| Daanct12 | TMO seems to be very busy atm | 13:55 |
|---|---|---|
| Daanct12 | what's going on? | 13:55 |
| joerg | hmmm | 16:24 |
| joerg | cmd: ssh italk uptime > 15:27:06 up 625 days, 14:08, 1 user, load average: 3.38, 5.69, 5.41 | 16:27 |
| joerg | mysqld. Maybe a backup? | 16:29 |
| sixwheeledbeast | been like that for 24h> | 16:34 |
| joerg | please elaborate | 17:07 |
| joerg | what are the symptoms? | 17:07 |
| joerg | slow? | 17:08 |
| joerg | seems it's at 100% on both cores | 17:09 |
| joerg | 57.141.0.0 | 17:11 |
| joerg | oops | 17:11 |
| joerg | % Information related to '57.141.0.0 - 57.149.255.255' | 17:13 |
| joerg | % Abuse contact for '57.141.0.0 - 57.149.255.255' is 'domain@fb.com' | 17:13 |
| joerg | somebody is running a multi-source 57.141.0.* massive query | 17:14 |
| joerg | https://termbin.com/wbc1 | 17:15 |
| sixwheeledbeast | sorry afk a lot at the moment. seems you found it. | 17:25 |
| joerg | yeah, but no clue how to mitigate it | 17:26 |
| joerg | *somewhere* I seen a *nospam* or the like file. Can't find any such thing on tmo | 17:27 |
| joerg | noforumspam? | 17:28 |
| sixwheeledbeast | what to limit 57.141.0.0/16 ? | 17:35 |
| joerg | yes | 17:44 |
| joerg | gosh! ipdeny_stopforumspam.conf | 17:44 |
| joerg | cmd: ssh italk ls -l /etc/apache2/custom.d/ipdeny_stopforumspam.conf >-rw-r--r-- 1 root root 6968572 Nov 19 16:20 /etc/apache2/custom.d/ipdeny_stopforumspam.conf | 17:46 |
| joerg | echo "deny from 57.141.0.0/16" >>/etc/apache2/custom.d/ipdeny_stopforumspam.conf ? I'm pretty sure this file is auto-generated and any edits will vanish within unspecified timespan | 17:50 |
| joerg | make that /24, not /16 | 17:51 |
| joerg | let's see if that works, and for how long | 17:56 |
| joerg | for now, looks good | 17:57 |
| joerg | cmd: ssh italk uptime > 16:57:24 up 625 days, 15:38, 1 user, load average: 1.02, 3.02, 3.96 | 17:57 |
| joerg | cmd: ssh italk uptime > 16:57:59 up 625 days, 15:39, 1 user, load average: 0.57, 2.68, 3.82 | 17:57 |
| joerg | cmd: ssh italk uptime > 16:59:54 up 625 days, 15:41, 1 user, load average: 0.08, 1.83, 3.37 | 17:59 |
| sixwheeledbeast | /16 is all the same assignment according to whois? | 18:02 |
| joerg | yeah, but the offenders were all 57.141.0.* | 18:11 |
| joerg | nfc what this got to do with damn facebook | 18:12 |
| joerg | Meta :-S | 18:12 |
| joerg | cmd: ssh italk uptime > 17:18:25 up 625 days, 15:59, 1 user, load average: 0.27, 0.31, 1.22 | 18:18 |
| joerg | cmd: ssh italk ls -l /etc/apache2/custom.d/ipdeny_stopforumspam.conf >-rw-r--r-- 1 root root 6968596 Nov 19 16:54 /etc/apache2/custom.d/ipdeny_stopforumspam.conf | 18:18 |
| joerg | I really wonder what facebook is doing with that IP range: '57.141.0.0 - 57.149.255.255' is 'domain@fb.com' | 18:21 |
| joerg | seems fixed *for now* anyway | 18:22 |
| joerg | ohmy! "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" | 18:26 |
| joerg | robots.txt it is, eh? | 18:27 |
| joerg | cmd: ssh italk ls -l /etc/apache2/custom.d/ipdeny_stopforumspam.conf >-rw-r--r-- 1 root root 6972173 Nov 19 17:20 /etc/apache2/custom.d/ipdeny_stopforumspam.conf | 18:27 |
| joerg | my patch gone | 18:27 |
| joerg | https://i.imgur.com/XhsJpHg.jpeg next try | 18:33 |
| joerg | sixwheeledbeast: please holler if it acts up again | 18:39 |
| joerg | so far looks good | 18:41 |
| joerg | error.log: | 18:41 |
| joerg | [Tue Nov 19 17:39:14 2024] [error] [client 57.141.0.23] client denied by server configuration: /var/www/attachment.php | 18:41 |
| joerg | [Tue Nov 19 17:39:23 2024] [error] [client 69.171.249.114] client denied by server configuration: /var/www/forumdisplay.php | 18:41 |
| sixwheeledbeast | I haven't really been about much. I have had the "server is busy try later message" before and it's usually resolved itself within 5 minutes. | 18:42 |
| joerg | cmd: ssh italk uptime > 17:42:42 up 625 days, 16:24, 1 user, load average: 0.22, 0.76, 1.25 | 18:42 |
| * joerg waves and heads out | 18:43 | |
Generated by irclog2html.py 2.17.0 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!
