
+    } else if(strcmp(*argv,"--man") == 0) {
+      usage(cmd, 1);
+    }
+    argc--;
+    argv++;
+  }
+
+  if(filter != NULL) {
+    m_filter = apr_palloc(pool, sizeof(qs_regex_t));
+    if(qs_regcomp(m_filter, filter, 0) != 0) {
+      fprintf(stderr, "failed to compile filter pattern <%s>\n", filter);
+      exit(1);
+    }
+    apr_pool_pre_cleanup_register(pool, m_filter, qs_pregfree);
+  }
+
+  if(m_evp == NULL) {
+    usage(cmd, 0);
+  }
+    
+  if(m_sec == NULL) {
+    usage(cmd, 0);
+  }
+
+  qs_setuid(username, cmd);
+
+  if(verify) {
+    long err = qs_verify(m_sec);
+    if(err != 0) {
+      return 1;
+    }
+  } else {
+    if(m_logend) {
+      signal(SIGTERM, qs_signal_exit);
+    }
+    qs_sign(m_sec);
+    if(m_logend && (m_end != NULL)) {
+      m_end(m_sec, 0);
+    }
+  }
+
+  apr_pool_destroy(pool);
+  return 0;
+}
diff --git a/tools/src/qstail.c b/tools/src/qstail.c
new file mode 100644
index 0000000..3d535e2
--- /dev/null
+++ b/tools/src/qstail.c
@@ -0,0 +1,237 @@
+/* -*-mode: c; indent-tabs-mode: nil; c-basic-offset: 2; -*-
+ */
+/**
+ * Utilities for the quality of service module mod_qos.
+ *
+ * qstail.c: Shows the end of a log file beginning at the
+ * provided pattern.
+ *
+ * See http://mod-qos.sourceforge.net/ for further
+ * details.
+ *
+ * Copyright (C) 2023 Pascal Buchbinder
+ *
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+static const char revision[] = "$Id: qstail.c 2654 2022-05-13 09:12:42Z pbuchbinder $";
+
+#include <stdio.h>
+#include <unistd.h>
+#include <string.h>
+#include <stdlib.h>
+#include <signal.h>
+
+#include "qs_util.h"
+
+#define BUFFER 2048
+
+static void usage(char *cmd, int man) {
+  if(man) {
+    //.TH [name of program] [section number] [center footer] [left footer] [center header]
+    printf(".TH %s 1 \"%s\" \"mod_qos utilities %s\" \"%s man page\"\n", qs_CMD(cmd), man_date,
+	   man_version, cmd);
+  }
+  printf("\n");
+  if(man) {
+    printf(".SH NAME\n");
+  }
+  qs_man_print(man, "%s - an utility printing the end of a log file"
+               " starting at the specified pattern.\n", cmd);
+  printf("\n");
+  if(man) {
+    printf(".SH SYNOPSIS\n");
+  }
+  qs_man_print(man, "%s%s -i <path> -p <pattern>\n", man ? "" : "Usage: ", cmd);
+  printf("\n");
+  if(man) {
+    printf(".SH DESCRIPTION\n");
+  } else {
+    printf("Summary\n");
+  }
+  qs_man_print(man, " %s shows the end of a log file beginning with the line containing the\n", cmd);
+  qs_man_print(man, " specified pattern. This may be used to show all lines which has been written\n");
+  qs_man_print(man, " after a certain event (e.g., server restart) or time stamp.\n");
+  printf("\n");
+  if(man) {
+    printf(".SH OPTIONS\n");
+  } else {
+    printf("Options\n");
+  }
+  if(man) printf(".TP\n");
+  qs_man_print(man, "  -i <path>\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Input file to read the data from.\n");
+  if(man) printf("\n.TP\n");
+  qs_man_print(man, "  -p <pattern>\n");
+  if(man) printf("\n");
+  qs_man_print(man, "     Search pattern (literal string).\n");
+  printf("\n");
+  if(man) {
+    printf(".SH SEE ALSO\n");
+    printf("qsdt(1), qsexec(1), qsfilter2(1), qsgeo(1), qsgrep(1), qshead(1), qslog(1), qslogger(1), qspng(1), qsre(1), qsrespeed(1), qsrotate(1), qssign(1)\n");
+    printf(".SH AUTHOR\n");
+    printf("Pascal Buchbinder, http://mod-qos.sourceforge.net/\n");
+  } else {
+    printf("See http://mod-qos.sourceforge.net/ for further details.\n");
+  }
+  if(man) {
+    exit(0);
+  } else {
+    exit(1);
+  }
+}
+
