SecDebugLog /dev/stdout
SecDebugLogLevel 9


SecRule REQUEST_HEADERS:User-Agent ".*" "id:1,phase:1,t:sha1,t:hexEncode,setvar:tx.ua_hash=%{MATCHED_VAR}"

SecAction "phase:2,initcol:ip=%{REMOTE_ADDR}_%{tx.ua_hash}"

SecRule REQUEST_HEADERS:User-Agent ".*" "id:2,phase:2,setvar:ip.auth_attempt=+1"

SecRule ARGS:foo "herewego" "id:3,phase:2,setvar:ip.foo=bar"
SecRule IP "bar" "id:4,phase:2"
SecRule IP:auth_attempt "bar" "id:5,phase:2"