It appears that the ModSecurity module sometimes fails to increment an integer in persistent storage when many concurrent transactions are sent to the Apache web server.

Create setup using configuration in this issue Description. Run load test using this script: #!/bin/bash for i in `seq 1 1000`; do curl -b "SESSIONID=testid" localhost/index.html &>/dev/ null & done You can either check the SecDebugLog or use the modsec-sdbm-util ( https://github.com/SpiderLabs/modsec-sdbm-util/ ) to check the final count. grep 'collection_store: Wrote variable: name "my_counter"' | tail -n1 OR modsec-sdbm-util -du /dev/shm/modsec/default_SESSION modsec-sdbm-util -du /dev/shm/modsec/global If you have reproduced the issue, the final count will not be equal to the number of requests received by httpd. In my local testing, I would occasionally overload the httpd server and it was not able to receive all of the requests I sent. So, make sure you are not simply comparing the number of requests you sent to the final counter value. Make sure you check the number of request actually received into httpd against the final counter value.