Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a apache working (in parts) as an reverse proxy. It's producing a load of 9 and more! When I set it up, I first made some mistake opening this for all URLs. I now tighten it (I beleive) to only proxy my local Plone via mod_rewrite:

<VirtualHost *>
        RewriteEngine on
        RewriteRule ^/<local_dir>(.*)$ - [L]
        RewriteRule ^/(.*)$ <plone_site>/VirtualHostRoot/$1 [L,P]

when I look at the /var/log/apache2/access.log I see lot of requests like:

59.54.112.184 - - [09/Sep/2009:14:01:52 +0200] "GET http://www.speedycpm.com/code.php?id=177&l=1 HTTP/1.0" 404 13267 "http://8cpa.0134.cn/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
124.192.187.189 - - [09/Sep/2009:14:01:55 +0200] "GET http://www.speedycpm.com/code.php?id=1030&l=2 HTTP/1.0" 404 13269 "http://8cpa.0134.cn/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
121.17.3.236 - - [09/Sep/2009:14:01:57 +0200] "GET http://bbc.mdc-berlin.de/info_icon.gif HTTP/1.0" 200 997 "http://www.promopaid.info/?ref=ppmesh" "Mozilla/4.0 (compatible; MSIE 5.0; Mac_PowerPC)"
112.192.11.205 - - [09/Sep/2009:14:01:58 +0200] "GET http://creditburner.blueadvertise.com/n_xb300250_d.php?uid=ZGVuZ2ppZXl1ZQ== HTTP/1.0" 404 13295 "http://www.168ptc.ws/neobux.htm" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7) Gecko/20040626 Firefox/0.9.1"
121.17.3.236 - - [09/Sep/2009:14:01:58 +0200] "GET http://bbc.mdc-berlin.de/newsitem_icon.gif HTTP/1.0" 200 952 "http://www.promopaid.info/?ref=ppmesh" "Mozilla/4.0 (compatible; MSIE 5.0; Mac_PowerPC)"
218.95.46.131 - - [09/Sep/2009:14:01:58 +0200] "GET http://www.speedycpm.com/code.php?id=1030&l=3 HTTP/1.0" 404 13269 "http://8cpa.0134.cn/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
121.17.3.236 - - [09/Sep/2009:14:02:02 +0200] "GET http://bbc.mdc-berlin.de/spinner.gif HTTP/1.0" 200 2037 "http://www.promopaid.info/?ref=ppmesh" "Mozilla/4.0 (compatible; MSIE 5.0; Mac_PowerPC)"
218.95.46.131 - - [09/Sep/2009:14:02:05 +0200] "GET http://creditburner.blueadvertise.com/n_xb300250_d.php?uid=ZGVuZ2ppZXl1ZQ== HTTP/1.0" 404 13295 "http://www.168ptc.ws/neobux.htm" "Mozilla/4.7 [en] (Win98; I)"
211.157.108.223 - - [09/Sep/2009:14:02:06 +0200] "GET http://creditburner.blueadvertise.com/n_xb46860_d.php?uid=NTM2NTQ4 HTTP/1.0" 404 13277 "http://fininfo.org" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"

They are all answered by 404 Error documents so I assume these requests are rejected. So is there anything I could tune? This is only a small webserver for our group so any fancy load balancing is out of question.

regards, Andreas

share|improve this question
add comment

4 Answers

    RewriteRule ^/(.*)$ <plone_site>/VirtualHostRoot/$1 [L,P]

You probably want to take a look to ProxyPass it's really lighter to do what you want.

share|improve this answer
add comment

If you have only recently disabled the proxy, it's going to take some time for the people who were using your proxy to realize its no longer working properly and drop you from their lists. I don't know of anything you can do-how many of these requests are you seeing per second?

share|improve this answer
add comment
up vote 0 down vote accepted

Ok turned out that not the actual hits were responsible but old hung apache procs from the time before I closed the proxy.

I shut down apache and were still seeing this high load. I then run lsof -i to see the jobs were trying to connect to other webservers. And then I realized that these processes were quite old. I killed them now and everything seems fine.

FWIW I still changed from RewriteRule to ProxyPass (or ProxyPassMatch).

regards

share|improve this answer
add comment

you could encourage those who are still trying to use your now-closed proxy to stop by redirecting them to a password-protected page (one that has no valid users, htpasswd file = /dev/null) - every request will pop up an annoying auth dialog until they give up and stop trying to misuse your proxy.

share|improve this answer
    
It looks like these are automatic tools meant to generate ad revenue. So that popup won't do anything. –  Andreas Kuntzagk Sep 10 '09 at 11:01
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.