Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am getting a lot of false positives notices sent by mod_evasive installed on my apache servers. They always happen on large PDF file downloads. When clients download PDFs from my site, they use many simultaneous connections which triggers blacklisting behaviour in mod_evasive. Is there any way to exclude PDFs from mod_evasive tracking? Am I using too restrictive config? I understand that every deployment is somewhat different but I am looking for suggestions. I want to stop sending 403 on partial downloads requests.

Here is the log

[Tue Dec 31 09:47:37 2013] [error] [client] client denied by server configuration: /srv/netce/Root/pdfs/catalogs/productid_3078.pdf - - [31/Dec/2013:09:47:37 -0800] "GET /3078/Catalog_MD14.pdf HTTP/1.1" 403 1018 "-" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0)" - - [31/Dec/2013:09:47:37 -0800] "GET /3078/Catalog_MD14.pdf HTTP/1.1" 206 2560 "-" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0)" - - [31/Dec/2013:09:47:37 -0800] "GET /3078/Catalog_MD14.pdf HTTP/1.1" 206 1024 "-" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0)" - - [31/Dec/2013:09:47:37 -0800] "GET /3078/Catalog_MD14.pdf HTTP/1.1" 206 4096 "-" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0)"

Here is mod_evasive config

LoadModule evasive20_module modules/
<IfModule mod_evasive20.c>
    DOSHashTableSize    3097
    DOSPageCount        5
    DOSSiteCount        50
    DOSPageInterval     1
    DOSSiteInterval     1
    DOSBlockingPeriod   10
    DOSLogDir           "/var/www"
    DOSWhitelist   192.168.*

Any help is appreciated.

share|improve this question

After writing up this question I started researching and looking for a solution. I found a work around that basically just disables partial downloads. It's not the most efficient solution but it seems to work.

<LocationMatch "\.pdf$">
 Header unset Accept-Ranges
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.