You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by "Ian M. Evans" <ia...@digitalhit.com> on 2002/08/27 09:52:17 UTC
[users@httpd] URGENT: Getting hammered by an adsl user...logs growing...
In the past few hrs., we've rec'd over 200,000 requests from an IP that
appears to be a Belgian ADSL users. It's the same page request over and over
except each subsequent request seems to have an additional '/1' appended to
it so the URL gets longer and longer.
I've denied the IP, but now both my error and access logs are ballooning.
What can I do so I can actually go to bed without waking up to a lack of
diskspace?
Thanks.
--
Ian Evans
Chairman & Executive Producer
Digital Hit Entertainment
http://www.digitalhit.com
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] URGENT: Getting hammered by an adsl user...logs growing...
Posted by Zac Stevens <zt...@cryptocracy.com>.
Hi Ian,
On Tue, Aug 27, 2002 at 03:52:17AM -0400, Ian M. Evans wrote:
> I've denied the IP, but now both my error and access logs are ballooning.
> What can I do so I can actually go to bed without waking up to a lack of
> diskspace?
Check out the notes on conditional logging here:
http://httpd.apache.org/docs/logs.html#conditional
As long as mod_log_config is available, you will be able to follow the
instructions there.
HTH,
Zac
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
RE: [users@httpd] URGENT: Getting hammered by an adsl user...logs growing...
Posted by "Ian M. Evans" <ia...@digitalhit.com>.
>you could rename the existing log file and gzip it.
Thanks for the suggestion. Alas, the logs are growing about a meg a minute.
Tried contacting Interland and their support site is down...and I'm about 5
hrs past when I should be sleeping. :-(
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] URGENT: Getting hammered by an adsl user...logs growing...
Posted by dale's stuff <st...@colony.net>.
Hello Ian,
You mentioned in a later post that you were able to stop and restart apache.
In that case, while it isn't a long term solution, when you stop apache
you could rename the existing log file and gzip it.
Then apache will create a new log file. While this isn't the best solution,
it will at least let you compress the existing log file for now until your
co-loc can take positive action.
Dale
On Tuesday, August 27, 2002, at 09:52 AM, Ian M. Evans wrote:
> In the past few hrs., we've rec'd over 200,000 requests from an IP that
> appears to be a Belgian ADSL users. It's the same page request over and
> over
> except each subsequent request seems to have an additional '/1' appended
> to
> it so the URL gets longer and longer.
>
> I've denied the IP, but now both my error and access logs are ballooning.
> What can I do so I can actually go to bed without waking up to a lack of
> diskspace?
>
> Thanks.
>
> --
> Ian Evans
> Chairman & Executive Producer
> Digital Hit Entertainment
> http://www.digitalhit.com
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
RE: [users@httpd] URGENT: Getting hammered by an adsl user...logs growing...
Posted by Koen Vingerhoets <ko...@ubench.com>.
If you tell me where he lives i'll drive over there and slap him/her :)
Koen
-----Original Message-----
From: Ian M. Evans [mailto:ianevans@digitalhit.com]
Sent: 27 August 2002 09:52
To: users@httpd.apache.org
Subject: [users@httpd] URGENT: Getting hammered by an adsl user...logs
growing...
In the past few hrs., we've rec'd over 200,000 requests from an IP that
appears to be a Belgian ADSL users. It's the same page request over and over
except each subsequent request seems to have an additional '/1' appended to
it so the URL gets longer and longer.
I've denied the IP, but now both my error and access logs are ballooning.
What can I do so I can actually go to bed without waking up to a lack of
diskspace?
Thanks.
--
Ian Evans
Chairman & Executive Producer
Digital Hit Entertainment
http://www.digitalhit.com
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
RE: [users@httpd] URGENT: Getting hammered by an adsl user...logs growing...
Posted by "Ian M. Evans" <ia...@digitalhit.com>.
>Are you sure your SetEnvIf directive contains the IP address of the
100%
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] URGENT: Getting hammered by an adsl user...logs growing...
Posted by Zac Stevens <zt...@cryptocracy.com>.
