[Systems] [Systems-logs] sunjammer.sugarlabs.org-Munin_alert

[Bernie Innocenti]

On 18/03/16 20:38, Bernie Innocenti wrote:
> On 18/03/16 19:05, Munin wrote:
>> sugarlabs.org :: sunjammer.sugarlabs.org :: CPU usage
>> 	OKs: system is 79.97.
> 
> Sunjammer has been overloaded for the whole day, but at least it hasn't
> OOMed this time.
> 
> I inspected the files in /root/apache-status/ and found that we're
> getting a ton of parallel queries to ASLO from 83.217.9.124, which is in
> a netblock owned by a russian ISP (atlex.ru).
> 
> Unless alsroot is stress-testing ASLO, this is a single-host DOS, which
> I stopped it in a second with my magical script ipkill. The IP will
> remain banned until we reboot sunjammer. In case it was really alsroot
> accidentally triggering the alarms, just run "ipunkill" to remove the
> iptables rule.

Monitoring shows that killing that one IP solved the issue:


http://munin.sugarlabs.org/sugarlabs.org/sunjammer.sugarlabs.org/apache_accesses.html

-- 
 _ // Bernie Innocenti
 \X/  http://codewiz.org