[Systems] [Systems-logs] sunjammer.sugarlabs.org-Munin_alert
bernie at codewiz.org
Fri Mar 18 21:03:55 EDT 2016
On 18/03/16 20:38, Bernie Innocenti wrote:
> On 18/03/16 19:05, Munin wrote:
>> sugarlabs.org :: sunjammer.sugarlabs.org :: CPU usage
>> OKs: system is 79.97.
> Sunjammer has been overloaded for the whole day, but at least it hasn't
> OOMed this time.
> I inspected the files in /root/apache-status/ and found that we're
> getting a ton of parallel queries to ASLO from 188.8.131.52, which is in
> a netblock owned by a russian ISP (atlex.ru).
> Unless alsroot is stress-testing ASLO, this is a single-host DOS, which
> I stopped it in a second with my magical script ipkill. The IP will
> remain banned until we reboot sunjammer. In case it was really alsroot
> accidentally triggering the alarms, just run "ipunkill" to remove the
> iptables rule.
Monitoring shows that killing that one IP solved the issue:
_ // Bernie Innocenti
More information about the Systems