--=-3ju7/Z5KhyO8SK89vDk9 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Le mardi 17 juin 2014 =C3=A0 16:03 +0200, Sandro Bonazzola a =C3=A9crit :
Il 17/06/2014 15:47, Michael Scherer ha scritto:
Hi, =20 Brian pinged me on a failure on lists.ovirt.org around 13h15 UTC. After scratching my head for a while ( since everything was running fine, despites regular Out of memory on the server ), it turned out to be a user trying to get the iso with a download accelerator. I first added more server, but without luck. =20 So as I am more of the kind "shoot first, ask later", I did kill the connexion with iptables, then limit it with iptables ( but with some side effect ), then installed mod_limitipconn to limit to 10 tcp connexion per IP.=20 =20 in short : - yum install mod_limitipconn - add=20 <IfModule mod_limitipconn.c> MaxConnPerIP 10 </IfModule> to /etc/httpd/conf.d/resources.ovirt.org.conf =20 I guess we should add this in some puppet module somewhere ? =20 Maybe also limit bandwidth per IP?
For now, the issue was more the ressources used serverside ( ie, 1 httpd slot per request ). Limit per IP could make sense, I didn't look at a supported apache module. Seems there is mod_bw for that. --=20 Michael Scherer Open Source and Standards, Sysadmin --=-3ju7/Z5KhyO8SK89vDk9 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part Content-Transfer-Encoding: 7bit -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) iQIcBAABAgAGBQJToFU4AAoJEE89Wa+PrSK9jyEP/2alxR0yC4F9Nl00PDdn+pAi f3RrxvaN1h6UAit4qsszfOhVmvcXs2ILbdfMO3Fuq04QiVCcptZZpo0YlmLWEgIW ZjI3lT9ejH6Z5GBTSvtftJygLicjnLcpofS/eHM/VlPhoYBUusBjuILWPKnbe5pi 5j/wJKHYteWbO1N6Gsd3AEGr1N/elaIoeN6x+ZGzSKRgXwz8WSBghkl1gdq1E2bi eQH/55z9ospIwfcJNUC6pwpF2+eOORyMSm68bHjTuznmu+M16EF0s/x2/l+8qHRw mqQRZtE/KPehw/ro+xXcoE7Ga5Ti9/Vn6S7+BgSBFpmDTqfVJOAyW7eNc2jEatpH 7boqajw7hYw61v/42k+huaiTW5yrhpIG5PiwGPEEb3Ph4FzArCMStqUXiO6xn65S lLTzZnnJX6lRVisu5Zrn4P1PpJoG5E2yH1oR/s7TUbjRRE4DkOhgUcXk3m4iOEck 82xE+JYxNOLXM1FuvqeoAosTkXfIqPEd2GjvC0b2AbFKNDmw4qcJvWmUBdk4tsrG 0TQ2rF71AZ2v9WsuAkD/Gd8VM5+wDN0rhNyAlbHXeiMJskO5e6RLM8yrgkoHXiXH +DKAyk7X9R5C/f5U9EhCzHV599vuXbQcJA/rqERAVvsaAilp/02Nqvp0IRhumIaN LeyC2+1gFva8aPFunSf5 =XCj1 -----END PGP SIGNATURE----- --=-3ju7/Z5KhyO8SK89vDk9--