Home / server / Questions / 63715
Accepted
Andreas Kuntzagk
Asked: 2009-09-10 05:00:40 +0800 CST

Apache hit with proxy request

  • 772

I have a apache working (in parts) as an reverse proxy. It's producing a load of 9 and more! When I set it up, I first made some mistake opening this for all URLs. I now tighten it (I beleive) to only proxy my local Plone via mod_rewrite:

<VirtualHost *>
        RewriteEngine on
        RewriteRule ^/<local_dir>(.*)$ - [L]
        RewriteRule ^/(.*)$ <plone_site>/VirtualHostRoot/$1 [L,P]

when I look at the /var/log/apache2/access.log I see lot of requests like:

59.54.112.184 - - [09/Sep/2009:14:01:52 +0200] "GET http://www.speedycpm.com/code.php?id=177&l=1 HTTP/1.0" 404 13267 "http://8cpa.0134.cn/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
124.192.187.189 - - [09/Sep/2009:14:01:55 +0200] "GET http://www.speedycpm.com/code.php?id=1030&l=2 HTTP/1.0" 404 13269 "http://8cpa.0134.cn/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
121.17.3.236 - - [09/Sep/2009:14:01:57 +0200] "GET http://bbc.mdc-berlin.de/info_icon.gif HTTP/1.0" 200 997 "http://www.promopaid.info/?ref=ppmesh" "Mozilla/4.0 (compatible; MSIE 5.0; Mac_PowerPC)"
112.192.11.205 - - [09/Sep/2009:14:01:58 +0200] "GET http://creditburner.blueadvertise.com/n_xb300250_d.php?uid=ZGVuZ2ppZXl1ZQ== HTTP/1.0" 404 13295 "http://www.168ptc.ws/neobux.htm" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7) Gecko/20040626 Firefox/0.9.1"
121.17.3.236 - - [09/Sep/2009:14:01:58 +0200] "GET http://bbc.mdc-berlin.de/newsitem_icon.gif HTTP/1.0" 200 952 "http://www.promopaid.info/?ref=ppmesh" "Mozilla/4.0 (compatible; MSIE 5.0; Mac_PowerPC)"
218.95.46.131 - - [09/Sep/2009:14:01:58 +0200] "GET http://www.speedycpm.com/code.php?id=1030&l=3 HTTP/1.0" 404 13269 "http://8cpa.0134.cn/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
121.17.3.236 - - [09/Sep/2009:14:02:02 +0200] "GET http://bbc.mdc-berlin.de/spinner.gif HTTP/1.0" 200 2037 "http://www.promopaid.info/?ref=ppmesh" "Mozilla/4.0 (compatible; MSIE 5.0; Mac_PowerPC)"
218.95.46.131 - - [09/Sep/2009:14:02:05 +0200] "GET http://creditburner.blueadvertise.com/n_xb300250_d.php?uid=ZGVuZ2ppZXl1ZQ== HTTP/1.0" 404 13295 "http://www.168ptc.ws/neobux.htm" "Mozilla/4.7 [en] (Win98; I)"
211.157.108.223 - - [09/Sep/2009:14:02:06 +0200] "GET http://creditburner.blueadvertise.com/n_xb46860_d.php?uid=NTM2NTQ4 HTTP/1.0" 404 13277 "http://fininfo.org" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"

They are all answered by 404 Error documents so I assume these requests are rejected. So is there anything I could tune? This is only a small webserver for our group so any fancy load balancing is out of question.

regards, Andreas

apache-2.2

4 Answers

  1.     RewriteRule ^/(.*)$ <plone_site>/VirtualHostRoot/$1 [L,P]

    You probably want to take a look to ProxyPass it's really lighter to do what you want.

    • 1

  2. If you have only recently disabled the proxy, it's going to take some time for the people who were using your proxy to realize its no longer working properly and drop you from their lists. I don't know of anything you can do-how many of these requests are you seeing per second?

    • 0
  3. Best Answer

    Ok turned out that not the actual hits were responsible but old hung apache procs from the time before I closed the proxy.

    I shut down apache and were still seeing this high load. I then run lsof -i to see the jobs were trying to connect to other webservers. And then I realized that these processes were quite old. I killed them now and everything seems fine.

    FWIW I still changed from RewriteRule to ProxyPass (or ProxyPassMatch).

    regards

    • 0

  4. you could encourage those who are still trying to use your now-closed proxy to stop by redirecting them to a password-protected page (one that has no valid users, htpasswd file = /dev/null) - every request will pop up an annoying auth dialog until they give up and stop trying to misuse your proxy.

    • 0