Or a least a decent battle. After I took down the Twiki yesterday, I expected the load to drop significantly on the server, and general response time to get alot better. Boy was I wrong.

Take a look at some of these numbers:

apache/logs> grep ’70.85.45.132′ www.yeraze.com-access_log | wc -l
6523
apache/logs> grep ’70.85.45.132′ www.yeraze.com-access_log | head –lines 1
70.85.45.132 – - [15/Aug/2005:13:19:31 -0500] “GET /robots.txt HTTP/1.1″ 206 686
apache/logs> grep ’70.85.45.132′ www.yeraze.com-access_log | tail –lines 1
70.85.45.132 – - [17/Aug/2005:09:21:53 -0500] “GET /gl/search.php?mode=search HTTP/1.1″ 403 294

apache/logs> grep ‘client denied’ www.yeraze.com-error_log | wc -l
2178
apache/logs> grep ‘client denied’ www.yeraze.com-error_log | head –lines 1
[Tue Aug 16 21:30:23 2005] [error] [client 70.85.45.132] client denied by server configuration (removed)

So what does this show you? Between 1pm on the 15th and 9am this morning, this guy requested over 6,500 pages. And not just any pages mind you, but the slowest & most time consuming pages on my website.

I don’t know who Mr. 70.85.45.132 is, but his traceroute points back to theplanet.com as an ISP, and a strange russian website. A quick google of the IP turns up that he’s made alot of enemies, and his IP comes as a default on alot of Blacklist plugins. When load finally returned to something I could manage, I IP-blocked him and that pretty much solved the problem. I also took a copy of the logs showing the thousands of requests (as much as 5 or 10 a second) and sent them to theplanet’s Policy Enforcement division, and I’m happy to say that I haven’t seen him in my logs for a few hours now.

I installed a new 404 page for the old twiki. I had it setup to redirect to the new blog, but that caused a big database hit for every failed twiki request, which was a bit unnecessary. I also installed a simple Rewrite rule to redirect the old index.cgi to the new index.php, and another to inform users of “Gone” links for individual stories. Those 2 rewrites have significantly cut down the load on the site, so here’s hoping that things will finally return to normal.

Be Sociable, Share!

No related posts.