0

I noticed some slowing on my server earlier today and when I looked into the log files, in between legitimate site requests are blank requests like this:

108.212.75.60 - - [13/Sep/2012:16:56:28 -0400] "-" 408 - "-" "-"

108.212.75.60 - - [13/Sep/2012:16:56:28 -0400] "-" 408 - "-" "-"

108.212.75.60 - - [13/Sep/2012:16:56:28 -0400] "-" 408 - "-" "-"

108.212.75.60 - - [13/Sep/2012:16:56:28 -0400] "-" 408 - "-" "-"

Does anybody have any idea what these might be or how I can prevent them? They seem to be taking up a decent chunk of my server resources.

Community
  • 1
  • 1
Josh Mountain
  • 1,888
  • 10
  • 34
  • 51
  • `They seem to be taking up a decent chunk of my server resources.` - why do you think that? – symcbean Sep 14 '12 at 15:55
  • @symcbean well to be honest this is what my host told me. It is a pretty powerful VPS and ram/cpu/disk are all fine but I think apache is getting clogged with these requests. – Josh Mountain Sep 14 '12 at 16:20

1 Answers1

0

408 is because of timeout,

look for MaxClients and KeepAliveTimeout , 24 and 5 is nice (in order)

if this is a managed server, your admin should look for these.

if these requests are coming from a single ip or a bunch of ips, and if you think this is an attack on purpose, you may ban them via .htaccess.

alpera
  • 509
  • 4
  • 9
  • Currently MaxClients is set to 170 (the site gets a lot of traffic) but KeepAliveTimeout is only at 3, I'll try turning it up and see if that helps. – Josh Mountain Sep 16 '12 at 12:45
  • `MaxClients` and `KeepAliveTimeout` aren't relevant here - these are requests timing out. See http://stackoverflow.com/q/15090897/598726 for more details. `Timeout` and `RequestReadTimeout` (if using `mod_reqtimeout`) are probably the levers to pull, but whether it's worth pulling them is another question. – simpleigh Sep 16 '14 at 08:23