Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:

I have two directories, under /var/www/vhosts: mydomain/ and default/. Files in default directory can be accessed using IP address of our server.

I have checked Apache log and somebody is constantly, trying to access random files under that directory - is performing "mapping". Also IP address, from which request is coming appears always different in Apache's error log. I have also a suspicion that this mapping causes Apache to run out of available slots, and jam at the end.

Here is a snippet from Apache log:

[Mon May 14 16:04:04 2012] [error] [client] File does not exist: /var/www/vhosts/default/htdocs/manager
[Mon May 14 16:05:29 2012] [error] [client] File does not exist: /var/www/vhosts/default/htdocs/manager
[Mon May 14 16:19:12 2012] [error] server reached MaxClients setting, consider raising the MaxClients setting

Is there any way to prevent these attacks?

share|improve this question

marked as duplicate by HopelessN00b Feb 18 '15 at 6:19

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

Why do you think that these scans cause apache to run out of available slots?

I suggest that instead of hunting a phantom, you first configure mod_status to find out what URLs are being processed by your server. You can then decide what action you want to take.

share|improve this answer

You can install and configure fail2ban to block access for ips that generates those kind of errors.

here are some helpful links

share|improve this answer
Thank you for linking to my site but you have linked to a dynamic link on used for paging results. The contant on that page will change as posts are added. Perhaps You meant to use…. I have edited you answer to use this URL I hope that is ok. – Richard Holloway May 15 '12 at 21:07

Not the answer you're looking for? Browse other questions tagged or ask your own question.