Delay error response or exclude them from logging

[Falco]

Hi,
My users have a concurrent connection limit and I did reserve one connection over limit for them to respond with a nice error page instead of dropping their requests. Requests are only dropped if they are 2 connections over limit.
So far it does work very well with mod qos by using the QS_ClientEventRequestLimit based on connection count.
Now I don’t want to get to many log entries for hitting the connection limit.
I would delay them by 5s or exclude them from Logging. But I could not configure any of these ideas.

Idea one: Delay
QS_Delay did not get applied on requests which are hitting ClientEventRequestLimit

Idea two: Exclude from logging by env
QS_ErrorResponseCode 429 could not be queried by SetEnvIf status_code = 429 dontlog and CustomLog based on env=! dontlog. That means I don’t know who do exclude them from logging. But at least I’m able to create empty log lines by logformat %!429.

Idea three: Exclude from logging by expr
Maybe I would work by using expr parameter of custom log but I don’t know how to access QS_IPConn in apache expressions.

Do you have an idea how to exclude them from logging or how to apply a delay to reduce the amount of logs? Even QS_LocRequestPerSecLimit / 1 did not get applied on requests which are marked as ClientEventRequestLimit.

Kind Regards
Falco

[Pascal Buchbinder]

The followign figure shows you the order by which the functions are processed: http://mod-qos.sourceforge.net/images/mod_qos_seq.gif (QS_Delay comes after QS_ClientEventRequestLimit and hence can't be used).

If you want filter log messages, why not add one using piped logging, e.g., a perl script implementing the necessary logic or a simple "grep -v" to not log the unwanted messages?

 ErrorLog "|grep -v QS_ClientEventRequestLimit |/usr/bin/qsrotate -o /var/log/apache/error.log"

[Falco]

That is superb, I didn't know that you can include stream processing into the logging configuration. Thank you. Don't know why people still use gracefull reload to release rotatet logs.