+/* search the beginning of the line starting at the provided position */
+static void qs_readline(long pos, FILE *f) {
+  size_t len;
+  long startpos = pos - BUFFER + 1;
+  long readlen = BUFFER;
+  char line[readlen + 1];
+  if(startpos < 0) {
+    // we are at the beginning of the file
+    startpos = 0;
+    readlen = pos + 1;
+  }
+  fseek(f, startpos, SEEK_SET);
+  len = fread(&line, 1, readlen, f);
+  if(len > 0) {
+    char *s = &line[len-1];
+    line[len] = '\0';
+    while((s >= line) && (s[0] != CR) && (s[0] != LF)) {
+      s--;
+    }
+    if((s[0] == CR) || (s[0] == LF)) {
+      s++;
+    }
+    printf("%s", s);
+  }
+}
+
+static int qs_tail(const char *cmd, FILE *f, const char *pattern) {
+  char *cont = NULL;
+  long search_win_len = (strlen(pattern) * 2) + 32;
+  char line[search_win_len + 10];
+  long pos = 0;
+  size_t len;
+  char *startpattern = NULL;
+  fseek(f, 0L, SEEK_END);
+  pos = ftell(f);
+  while(pos > search_win_len) {
+    int offset = 0;
+    pos = pos - (search_win_len/2);
+    fseek(f, pos, SEEK_SET);
+    len = fread(&line, 1, search_win_len, f);
+    if(len <= 0) {
+      /* pattern not found / reached end */
+      return 1;
+    }
+    line[len] = '\0';
+    if((startpattern = strstr(line, pattern)) != NULL) {
+      int containsend = 0;
+      char *s = startpattern;
+      char *end;
+      offset = startpattern - line;
+      /* search the beginning of the line */
+      while((s > line) && (s[0] != CR) && (s[0] != LF)) {
+        s--;
+      }
+      if((s[0] != CR) && (s[0] != LF)) {
+        // beginning of the line not in the buffer
+        qs_readline(pos, f);
+      }
+      s++;
+      end = startpattern;
+      /* search the end of the line */
+      while((offset < search_win_len) && end[0] && end[0] != CR && end[0] != LF) {
+        end++;
+        offset++;
+      }
+      /* print the line containing the pattern */
+      if((end[0] == CR) || (end[0] == LF)) {
+        end[0] = '\0';
+        printf("%s\n", s);
+        containsend = 1;
+      } else {
+        printf("%s", s);
+      }
+      fseek(f, pos + offset, SEEK_SET);
+      if(containsend) {
+        // skip the line at the  current position
+        cont = fgets(line, sizeof(line), f);
+      } else {
+        cont = line;
+      }
+      if(cont) {
+        while(fgets(line, sizeof(line), f) != NULL) {
+          printf("%s", line);
+        }
+      }
+      return 0;
+    }
+  }
+  return 1;
+}
+
+int main(int argc, const char * const argv[]) {
+  FILE *f;
+  const char *filename = NULL;
+  const char *pattern = NULL;
+  char *cmd = strrchr(argv[0], '/');
+  int status = 0;
+  if(cmd == NULL) {
+    cmd = (char *)argv[0];
+  } else {
+    cmd++;
+  }
+
+  argc--;
+  argv++;
+  while(argc >= 1) {
+    if(strcmp(*argv,"-i") == 0) {
+      if (--argc >= 1) {
+	filename = *(++argv);
+      }
+    } else if(strcmp(*argv,"-p") == 0) {
+      if (--argc >= 1) {
+	pattern = *(++argv);
+      } 
+    } else if(strcmp(*argv,"-?") == 0) {
+      usage(cmd, 0);
+    } else if(strcmp(*argv,"-help") == 0) {
+      usage(cmd, 0);
+    } else if(strcmp(*argv,"--help") == 0) {
+      usage(cmd, 0);
+    } else if(strcmp(*argv,"--man") == 0) {
+      usage(cmd, 1);
+    }
+    argc--;
+    argv++;
+  }
+
+  if(filename == NULL || pattern == NULL) {
+    usage(cmd, 0);
+  }
+  if((f = fopen(filename, "r")) == NULL) {
+    fprintf(stderr, "[%s]: ERROR, could not open file '%s'\n", cmd, filename);
+    exit(1);
+  }
+  
+  status = qs_tail(cmd, f, pattern);
+
+  fclose(f);
+  return status;
+}