0

Fitrst I got notification from Nagios that NGINX down.

When I checked server - there was lot full swap and memory.

I found odd entries in log:

65.49.14.146 - - [04/Jan/2015:16:06:11 +0200] "GET /EC65E041-8DDF-D04A-8307-38506B99BE22/6C6CCDBA-AFF1-E54F-A6A6-0D7A76E35801/from HTTP/1.1" 404 11564 "http://domain.ua/lalala" "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36" "-"

What is is:

EC65E041-8DDF-D04A-8307-38506B99BE22/6C6CCDBA-AFF1-E54F-A6A6-0D7A76E35801

I banned this IP on firewall, and LA and memory now looks good.

Improve this question

1 Answer 1

Reset to default
1

The URL contains two UUID, but they probably don't mean anything.

Since the entries appear to be GET requests for a nonexisting URL there is little reason to think they could be causing any harm. If there are lots of them, then adding it all up, they could probably take some resources to process.

A decent server should be able to handle many requests triggering 404 every second. You haven't told us exactly how frequent those requests are. Assuming they are very frequent, then that in itself could explain slowdown on the server.

The IP address 65.49.14.146 belongs to Hurricane Electric. That is a respectable company. I suggest you ask them if blocking said IP could potentially block legitimate requests as well. They are usually very helpful.

Improve this answer
1
  • 1
    Requesting missing page in WordPress by default causes search query in database, thus - it causes some load. I was too lazy, to disable it (but done now).
    – setevoy
    Jan 4, 2015 at 17:24

Not the answer you're looking for? Browse other questions tagged .