113.96.109.157 - - [07/Mar/2019:08:07:03 +0800] "GET /test.html HTTP/1.1" 404 132 "-" "Go-http-client/1.1" 119.147.39.151 - - [07/Mar/2019:08:07:03 +0800] "GET /test.html HTTP/1.1" 404 132 "-" "Go-http-client/1.1" 121.12.109.39 - - [07/Mar/2019:08:07:03 +0800] "GET /test.html HTTP/1.1" 404 132 "-" "Go-http-client/1.1" 47.106.50.155 - - [07/Mar/2019:08:07:03 +0800] "GET /test.html HTTP/1.1" 404 132 "-" "Go-http-client/1.1" 202.108.249.153 - - [07/Mar/2019:08:07:04 +0800] "GET /test.html HTTP/1.1" 404 132 "-" "Go-http-client/1.1" 60.221.194.35 - - [07/Mar/2019:08:07:05 +0800] "GET /test.html HTTP/1.1" 404 132 "-" "Go-http-client/1.1" 202.99.114.204 - - [07/Mar/2019:08:07:05 +0800] "GET /test.html HTTP/1.1" 404 132 "-" "Go-http-client/1.1" 117.27.235.150 - - [07/Mar/2019:08:07:05 +0800] "GET /test.html HTTP/1.1" 404 132 "-" "Go-http-client/1.1" 122.156.57.161 - - [07/Mar/2019:08:07:05 +0800] "GET /test.html HTTP/1.1" 404 132 "-" "Go-http-client/1.1" 123.6.31.154 - - [07/Mar/2019:08:07:05 +0800] "GET /test.html HTTP/1.1" 404 132 "-" "Go-http-client/1.1" 113.6.227.203 - - [07/Mar/2019:08:07:05 +0800] "GET /test.html HTTP/1.1" 404 132 "-" "Go-http-client/1.1" 121.22.229.26 - - [07/Mar/2019:08:07:06 +0800] "GET /test.html HTTP/1.1" 404 132 "-" "Go-http-client/1.1" 39.96.119.23 - - [07/Mar/2019:08:07:06 +0800] "GET /test.html HTTP/1.1" 404 132 "-" "Go-http-client/1.1" 183.214.130.150 - - [07/Mar/2019:08:07:07 +0800] "GET /test.html HTTP/1.1" 404 132 "-" "Go-http-client/1.1" 120.223.240.35 - - [07/Mar/2019:08:07:07 +0800] "GET /test.html HTTP/1.1" 404 132 "-" "Go-http-client/1.1" 39.96.135.227 - - [07/Mar/2019:08:07:07 +0800] "GET /test.html HTTP/1.1" 404 132 "-" "Go-http-client/1.1" 120.221.154.209 - - [07/Mar/2019:08:07:08 +0800] "GET /test.html HTTP/1.1" 404 132 "-" "Go-http-client/1.1" 118.31.194.149 - - [07/Mar/2019:08:07:08 +0800] "GET /test.html HTTP/1.1" 404 132 "-" "Go-http-client/1.1" 61.168.101.24 - - [07/Mar/2019:08:07:08 +0800] "GET /test.html HTTP/1.1" 404 132 "-" "Go-http-client/1.1" 58.20.147.25 - - [07/Mar/2019:08:07:09 +0800] "GET /test.html HTTP/1.1" 404 132 "-" "Go-http-client/1.1" 118.112.13.205 - - [07/Mar/2019:08:07:10 +0800] "GET /test.html HTTP/1.1" 404 132 "-" "Go-http-client/1.1" 39.96.151.171 - - [07/Mar/2019:08:07:11 +0800] "GET /test.html HTTP/1.1" 404 132 "-" "Go-http-client/1.1" 119.167.151.155 - - [07/Mar/2019:08:07:11 +0800] "GET /test.html HTTP/1.1" 404 132 "-" "Go-http-client/1.1" 27.221.56.150 - - [07/Mar/2019:08:07:11 +0800] "GET /test.html HTTP/1.1" 404 132 "-" "Go-http-client/1.1" 106.60.80.28 - - [07/Mar/2019:08:07:12 +0800] "GET /test.html HTTP/1.1" 404 132 "-" "Go-http-client/1.1" 120.201.253.38 - - [07/Mar/2019:08:07:12 +0800] "GET /test.html HTTP/1.1" 404 132 "-" "Go-http-client/1.1" 111.6.251.48 - - [07/Mar/2019:08:07:12 +0800] "GET /test.html HTTP/1.1" 404 132 "-" "Go-http-client/1.1" 223.111.105.160 - - [07/Mar/2019:08:07:13 +0800] "GET /test.html HTTP/1.1" 404 132 "-" "Go-http-client/1.1" 183.213.20.27 - - [07/Mar/2019:08:07:13 +0800] "GET /test.html HTTP/1.1" 404 132 "-" "Go-http-client/1.1" 119.23.169.196 - - [07/Mar/2019:08:07:13 +0800] "GET /test.html HTTP/1.1" 404 132 "-" "Go-http-client/1.1" 112.29.216.161 - - [07/Mar/2019:08:07:13 +0800] "GET /test.html HTTP/1.1" 404 132 "-" "Go-http-client/1.1" 124.239.234.163 - - [07/Mar/2019:08:07:13 +0800] "GET /test.html HTTP/1.1" 404 132 "-" "Go-http-client/1.1" 61.163.8.22 - - [07/Mar/2019:08:07:14 +0800] "GET /test.html HTTP/1.1" 404 132 "-" "Go-http-client/1.1" 118.190.214.147 - - [07/Mar/2019:08:07:15 +0800] "GET /test.html HTTP/1.1" 404 132 "-" "Go-http-client/1.1" 140.205.253.144 - - [07/Mar/2019:08:07:15 +0800] "GET /test.html HTTP/1.1" 404 132 "-" "Go-http-client/1.1" 111.48.30.40 - - [07/Mar/2019:08:07:15 +0800] "GET /test.html HTTP/1.1" 404 132 "-" "Go-http-client/1.1" 27.221.92.164 - - [07/Mar/2019:08:07:15 +0800] "GET /test.html HTTP/1.1" 404 132 "-" "Go-http-client/1.1
1
Humorce 2019-03-07 11:00:33 +08:00
所以这个页面是干什么的呢
|
2
zhuzhiqiang OP @Humorce 没这个页面 返回的 404
|
3
Humorce 2019-03-07 11:07:41 +08:00
域名是新买的?