On Tue, Aug 27, 2002 at 04:38:25AM -0400, Ian M. Evans wrote:
> I edited the IP and added the line
> CustomLog /var/log/httpd/access_log combined env=!dontlog
>
> in my vhosts.conf as per your suggestion, restarted apache and it appears
> not be working. Knowing my host...Interland...they probably don't have all
> the modules installed.
Possibly, however I would have expected httpd to choke on startup as it
wouldn't recognise the 'CustomLog' directive without mod_log_config in the
server.
Are you sure your SetEnvIf directive contains the IP address of the problem
client?
Zac
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
RE: Re[2]: [users@httpd] URGENT: Getting hammered by an adsl user...logs growing...
Posted by "Ian M. Evans" <ia...@digitalhit.com>.
>Can't you block the IP in the firewall, or if you have none, with
>iptables?
We're on a shared server with no access to either.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re[2]: [users@httpd] URGENT: Getting hammered by an adsl user...logs growing...
Posted by Anders Widman <an...@tnonline.net>.
>>shouldn't that be changed in httpd.conf?
> That didn't help either.
> Just checked error log...the IP appears to be hitting me 15 times a second.
Can't you block the IP in the firewall, or if you have none, with
iptables?
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP Server Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
RE: [users@httpd] URGENT: Getting hammered by an adsl user...logs growing...
Posted by "Ian M. Evans" <ia...@digitalhit.com>.
>shouldn't that be changed in httpd.conf?
That didn't help either.
Just checked error log...the IP appears to be hitting me 15 times a second.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
RE: [users@httpd] URGENT: Getting hammered by an adsl user...logs growing...
Posted by Koen Vingerhoets <ko...@ubench.com>.
Hi,
shouldn't that be changed in httpd.conf?
Met vriendelijke groet,
Koen Vingerhoets
***** UBench nv *****
http://www.ubench.com
____________________________________________
The information contained in this electronic mail message is privileged and
confidential,
and is intended only for use of the addressee. If you are not the intended
recipient, you
are hereby notified that any disclosure,reproduction, distribution or other
use of this
communication is strictly prohibited.
If you have received this communication in error, please notify the sender
by reply
transmission and delete the message without copying or disclosing it.
-----Original Message-----
From: Ian M. Evans [mailto:ianevans@digitalhit.com]
Sent: 27 August 2002 10:38
To: users@httpd.apache.org
Subject: RE: [users@httpd] URGENT: Getting hammered by an adsl
user...logs growing...
I edited the IP and added the line
CustomLog /var/log/httpd/access_log combined env=!dontlog
in my vhosts.conf as per your suggestion, restarted apache and it appears
not be working. Knowing my host...Interland...they probably don't have all
the modules installed.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
RE: [users@httpd] URGENT: Getting hammered by an adsl user...logs growing...
Posted by "Ian M. Evans" <ia...@digitalhit.com>.
I edited the IP and added the line
CustomLog /var/log/httpd/access_log combined env=!dontlog
in my vhosts.conf as per your suggestion, restarted apache and it appears
not be working. Knowing my host...Interland...they probably don't have all
the modules installed.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] URGENT: Getting hammered by an adsl user...logs
growing...
Posted by Rasmus Lerdorf <ra...@apache.org>.
How about simply:
SetEnvIf Remote_Addr "123\.123\.123\.123" dontlog
And then when you define your log, use something like:
CustomLog /var/log/httpd/access_log combined env=!dontlog
That should prevent anything from that IP from getting logged.
By the way, you can also weed out all the code-red crap with something
like:
SetEnvIf Request_URI "default\.ida" dontlog
SetEnvIf Request_URI "root\.exe" dontlog
SetEnvIf Request_URI "cmd\.exe" dontlog
-Rasmus
On Tue, 27 Aug 2002, Ian M. Evans wrote:
> In the past few hrs., we've rec'd over 200,000 requests from an IP that
> appears to be a Belgian ADSL users. It's the same page request over and over
> except each subsequent request seems to have an additional '/1' appended to
> it so the URL gets longer and longer.
>
> I've denied the IP, but now both my error and access logs are ballooning.
> What can I do so I can actually go to bed without waking up to a lack of
> diskspace?
>
> Thanks.
>
> --
> Ian Evans
> Chairman & Executive Producer
> Digital Hit Entertainment
> http://www.digitalhit.com
>
>
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP Server Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org