whats the number of times the letter g appears in:
q: already enabled x-forwarded for in haproxy, but mod_remoteip 2.2 backport still doesnt work im using haproxy to forward requests to apache 2.2 bundled with modsecurity 2.7 and owasp_crs. i have enabled insertion of the x-forwarded-for header in the haproxy config:
defaults:
option forwardfor except 127.0.0.1 header x-forwarded-for

in mod_audit.log the real ip address is shown in x-forwarded header:
--06f84712-b--
get /item/820 http/1.1
host: myownsite.com
accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
from: googlebot(at)googlebot.com
accept-encoding: gzip,deflate
user-agent: ......
x-forwarded-for: 66.249.35.164
connection: close

but in error_log file, all of the logs still have my server ip logged instead of the real client ip:
    [fri oct 23 12:55:57 2015] [error] [client mylocalipaddress] 
modsecurity: access denied with code 403 (phase 2). 
pattern match <(a|abbr|acronym|address|applet|area|audioscope|b|base|basefront|bdo|bgsound|big|blackface|blink|blockquote|body|bq|br|button|caption|center|cite|code|col|colgroup|comment|dd|del|dfn|dir|div|dl|dt|em|embed|fieldset|fn|font|form|frame|frameset|h1|head|h ... at args:type. 
[file /etc/httpd/crs-tecmint/owasp-modsecurity-crs/base_rules/modsecurity_crs_41_xss_attacks.conf] [line 301] [id 973300] [rev 2] [msg possible xss attack detected - html tag handler] [data matched data: <div> found within args:page_type: <div>] [ver owasp_crs/2.2.9] [maturity 8] [accuracy 8] [tag owasp_crs/web_attack/xss] [tag wasctc/wasc-8] [tag wasctc/wasc-22] [tag owasp_top_10/a2] [tag owasp_appsensor/ie1] [tag pci/6.5.1] [hostname myownsite] [uri /item/31] [unique_id vim93dj1xswaafz0akoaaaab]

i have enabled the mod_remoteip-httpd22 module but no real clients ips have been logged in the error_log file. can anyone tell me if there is something missing?
heres the config for mod_remoteip
loadmodule remoteip_module modules/mod_remoteip.so
remoteipheader x-forwarded-for
remoteipinternalproxy 127.0.0.1


a: ive pinned down the problem after hours of trying to understand how these things work. 
in haproxy config, i found that the ip from the backend apache isnt in accord with the mod_remote_ip setting. 
backend apache2

    *****
                    // think of this ip as my real server ip
    server apache2 214.4.334.1:3001 weight 1 maxconn 1024 check

    *****

instead, i should use 127.0.0.1 as the ip address:
backend apache2

    *****

    server apache2 127.0.0.1:3001 weight 1 maxconn 1024 check

    *****

when a request is forwarded to apache by haproxy, the mod_remote_ip would check whether the incoming ip is the proxy ip 127.0.0.1. if that is, it will use the ip in x-forwarded for instead in the error_log file. 
[error] [client myrealip] modsecurity: access denied with code 403


user
In that passage, there are 43 occurrences of the letter "g."
assistant