This page describes definition of 'TX' as following: "This is the transient transaction collection, which is used to store pieces of data, create a transaction anomaly score, and so on. The variables placed into this collection are available only until the transaction is complete."

In modsecurity we also can frequently see another collection, 'tx', such as following rule:


    "phase:2, rev:'2', ver:'OWASP_CRS/2.2.9', maturity:'8', accuracy:'8', capture, t:none, t:htmlEntityDecode, t:compressWhiteSpace, t:lowercase, ctl:auditLogParts=+E, block, msg:'Cross-site Scripting (XSS) Attack', id:'958418', tag:'OWASP_CRS/WEB_ATTACK/XSS', tag:'WASCTC/WASC-8', tag:'WASCTC/WASC-22', tag:'OWASP_TOP_10/A2', tag:'OWASP_AppSensor/IE1', tag:'PCI/6.5.1', logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}', severity:'2', setvar:'tx.msg=%{rule.msg}', setvar:tx.xss_score=+%{tx.critical_anomaly_score}, setvar:tx.anomaly_score=+%{tx.critical_anomaly_score}, setvar:tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/XSS-%{matched_var_name}=%{tx.0}"

Why are there two similar collections used? Why no just using 'TX'?

  • 1
    Have you looked this up? The ModSecurity documentation appears to equate TX and tx: blog.modsecurity.org/2007/12/using-transacti.html
    – schroeder
    Apr 25, 2016 at 14:33
  • From below comment in modsecurity source code, tx is a special case for TX. But I do not understand it. /* Locate the collection. / if (strcasecmp(col_name, "tx") == 0) { / Special case for TX variables. */ target_col = msr->tx_vars; }
    – appleleaf
    Apr 26, 2016 at 4:47

1 Answer 1


tx and TX are the same collections, without case sensitive, in my view it is a writing pattern when a conditional argument of the rule is uppercase, when the assignment is made in lowercase.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .