Apache :: Server IP Making GET Requests
Apr 12, 2014
I've spent the last several months working on a huge upgrade of a couple dozen websites. The upgrades include modifying Apache so that visitors who arrive at links pointing to mysite/World/New_York are redirected to mysite/world/new-york. In other words, all my links now default to lower case, and underscores are replaced with dashes.
Unfortunately, publishing it has been an endless series of disasters. My websites are now all crashed, and the server is unbelievably slow. It takes pages forever to load (if they load at all), and I can scarcely publish files online.So the following notice sent to me by my webhost got my attention.
IT appears your own server IP is making GET requests to Apache, causing excessive loading and causing service failures. On today's date, your IP made almost 6,000 connections to Apache:<br><br>
[root@host ~]# grep 64.91.229.106 /usr/local/apache/domlogs/mysite.org | wc -l 5924 [root@host ~]#<br><br>
These were all the same request:<br><br>
64.91.229.106 - - [12/Apr/2014:08:10:10 -0400] "GET /404.php HTTP/1.0" 200 14294 "-" "-"<br><br>
And that made up the total of requests:<br><br>
[root@host ~]# grep 64.91.229.106 /usr/local/apache/domlogs/mysite.org | grep "GET /404.php HTTP/1.0" | wc -l 5924 [root@host ~]#<br><br>
View 1 Replies
ADVERTISEMENT
Jan 19, 2008
I currently have a web VPS hosted with FDCServers.net and after 5 days of switching to it i am getting massive HTTP requests. When i login to WHM and hit apache status i have many requests per second by multiple IP's that are going to pages that simple don't exist. Currently my hostname for the server is set at web-01.optical-hosting.com which is what the requests are being sent to. I am also having a DNS issue because when i put http://web-01.optical-hosting.com in the web browser it displays the first account's site under "list accounts" in cpanel. Can someone please help me fix both of these issue's? i will post an apache log in a second post as it is long. Also, these are from overseas. please someone help me with this i have Aim and Msn.
View 4 Replies
View Related
Jun 4, 2009
My Linux Server's Http Daemon (Apache) would stop serving websites ever so often, as soon as apache is restarted the error fixes iteself only to resurface within few hours.
The apache process would still be running i.e. apache does not die but no websites hosted on my server would be accessible from browser. And when this happens the apache logs do not log any http requests.
Instead when this happens all http requests to my server would be redirected to some weird Trojan website and my Norton Antivirus would show an Alert/Warning, for example;
"Browser exploit at www.xxx.xxx was blocked"
Risk Name: MSIE WebViewFolderIcon ActiveX Control BO
or another error like;
"Auto-Protect has detected Trojan.Fakeavalert".
At first i thought the problem could be with my Laptop/ISP so i logged on to the server via SSH and opened try to open a website using command line "lynx mywebsite.com" and it shows following error;
"Alert!: HTTP/1.0 503 Service Unavailable".
Now if i assume my laptop were to be infected, then as soon as i restart my apache and visit mywebsite.com eveything returns to normal with no such warnings. Why do i see those norton error messages only when apache is down with 503, and when apache is down with 503 how come the http requests always get redirected to some suspicious websites and nothing gets logged in apache error log?
I think my server is being attacked causing http to get unresponsive and thereafter http requests to my server are redirected to some malicious website, is this correct?
Also, i suspect this is a php script exploit as some customers have reported that google have blocked their website due to security reasons, i found <iframe> tage inserted in some php pages which i fixed.
Also, another thinh i noticed;
when apache responds with the 503 it is referencing PHP 5.1.4 in the header response:
[root@]# curl -I xxx.xxx.xxx.xxx (my server ip)
HTTP/1.0 503 Service Unavailable
Server: Apache
X-Powered-By: PHP/5.1.4
Retry-After: 20
I am running PHP 4.3.9m why does apache responds with PHP 5.1.4 when this 503 error surfaces?
Also, since my apache was dowan with 503 error a customer mailed in today saying;
"It seems that my site www.xxxx.com is regularly down, and the winlogon virus is involved."
I suspect this is again due to the fact that http requests start getting redirected?
