title: Apache modsecurity: limit requests per resource per second
body: <p>I'm trying to configure modsecurity for Apache to limit the number of requests to the same resource per unit of time: 10 hits per second per resource, no matter which ip address does the request. It is desirable do not block extra calls but redirect to a given page.</p>
  
  <p>I included module and placed next code in httpd.conf: </p>
  
  <pre><code>&lt;LocationMatch "(.*)\.dimg(.*)"&gt;
    SecDebugLogLevel 9
    SecAction phase:2,initcol:resource=%{REQUEST_URI},pass,nolog,id:132
    SecRule RESOURCE:COUNT "@gt 10" "phase:2,pause:300,deny,status:503,setenv:RATELIMITED,skip:1,nolog,id:102"
    SecAction "phase:2,setvar:resource.count=+1,pass,nolog,id:103"
    SecAction "phase:5,deprecatevar:resource.count=10/1,pass,nolog,id:104"
    Header always set Retry-After "10" env=RATELIMITED
    ErrorDocument 503 "Service Unavailable"
  </code></pre>
  
  <p></p>
  
  <p>Then I run stress test to simulate high load.
  But extra requests are not blocked. 
  From logs:
  Recorded original collection variable: resource.count = "0" </p>
  
  <p>As a result SecRule RESOURCE:COUNT "@gt 10" returns false for any request.</p>
  
  <p>What is wrong here?</p>