1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
|
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<HTML><HEAD><TITLE>Man page of QSEXEC</TITLE>
<META name='KeyWords' content='Quality of Service, QoS, Apache Web Server, Web application security, WAF, Open Source Software, Security, Proxy'/>
<META name='author' content='Pascal Buchbinder' />
</HEAD><BODY>
<H1>QSEXEC</H1>
Section: qsexec man page (1)<BR>Updated: May 2023<BR><A HREF="#index">Index</A>
<A HREF="index.html#utilities">Return to Main Contents</A><HR>
<P>
<A NAME="lbAB"> </A>
<H2>NAME</H2>
qsexec - parses the data received via stdin and executes the defined command on a pattern match.
<P>
<A NAME="lbAC"> </A>
<H2>SYNOPSIS</H2>
qsexec -e <pattern> [-t <number>:<sec>] [-c <pattern> [<command string>]] [-p] [-u <user>] <command string>
<A NAME="lbAD"> </A>
<H2>DESCRIPTION</H2>
qsexec reads log lines from stdin and searches for the defined pattern. It executes the defined command string on pattern match.
<A NAME="lbAE"> </A>
<H2>OPTIONS</H2>
<DL COMPACT>
<DT>-e <pattern> <DD>
Specifies the search pattern causing an event which shall trigger the command.
<DT>-t <number>:<sec> <DD>
Defines the number of pattern match within the the defined number of seconds in order to trigger the command execution. By default, every pattern match causes a command execution.
<DT>-c <pattern> [<command string>] <DD>
Pattern which clears the event counter. Executes optionally a command if an event command has been executed before.
<DT>-p <DD>
Writes data also to stdout (for piped logging).
<DT>-u <name> <DD>
Become another user, e.g. www-data.
<DT><command string> <DD>
Defines the event command string where $0-$9 are substituted by the submatches of the regular expression.
</DL>
<A NAME="lbAF"> </A>
<H2>EXAMPLE</H2>
Executes the deny.sh script providing the IP address of the client causing a mod_qos(031) messages whenever the log message appears 10 times within at most one minute:
<BR> ErrorLog "|/usr/bin/qsexec -e \'mod_qos\(031\).*, c=([0-9a-zA-Z:.]*)\' -t 10:60 \'/usr/local/bin/deny.sh $1\'"
<P>
<A NAME="lbAG"> </A>
<H2>SEE ALSO</H2>
<A HREF="qsdt.1.html">qsdt</A>(1), <A HREF="qsfilter2.1.html">qsfilter2</A>(1), <A HREF="qsgeo.1.html">qsgeo</A>(1), <A HREF="qsgrep.1.html">qsgrep</A>(1), <A HREF="qshead.1.html">qshead</A>(1), <A HREF="qslog.1.html">qslog</A>(1), <A HREF="qslogger.1.html">qslogger</A>(1), <A HREF="qspng.1.html">qspng</A>(1), <A HREF="qsre.1.html">qsre</A>(1), <A HREF="qsrespeed.1.html">qsrespeed</A>(1), <A HREF="qsrotate.1.html">qsrotate</A>(1), <A HREF="qssign.1.html">qssign</A>(1), <A HREF="qstail.1.html">qstail</A>(1)
<A NAME="lbAH"> </A>
<H2>AUTHOR</H2>
Pascal Buchbinder, <A HREF="http://mod-qos.sourceforge.net/">http://mod-qos.sourceforge.net/</A>
<P>
<HR>
<A NAME="index"> </A><H2>Index</H2>
<DL>
<DT><A HREF="#lbAB">NAME</A><DD>
<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
<DT><A HREF="#lbAE">OPTIONS</A><DD>
<DT><A HREF="#lbAF">EXAMPLE</A><DD>
<DT><A HREF="#lbAG">SEE ALSO</A><DD>
<DT><A HREF="#lbAH">AUTHOR</A><DD>
</DL>
<HR>
</BODY>
</HTML>
|