View 3 Replies
View Related
Mar 27, 2013
I'm running Apache 2.4.4 on Windows Server 2008 R2. It's already happened many times that Apache stopped responding to requests. The last entry in the error.log:
[Wed Mar 27 06:22:07.043600 2013] [mpm_winnt:notice] [pid 1736:tid 256] AH00354: Child: Starting 64 worker threads.
[Wed Mar 27 06:52:34.521200 2013] [mpm_winnt:error] [pid 1736:tid 1656] AH00326: Server ran out of threads to serve requests. Consider raising the ThreadsPerChild setting
View 1 Replies
View Related
May 28, 2014
I recently upgraded my Apache 2.2.22 installation on Win 8.1 to 2.4.9, making all necessary changes (I believe) to the conf files. I am puzzled that two files in the format authdigest_shm.xxxx now appear in my logs directory when the server is restarted. (Edit: there is also no httpd.pid file)I assume this is to do with running digest authentication, but is a new phenomenon since the upgrade.what conf file setting(s) have I screwed up?!
View 2 Replies
View Related
Feb 15, 2007
Is it possible to make these two work together? I can't seem to find any way to let Apache read /home/<username>/public_html without disabling selinux entirely.
I know you can do "chcon -t httpd_sys_content_t -R $HOME/public_html", but it seems like it would be a pain when adding users, especially if someone decides to delete their public_html and make a new directory.
Is it possible to create an exception to let httpd do whatever it wants?
View 0 Replies
View Related
Feb 8, 2007
I have a dedicated box with softlayer and I have noticed at varying times the past few months that with sites we host, sometimes the connection times out (I'll try to access like 5 or 6 sites within 30 seconds or so and they all drop, then a minute later they load fine).
I opened a support ticket and they said it usually has to do with the # of requests Apache can handle, and that this can be modified. They stated they could: "tweak the apache configuration file in this server that can make it possible to handle more requests."
So my question is what should the # of requests be set to? (I'm not sure what it is now, but I assume whatever the default # is).
View 6 Replies
View Related
Mar 31, 2008
I have been experiencing a lot of Keepalive requests for a particular image on a particular domain. please see the lines below.
0-11233931/63/63K 0.15100.40.030.03 195.68.185.13mydomain.comGET http://mydomain.com//images/logo.jpg HTTP/1.1
1-11233941/77/77K 0.18100.40.050.05 122.164.58.63mydomain.comGET http://mydomain.com//images/logo.jpg HTTP/1.1
2-11233951/42/42K 0.76000.40.170.17 89.139.214.74mydomain.comGET http://mydomain.com//images/logo.jpg HTTP/1.1
3-11233971/57/57K 0.04000.40.020.02 82.199.98.229mydomain.comGET http://mydomain.com//images/logo.jpg HTTP/1.1
4-11233981/46/46K 0.27000.40.040.04 217.150.55.41mydomain.comGET http://mydomain.com//images/logo.jpg HTTP/1.1
These are just a few lines from the top.
How can i prevent this from happening.. it seems as a SYN Flood, or maybe a DDoS.
View 3 Replies
View Related
Sep 16, 2014
We have an Apache acting as a reverse-proxy and listening on the Internet ("Our URL" on port 443).
We would have two ways of accessing this reverse-proxy:
-From a mobile app (authentication would be based on a corporate certificate)
-From any browser (authentication would be a login form)
The question is: can Apache forward requests to either server 1 or server 2, depending on whether a certificate is sent by the client?
View 10 Replies
View Related
Sep 29, 2013
I have Apache 2.4.2, OpenSSL/1.0.1c, on Windows Web Server 2008 R2 (64 bits)
After 12 hours of heavier load, the SSL requests stopped working/being answered. However if you requested the same page via http instead of https, it worked fine. Restarting the Apache server fixes this, for a while. Again after a few hours of traffic, the https requests stopped working again. I checked the logs, and nothing notable, the mod_ssl entries just...
The site is called only by client developed with Delphi 2007 (CodeGear user-agent). Delphi client use THTTPRIO for sending HTTPS request to SOAP.
View 9 Replies
View Related
Dec 13, 2012
So I just upgraded Apache 2.2.22 to Apache 2.4.3 and made sure to go through all the options that had changed and update the conf file accordingly. This included adding the cache module for SSL and changing the SSLMutex option over to Mutex default ssl-cache. We also turned off SSLCompression due to the CRIME attack vulnerability.
