I attempted to install and use the evasive module, but it seems completely
dysfunctional. I couldn't get it to at least output something to a log file or
send a mail. I tested with the standard config and with the instructions found
at https://wiki.debian.org/fr/Apache/mod_evasive. I am sure that the config did
not contain an issue. I confirmed that the module was loaded. The logs didn't
show anything at all.

Is it possible that this module is no longer functional with the Apache version
in Trixie?

Regards, Daniel


- -- System Information:
Debian Release: forky/sid
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'oldstable-updates'), (500, 'oldstable-security'), (500, 'oldoldstable-updates'), (500, 'oldoldstable-security'), (500, 'oldoldstable'), (500, 'unstable'), (500, 'testing'), (500, 'stable'), (500, 'oldstable'), (1, 'experimental')
Architecture: amd64 (x86_64)

Kernel: Linux 6.17.7+deb14+1-amd64 (SMP w/16 CPU threads; PREEMPT)
Kernel taint flags: TAINT_OOT_MODULE
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEvu1N7VVEpMA+KD3HS80FZ8KW0F0FAmkfm3kACgkQS80FZ8KW
0F0GSxAAufqvnge7cZd6KMTL9RgiFXXlfjZ7fxhnsFuUJMHrMf5fzB/s+5rEDG6j
5+okZWaQAA573KhrdHHpzQXRLE1JRyrcrOWe6eIuzDq7L+7nKH31YgUxZnKasU0R
xKiAR/lS8+WkTzp7nL577RgF/fXV3KDDTQ1g9K5qCzLedlDsaWsa+/FkOTRRMA2e
MPrdL6N+DagZQzLXJnqKPUtBanp6Bhh7Eq6OrhjUP9oVnmKlsD2HH2AwHYG5+KZo
0V6Xnb/czAy9lykBHzNZ6AIk5O9mBqUQ/zN3vxFx2QGOFeImrnwYk5ff6lHy7WAo
BLnvw2Iz6Mldv4JuL2aWuisIo2DVBUISfu8ERWJPG9kMpyJSi0hYotzyuvJEbFru
g1mng/nXN7H03NEK+zGFSus0/OVVgMIgOHEGUOBp6SuScv5uNDZDSyzyP8KL9Gi1
JrU1iWtbgfEM25RSL1eeWMCewuhIX3gX2emPsy225yRL6vRzaC0I2eNRBnqWgWrS
ILjwbeQEi0T4Vz9qtjSIe2AtuxEs5BDOi0CRQTaiwuFnFFlZ2yiP/pR22s7VY/fC
VN88C1VZnsjze/T1ZtBq4sRF8uG0gl98CF+v3DfpOJBgWLpayHNiVFrytQDV/1tm
w1xDS7XqVdWjEIR9kKYT2JXiREv3yAvAZxkoZhsZcQTilBXxMds=
=Sb3L
-----END PGP SIGNATURE-----

control: severity -1 normal
control: tags -1 moreinfo unreproducible

Works for me (tm).

What is the output of `apache2ctl -M | grep -i evasive`?

Also you could perform a DOS yourself via `ab -c 50 -n 1000
http[s]://example.org/` (with ab from the package apache2-utils).

Hi Christian,

I have already replaced it with the qos module. However, I can answer
your questions:

That one showed "evasive" as output. It was one of the first steps to
confirm that the module was loaded.

I did with the exact same values from multiple servers and from
localhost. There was no reaction, no block, no log entry. I debugged
this for over an hour without getting evasive to work.

The server in question only provides some static sites. Thus, nothing
fancy here.

May I asked if you have tested under Trixie or Sid?

Regards, Daniel

Hi,

I had no knowledge of the french documentation in the Debian Wiki for
mod_evasive, but after briefly checking it, I have to conclude that it
seems at least a bit outdated. It's hard to maintain proper documentation
at multiple locations. In my opinion, it would be wiser to keep the Debian
Wiki entry very short and simple, preferably only linking to the correct
documentation page and not attempting to provide any details that might
become outdated with future updates.

Please find up-to-date documentation at https://github.com/jvdmr/mod_evasive
(in English, sorry!)

One detail I notice is that the Debian wiki's 'proposed reference' tells
you to use `<IfModule mod_evasive20.c>`, which I'm pretty sure should be
`<IfModule mod_evasive.c>`. This might actually be the entire solution to
your problem.

Hope that helps!
--
Kind regards,
jvdmr


On Sat, Nov 22, 2025 at 2:35 PM Daniel Leidert < dleidert_at_debian_org_sfhyf1b9mwcndf_82vt0317@icloud.com> wrote:

Am Montag, dem 24.11.2025 um 11:15 +0100 schrieb Christian Göttsche:

[..]

I tried with that originally. Then I tried with <IfModule
mod_evasive20.c> as well.

I used multiple documentation sources until I exhausted all options.

At this point, it seems to make most sense to set this up on a test
system again.

Regards, Daniel

Any update on this issue, has it been resolved on your side?

Hello,

I have encountered a similar situation, while upgrading all the way from
buster to trixie. From buster to bookworm was OK but in trixie
mod_evasive was not working under the same circunstancies.

Also, I did double check the configuration (mod_evasive/mod_evasive20).
After "forward porting" 1.10.1-5 to trixie (built with
libapache-mod-evasive_1.10.1-5.dsc) and adjusting back the conf it does
work. 2.4.0-3 was also not working.

(As a side note, one thing that seems to be stuck at 5s whatever the
conf is DOSBlockingPeriod, though.)

Hope this helps.

Best regards,
Filipe