QSEXEC(1)

📦
version 11.74 · 2 versions
, in epel 9, ubuntu noble

💖 QSEXEC 💖

okay so bestie, welcome to qsexec(1) — she's a mod_qos utility and she's literally the group chat moderator of your logs. say hi 👋

✨ NAME ✨

qsexec — parses the data received via stdin and executes the defined command on a pattern match.

like, she reads your logs, she spots the vibe she's looking for, and then she acts. main character energy fr. 🎀

🌸 SYNOPSIS 🌸

qsexec -e <pattern> [-t <number>:<sec>] [-c <pattern> [<command
string>]] [-p] [-u <user>] <command string>

🦋 DESCRIPTION 🦋

qsexec reads log lines from stdin and searches for the defined pattern. It executes the defined command string on pattern match.

that's it, that's the whole personality. she's a listener, she's a looker, and when she sees what she's looking for she POUNCES. 💅

💜 OPTIONS 💜

  • -e <pattern> — Specifies the search pattern causing an event which shall trigger the command.

this is the pattern, the one she's obsessed with. when it shows up, it's an event, and events trigger commands. no notes. ✨

  • -t <number>:<sec> — Defines the number of pattern match within the the defined number of seconds in order to trigger the command execution. By default, every pattern match causes a command execution.

so like… number matches inside sec seconds = we go. rate-limiting but make it a vibe check. and yeah, the original really does say "within the the" — we don't gatekeep typos here, we preserve them. 🫶 default behaviour is every single match fires the command, no chill whatsoever.

  • -c <pattern> [<command string>] — Pattern which clears the event counter. Executes optionally a command if an event command has been executed before.

the reset button bestie. this pattern wipes the counter clean. and if you hand her a command string too, she'll run it — but only if an event command actually ran before. conditional queen. 👑

  • -p — Writes data also to stdout (for piped logging).

she'll still pass the data along to stdout so your piped logging doesn't lose a single crumb. sharing is caring. 🌈

  • -u <name> — Become another user, e.g. www-data.

glow-up into someone else. drop privileges, become www-data, live your truth. 🧚

  • <command string> — Defines the event command string where $0-$9 are substituted by the submatches of the regular expression.

your command goes here, and the regex submatches slide right in as $0-$9. it's giving mad libs but for sysadmin. 😭

🔥 EXAMPLE 🔥

Executes the deny.sh script providing the IP address of the client causing a mod_qos(031) messages whenever the log message appears 10 times within at most one minute:

ErrorLog "|/usr/bin/qsexec -e \'mod_qos\(031\).*, c=([0-9a-zA-Z:.]*)\'
-t 10:60 \'/usr/local/bin/deny.sh $1\'"

okay so read it with me: that's a mod_qos(031) situation, the client IP gets scooped up by the capture group, and if it happens 10 times in 60 seconds? deny.sh gets that $1 and the problem is handled. iconic behaviour, honestly. ⭐

🌟 SEE ALSO 🌟

qsdt(1), qsfilter2(1), qsgeo(1), qsgrep(1), qshead(1), qslog(1), qslogger(1), qspng(1), qsre(1), qsrespeed(1), qsrotate(1), qssign(1), qstail(1)

the whole mod_qos friend group 💖 go say hi to all of them.

👑 AUTHOR 👑

Pascal Buchbinder, http://mod-qos.sourceforge.net/

and that's the page bestie! no cap, you now know qsexec better than most people know their own passwords. go forth and pattern-match. 🦋

this little gem is part of the mod_qos utilities, version 11.74, dated May 2023 — xoxo, take care of her, she takes care of your logs 💅✨

📦 where this page comes from