We use apache strictly as a loadbalancer to 2 tomcat servers via mod_jk. Apache serves no static content at this time.
After being deployed, everything worked fine until later in the day. After 3 hours of heavier load (our site only takes significant traffic during business hours), the SSL requests stopped working/being answered. However if you requested the same page via http instead of https, it worked fine.
Restarting the Apache server fixes this, for a while. Again after a few hours of traffic, the https requests stopped working again. This time I turned the loglevel up to debug and restarted the Apache server.
As traffic slowed down it took another 6 or 7 hours before SSL requests stopped working again. I checked the logs, and nothing notable, the mod_ssl entries just... stopped. (I don't know for sure its ammount of traffic related, it just seems that way)
I have tried reproducing this in a lab, but have not been able to get it to happen on the lab server.
OS: Windows Server 2008 R2
Apache: 2.4.3 vc9 build with OpenSSL 0.9.8 downloaded from apachelounge.org
Mod_JK Version 1.2.37 vc9 also downloaded from apachelounge.
View 10 Replies
View Related
May 25, 2015
I have a little problem (on my Raspberry) with the maximum concurrent connections.When I open multiple tabs of a webpage which keeps persistent connections, apache is unable to serve more requests.Here is the (shortened) mod_info output (which also takes some time till there is a process kind enough to serve the request):
Code:
Server Version: Apache/2.4.10 (Raspbian) OpenSSL/1.0.1k
Server MPM: prefork
5 requests currently being processed, 9 idle workers
.___W____WWW_..W_...............................................
................................................................
......................
Srv PID Acc M CPU SS Req Conn Child Slot Client VHost Request
[Code] ....
When I understood it correctly, apache should spawn new processes (up to MaxRequestWorkers=150)
But there are idle???? processes, so it wont add new ones?
I dont think it has to do with mod_proxy (used for the webpage) since the mod_info output is affected as well...
View 1 Replies
View Related
Jan 26, 2008
A weird thing happents once on few days on my server, and it's not a regular thing or on exact time.
When I have this problem no page can be loaded in the browser, but WHM is working, i think because it's accessed by IP .
In apache status page I can see lots of ..reading.. requests which are there even for 10 - 20 seconds sometimes.
Usualy the server has 10 - 20 requests/s :
CPU Usage: u35146 s2297.05 cu2.74 cs4.5 - 6.97% CPU load
11.2 requests/sec - 83.0 kB/second - 7.4 kB/request
10 requests currently being processed, 8 idle servers
But when the ..reading.. requests appear it goes much higher like 100 to 200
11.5 requests/sec - 85.3 kB/second - 7.5 kB/request
200 requests currently being processed, 0 idle servers
after 3 minutes :
160 requests currently being processed, 30 idle servers
When I logged on to SSH I saw that there are ~150 conection from a single IP .
View 14 Replies
View Related
Feb 20, 2013
I have an Apache Server (2.4.3) and a Tomcat Server (7.0.36) and have some Java Applications deployed.Everything works fine, but when we start a quite long Ajax process, I see in my Java Application, that a Ajax request is received and starts processing - everything fine. But during processing of the first request, I see a second request starts after 5 minutes.
View 1 Replies
View Related
Apr 10, 2013
I'm looking to pass the entries to a web form, via Apache, to an external process (listening on a port say 4321) running on the same host as Apache.Is there a way to "coerce" Apache into doing this?
View 1 Replies
View Related
Feb 8, 2015
So I've got a problem where a small percentage of incoming requests are resulting in "400 bad request" errors and I could really use some input. At first I thought they were just caused by malicious spiders, scrapers, etc. but they seem to be legitimate requests.
I'm running Apache 2.2.15 and mod_perl2.
The first thing I did was turn on mod_logio and interestingly enough, for every request where this happens the request headers are between 8000-9000 bytes, whereas with most requests it's under 1000. Hmm.
There are a lot of cookies being set, and it's happening across all browsers and operating systems, so I assumed it had to be related to bad or "corrupted" cookies somehow - but it's not.
I added "%{Cookie}i" to my LogFormat directive hoping that would provide some clues, but as it turns out half the time the 400 error is returned the client doesn't even have a cookie. Darn.
Next I fired up mod_log_forensic hoping to be able to see ALL the request headers, but as luck would have it nothing is logged when it happens. I guess Apache is returning the 400 error before the forensic module gets to do its logging?
