0

I've been handed the following report, in connection with our Elastic Beanstalk application showing some weird health check results:

  1. our health check all passed with 2xx.
  2. 74% health check fails with 4xx, but it comes from a domain called "dsb.easysol.net" which owns by amazon. the request are:

    2019/04/22 03:02:21 [error] 6215#0: *745458 recv() failed (104:
    Connection reset by peer) while reading response header from
    upstream, client: 200.217.197.55, server: , request: "GET
    /compatibilityserver/rest/compatibility?dsbVersion=4.8.0&arch=win64&kernelOs=10.0 HTTP/1.1", upstream:
    "http://127.0.0.1:8080/compatibilityserver/rest/compatibility?dsbVersion=4.8.0&arch=win64&kernelOs=10.0", host: "dsb.easysol.net"

  3. These "failed" requests are sent 3-4 times per-seconds

  4. Our app does not use anything from "dsb.easysol.net"

  5. Our beanstalk configuration does not set anything related to "dsb.easysol.net"

The person who passed this report on to me can't make head or tail of it, and neither can I. Does anybody know what could be up with this "dsb.easysol.net," or even what "dsb.easysol.net" is? All I see is something called "Detect Safe Browsing."

New information: I have just took a look at the health check status myself, and it's showing some 85-95% of requests erroring. I pulled up the logs ("last 100"), and while I didn't see any "dsb.easysol.net," I did see this in the logs:

-------------------------------------
/var/log/tomcat8/localhost_access_log.txt
-------------------------------------
127.0.0.1 - - [22/Apr/2019:21:26:42 +0000] "GET /compatibilityserver/rest/compatibility?dsbVersion=4.8.0&arch=win64&kernelOs=6.1 HTTP/1.1" 404 767
127.0.0.1 - - [22/Apr/2019:21:26:42 +0000] "GET /compatibilityserver/rest/compatibility?dsbVersion=4.8.0&arch=win64&kernelOs=6.1 HTTP/1.1" 404 767
127.0.0.1 - - [22/Apr/2019:21:26:44 +0000] "GET /compatibilityserver/rest/compatibility?dsbVersion=4.8.0&arch=win64&kernelOs=6.1 HTTP/1.1" 404 767
127.0.0.1 - - [22/Apr/2019:21:26:44 +0000] "GET /heath.txt HTTP/1.1" 200 2
127.0.0.1 - - [22/Apr/2019:21:26:44 +0000] "GET /heath.txt HTTP/1.1" 200 2
127.0.0.1 - - [22/Apr/2019:21:26:44 +0000] "GET /compatibilityserver/rest/compatibility?dsbVersion=4.8.0&arch=win64&kernelOs=10.0 HTTP/1.1" 404 767
127.0.0.1 - - [22/Apr/2019:21:26:45 +0000] "GET /compatibilityserver/rest/compatibility?dsbVersion=4.8.0&arch=win64&kernelOs=6.1 HTTP/1.1" 404 767

and so forth. . .

and also

-------------------------------------
/var/log/nginx/access.log
-------------------------------------
200.217.197.55 - - [22/Apr/2019:21:26:52 +0000] "GET /compatibilityserver/rest/compatibility?dsbVersion=4.8.0&arch=win64&kernelOs=6.1 HTTP/1.1" 404 432 "-" "Mozilla/5.0" "200.217.197.55"
200.217.197.55 - - [22/Apr/2019:21:26:52 +0000] "GET /compatibilityserver/rest/compatibility?dsbVersion=4.8.0&arch=win64&kernelOs=6.1 HTTP/1.1" 404 432 "-" "Mozilla/5.0" "200.217.197.55"
200.217.197.55 - - [22/Apr/2019:21:26:52 +0000] "GET /compatibilityserver/rest/compatibility?dsbVersion=4.8.0&arch=win&kernelOs=6.1 HTTP/1.1" 404 432 "-" "Mozilla/5.0" "200.217.197.55"
200.217.197.55 - - [22/Apr/2019:21:26:52 +0000] "GET /compatibilityserver/rest/compatibility?dsbVersion=4.8.0&arch=win64&kernelOs=6.1 HTTP/1.1" 404 432 "-" "Mozilla/5.0" "200.217.197.55"
200.217.197.55 - - [22/Apr/2019:21:26:52 +0000] "GET /compatibilityserver/rest/compatibility?dsbVersion=4.8.0&arch=win64&kernelOs=6.1 HTTP/1.1" 404 432 "-" "Mozilla/5.0" "200.217.197.55"
200.217.197.55 - - [22/Apr/2019:21:26:52 +0000] "GET /compatibilityserver/rest/compatibility?dsbVersion=4.8.0&arch=win64&kernelOs=6.1 HTTP/1.1" 404 432 "-" "Mozilla/5.0" "200.217.197.55"
200.217.197.55 - - [22/Apr/2019:21:26:53 +0000] "GET /compatibilityserver/rest/compatibility?dsbVersion=4.8.0&arch=win64&kernelOs=6.1 HTTP/1.1" 404 432 "-" "Mozilla/5.0" "200.217.197.55"

Does this give anybody any insights?

  • Who prepared this report? Where did it come from? – ceejayoz Apr 22 at 21:22
  • My immediate superior. And I just looked into it myself, and added what I found to the original post. – hbquikcomjamesl Apr 22 at 21:38
  • 1
    I'm a bit confused by your edit. Your health check appears to be at /heath.txt. That's not what's being accessed when the 404s are generated. Chances are your server's IP was previously used by dsb.easysol.net, or they pointed the domain at you by mistake. If it's always the same IP, just block them. – ceejayoz Apr 22 at 21:42
  • Thanks. That may help. – hbquikcomjamesl Apr 22 at 21:50
  • I've just been informed that your comment was not the whole answer, but it started the developer in the right direction. Thanks again. – hbquikcomjamesl Apr 23 at 23:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.