这个时间密度,先更改配置 Block 掉此 UA 吧 |
4
zhuzhiqiang OP @Humorce 403 了 还有什么好的解决办法吗 还一直在访问 [捂脸]
|
5
blless 2019-03-07 12:41:55 +08:00 via Android
404 都能跑满 CPU 吗
|
6
fiht 2019-03-07 12:49:29 +08:00
Go-http-client 这个是 go 语言程序呀
|
7
zhuzhiqiang OP @blless 我觉得也不至于啊 大佬 看下 CPU 和 TCP
|
8
Steps 2019-03-07 13:06:22 +08:00
是否使用了负载均衡?
我的站跟你一模一样的情况,我过滤了 UA 直接给 503 了 现在一共跑了 一千多万次吧。。。 |
9
claysec 2019-03-07 13:16:54 +08:00
@zhuzhiqiang 接个 cdn 让他慢慢跑呗
|
10
zhuzhiqiang OP @Steps 没有使用均衡负载服务 就 Nginx 做了个热备
|
11
boris1993 2019-03-07 13:21:09 +08:00 via Android 2
返回个 gzip 炸弹?
|
12
zhuzhiqiang OP @Steps 老哥你的也是这个 UA 吗
|
13
Vhc 2019-03-07 13:25:19 +08:00
1、这个访问频次并不高,CPU 占用和这一毛钱关系也没有。
2、千万不要屏蔽 "Go-http-client/1.1" 这个 UA |
14
dbpe 2019-03-07 13:27:42 +08:00
新知识..GZIp Boom..
|
15
gamexg 2019-03-07 13:31:11 +08:00
跳转到 ubuntu iso ?
|
17
zhuzhiqiang OP @Vhc 大佬 怎么说
|
18
CallMeReznov 2019-03-07 13:46:55 +08:00
@Vhc 为什么不能屏蔽?
|
19
Steps 2019-03-07 13:53:06 +08:00
|
20
LanAiFaZuo 2019-03-07 13:54:17 +08:00
我昨天到今天也是 cpu 爆满,用的宝塔。不知道是不是被黑了。
|
21
Steps 2019-03-07 14:15:59 +08:00
求高人解决!
|
22
ryd994 2019-03-07 15:07:59 +08:00
直接让 web 服务器给他一个静态页面不就好了。Nginx 和 Apache 都可以轻松实现这个目的。
这点请求量,简单的静态请求不可能打满 CPU。要么有别的恶意请求混在里面。要么这些连接有鬼,比如 HTTP slow post 之类的。tcpdump 抓包分析吧。 |
23
Newbing 2019-03-07 15:30:32 +08:00
我也遇到了,每天几十万次的请求。我后面建立了一个默认的页面。
|
25
Steps 2019-03-07 16:22:04 +08:00
@zhuzhiqiang #12 我是姐姐,还有,我的 问题和你一模一样的
|
26
ryd994 2019-03-07 17:20:53 +08:00 via Android
@Steps 从你贴的 log 估测每秒 5 次,往上加一个数量级,50*24*3600 几百 MB 顶天了。你看到的这些都是烟幕弹。每秒 5 次的请求是不可能打出 100%CPU 的。
你可以直接使用 limit_req 控制频率。也可以写个脚本查 404 的频率,再把恶意 IP 加到 ipset 里让 iptables 过滤。 你先把 log 过滤一遍,看还有其他什么鬼。然后还是抓包分析。 不必屏蔽 UA:1.已经是 404 了,屏蔽 UA 也减少不了多少压力 2.换个 UA 还不简单? |
27
opengps 2019-03-07 17:25:57 +08:00
404 不应该导致 cpu 爆满吧
|
28
SakuraKuma 2019-03-07 18:18:43 +08:00 via Android
fail2ban 检查到这个 test 封 ip
|
29
Marsss 2019-03-07 18:24:56 +08:00 via iPhone
触发验证码给他
|
30
Steps 2019-03-07 18:32:55 +08:00
|
31
Steps 2019-03-07 18:33:54 +08:00
|
32
zhuzhiqiang OP @CallMeReznov
@Humorce @LanAiFaZuo @Marsss @Newbing @SakuraKuma @Steps @Vhc @blless @boris1993 感谢各位 问题已经找到了 不是恶意访问造成的 CPU 100 如果不是 cpu100 还真发现不了这个恶意访问 [捂脸] |
33
Steps 2019-03-08 13:58:48 +08:00
|
34
zhuzhiqiang OP @Steps 恶意访问我也没办法 IP 动态的
导致 CPU100 的问题是 业务写的有问题 SQL 慢查询 [逃跑] |
35
zhuzhiqiang OP @Steps 姐姐 我刚刚 awk 统计了下 nginx log /test.html 5 个小时跑了 269247 次[捂脸]
|
36
Steps 2019-03-08 21:06:47 +08:00
|
38
WanJiJun 2019-04-03 17:35:23 +08:00
是阿里云动态 CDN 搞的吧,我之前也这样,后来看 https://www.v2ex.com/t/543424,关掉动态加速恢复正常了。
|