By the way, when this happens I see this in the error log:
request failed: error reading the headers
To me this says Apache doesn't like something about the raw incoming request, rather than a problem with our rewriting, etc. Or am I misunderstanding the error?
I'm at a loss where to go from here. Is there some other way that I can easily see all the request headers? I feel like that's the only thing that will possibly provide a clue as to what's going on.
View 1 Replies
View Related
Jan 21, 2014
I have been trying to solve a big problem for the last 2 weeks with one of our servers.
The client using our system (web based w/ apache and php) is a contact center firm. They have about 120 operators, all connect to our websever with the same IP.
We have been suffering DoS attacks from some of these operators. This are simple, browser attacks , namely 5 or 10 operators will just hold F5 key and bombard the server with requests when they shouldnt.
We did manage to produce a php protection which will recognize the multiple requests and blacklist the user, but its "too late" because the request have already been sent and processed by the webserver.
We use the user ID in the system to control who should be blacklisted, so this is all dependent on our own authentication.
Ideally, we need something EXACTLY like mod_evasive, but for rejecting single requests instead of blocking the IP. Exemplifying : if a user calls the same url, 5 times, in a 3 second spawn, we will reject every next request for 30 seconds, but only the requests by that user.
If the webserver can make any use of it, the user id is stored in a cookie.
View 4 Replies
View Related
Apr 10, 2015
I'm trying to prevent unnecessary GET requests from being processed by my CMS that originate from mutating IP address locations. This is sucking up server resources when the request is processed by the app, and so if possible, I'd like to block them with HTACCESS so that the request is stopped before anything is intensively-processed.
What happens is that an IP address will make a GET request for, say, "blah/test" or "blah/test2" but nothing else (no site assets like images or CSS/JavaScript files or even other pages). After this request, another IP address will then make an equivalent kind of request, and so on, and so on... All of them have similar if not identical user agent strings but they're always worthless requests that do nothing but waste CPU and RAM. I'm assuming it's just some idiotic SPAM bot because of this.
View 8 Replies
View Related
May 13, 2007
I was wondering I've been having problems with getting my web server going.
I'm using Apache 2 on my Windows XP SP2 machine. I have a Linksys WRT54GX2 router, and I have Charter 3MB Cable internet. I already called charter to see if they allowed web servers and they said they do. I also asked if they block ports, and they said they don't.
Now my problem... So, I originally thought maybe charter blocked port 80, so I used NO-IP to work around that, I did port forwarding through that. Well, I used there tool canyouseeme.org and it said it couldnt read any ports i put in.
All my firewalls were off and i had my router firewall off. I even put my computer in the DMZ part of my router. I'm about to see if i can connect my modem directly to my computer without having a problem but i wasn't able to a bit ago. Anyone got any clues to waht i could do if nothing changes when i put my modem to my computer.
View 14 Replies
View Related
Jun 10, 2008
build our our server network for our business and power it with our new 15Mbps/15Mbps Fios Business Plan.
Now I know enough to set up a home network just fine but dealing with a server end is a little different.
What I need a for someone to help me with advise on hardware for our setup ie: Routers, Switches, ect ect
We are looking to start with 2 boxes at this time and may go as big as 5 so we want to be sure we have the equipment to handle it
I would like a Router that allows me to connect 2 uplink connection so if we need to upgrade we can add a 2nd fios line.
a decent router to handle this?
View 6 Replies
View Related
Jul 8, 2007
I'm getting myself a colocated server in August.
Its quite a 'powerful' one (Q6600, 2GB, 2x160GB). It will be running Windows Server 2003 Standard edition.
I would also like to make a test 2003 installation on the server itself and most likely a Linux Ubuntu) installation too.
Now VPS looks good, but I have some questions about it.
- Can I run 2003 (virtual in VPS) with the same SPLA license?
- Is it possible to give the power of one core of the CPU (since I got four) to a VPS? (so it doesn't stress other cores)
- For example, I host an application on port 5000 (random chosen ) on the non-VPS system, is it possible to host the same application in the VPS system on the same port with an other IP address assigned to it?
- Whats the best (free if possible, shouldn't have many options (just an on/off switch )) way to make a VPS in Windows?
- Is it a problem with servers of these days to push the 'maximum' (or like 80%) out of the network connection (a gigabits or 100MBits)? Are the server response response times (pings) acceptable for gaming when its under such a load?
View 14 Replies
View Related
Aug 4, 2009
Let's say you ordered new server,do you make active same moment(install httpd server and all other components)or you running test before like memory and hardware test? If yes,which programs you would recommend to test fully hardware?
View 2 Replies
View Related
Aug 8, 2007
I have a Ubuntu 6 LTS server, and so far i have installed and got working:
Apache, PHP5, SQL5
but now i come to EXIM, its installed, and i have installed Solid Pop3d as a pop server - it was in the repository, but now i dont know what to do.
The server exists as a subdomain of another, until its ready for me to move onto. There are no control panels, i wanted to do it all with SSH.
Does anyone know how to set it up so i can connect with a mail client, and how to setup accounts?
View 0 Replies
View Related
Jul 25, 2008
my server is still effed up from the MPack attack that I received.
I just received the following email, does anyone know what this means or how it could be done? The client IP is mine, so some how my server is sending that request?
72.233.79.2 (malwarebytes.org) Server Log:
[Thu Jul 24 13:05:07 2008] [error] [client 72.55.184.144] mod_security:
Access denied with code 403. Pattern match ".../" at THE_REQUEST
[id "300006"] [rev "1"] [msg "Bogus Path denied"] [severity "CRITICAL"]
[hostname "www.malwarebytes.org"] [uri
"/errors.php?error=[url][unique_id "tNAGeH8AAAEAAEsfD7wAAAAO"]
[Thu Jul 24 13:05:07 2008] [error] [client 72.55.184.144] mod_security:
Access denied with code 403. Pattern match ".../" at THE_REQUEST
[id "300006"] [rev "1"] [msg "Bogus Path denied"] [severity "CRITICAL"]
[hostname "www.malwarebytes.org"] [uri
"/forums/errors.php?error=[url][unique_id
"tNAPAn8AAAEAAD7mqWQAAAAl"]
[url]is the RKHunter scan log
[url]is the ChkRootKit scan log.
I'm going through this thread right now:
[url]("How-to detect a possible intruder?") and I've come across a handful of hidden directories:
/home/mifbody/public_html/vbulletin/arcade/images/. /. /xh
/home/mifbody/public_html/vbulletin/arcade/images/. /. /xhide.c
/home/mifbody/public_html/vbulletin/arcade/images/. /. /obj/convertxdccfile.o
/home/mifbody/public_html/vbulletin/arcade/images/. /. /obj/iroffer_admin.o
/home/mifbody/public_html/vbulletin/arcade/images/. /. /obj/iroffer_dccchat.o
/home/mifbody/public_html/vbulletin/arcade/images/. /. /obj/iroffer_display.o
/home/mifbody/public_html/vbulletin/arcade/images/. /. /obj/iroffer_main.o
/home/mifbody/public_html/vbulletin/arcade/images/. /. /obj/iroffer_md5.o
/home/mifbody/public_html/vbulletin/arcade/images/. /. /obj/iroffer_misc.o
/home/mifbody/public_html/vbulletin/arcade/images/. /. /obj/iroffer_statefile.o
/home/mifbody/public_html/vbulletin/arcade/images/. /. /obj/iroffer_transfer.o
/home/mifbody/public_html/vbulletin/arcade/images/. /. /obj/iroffer_upload.o
/home/mifbody/public_html/vbulletin/arcade/images/. /. /obj/iroffer_utilities.o
/home/mifbody/public_html/vbulletin/arcade/images/. /. /src/convertxdccfile.c
/home/mifbody/public_html/vbulletin/arcade/images/. /. /src/iroffer_admin.c
/home/mifbody/public_html/vbulletin/arcade/images/. /. /src/iroffer_config.h
/home/mifbody/public_html/vbulletin/arcade/images/. /. /src/iroffer_dccchat.c
/home/mifbody/public_html/vbulletin/arcade/images/. /. /src/iroffer_defines.h
/home/mifbody/public_html/vbulletin/arcade/images/. /. /src/iroffer_display.c
/home/mifbody/public_html/vbulletin/arcade/images/. /. /src/iroffer_globals.h
/home/mifbody/public_html/vbulletin/arcade/images/. /. /src/iroffer_headers.h
/home/mifbody/public_html/vbulletin/arcade/images/. /. /src/iroffer_main.c
/home/mifbody/public_html/vbulletin/arcade/images/. /. /src/iroffer_md5.c
/home/mifbody/public_html/vbulletin/arcade/images/. /. /src/iroffer_md5.h
/home/mifbody/public_html/vbulletin/arcade/images/. /. /src/iroffer_misc.c
/home/mifbody/public_html/vbulletin/arcade/images/. /. /src/iroffer_statefile.c
/home/mifbody/public_html/vbulletin/arcade/images/. /. /src/iroffer_transfer.c
/home/mifbody/public_html/vbulletin/arcade/images/. /. /src/iroffer_upload.c
/home/mifbody/public_html/vbulletin/arcade/images/. /. /src/iroffer_utilities.c
I was able to successfully delete all the files, but how do I now get rid of the directories themselves? When I do:
rm -fr "/arcade/images/. /"
and then locate ". "
I still get:
/home/mifbody/public_html/vbulletin/adserver/banners/.
/home/mifbody/public_html/vbulletin/alice/src/admin/.
/home/mifbody/public_html/vbulletin/arcade/images/.
View 2 Replies
View Related
Oct 8, 2007
There seems to be some problem with my server, none of the websites hosted on my server are accessible, the http requests either return a blank page or a page with a red quare on the upper left hand corner.
I am not sure if this is some kind of infection or DNS problem or a problem with memory apache is taking up
as i have thousands of virtualhost entries in my access log accumulated over the years out of which only a few 100 websites i am serving presently, but never deleted the non-exitent virtualhost blocks.
At times the websites are opening but most of the times they are not. And when they do not open my http requets are not logged in apacha access log.
Even the customers have reported the same problem.
Also, just four days back i had a strange issue where all
http requests to my server would take me to [url].
I can SSH to server, and everything else is working fine.
View 3 Replies
View Related
May 8, 2007
I host my DNS with DNSmadeeasy.com , I noticed that I have daily more than 350.000 DNS requests for main domain, This domains got about 80.000 uniqes/day, so this is strange how can there be 350.000 DNS requests/day. Seems that I'll go over the quota because of this.
The TTL for all domains is set to 86400.
Is there a way to discover how its possible ? And also is there a way to do something to make this number lower (DNS requests)
View 1 Replies
View Related
Apr 20, 2008
Where is a server's IP address for outgoing requests set? e.g. if a script on the server fetches ip-address.com, the IP that is identified there. A server may have multiple IPs pointing to it, but there's only one that outgoing requests are funneled through. I've tried changing "Main Shared IP" in WHM, but that doesn't seem to affect this.
Is this set server-side, in some setting file - or is this a datacenter thing?
View 9 Replies
View Related
Jul 24, 2009
When i try to open any website hosted on my server (around 50 of them) i am being taken to following malware website;
[url]
[url]
This is a problem with my Limnux server running Apache and not a virus on my local computer as customers from all over are reporting the same issue.
As soon as i restart Apache eveything returns to normal with no such redirects.
I think my server is being attacked causing http requests to get redirected to some malicious website.
This issue would resurface almost every hour and would not go away till i restart apache.
So far my Datacenter techs. have not been able to identify the cause of this.
View 14 Replies
View Related
Dec 3, 2007
An user is reporting this error receiving emails:
451 - The server has reached its limit for processing requests from your host
I've searched for this error message but haven't found much info
View 3 Replies
View Related
Jan 31, 2008
Yesterday I installed tomcat on a RHEL 4 + cPanel and httpd 2.0.63 server using easyapache3, process was ok, jsp pages are loading fine using http://site.com/example.jsp , but servlets, are not working using http://site.com/example, how ever, if I load http://site.com:8080/example it loads the servlet perfect.
I read something about redirecting all traffict from port 80 to 8080, but you know.. this is a shared server, and that would affect all customers on the server.
So, mod_jk seems to be the only solution, now I read many documents over the web, but no one seems to be working to configure apache2 and mod_jk that is installed using easyapache3 script.
In my httpd.conf file, i have this:
LoadModule jk_module modules/mod_jk.so
Include "/usr/local/apache/conf/jk.conf"
At jk.conf i have this content: ...
View 5 Replies
View Related