Bandwidth surges and hundreds of requests in logs - Strange Behaviour

So, beginners luck I guess...
Basically set up a client site to redirect from our existing site www.abc.com (hosted externally) so the client portion would direct to client.abc.com.
I had all the internal stuff setup correctly, dns for the client.domain.com pointed to our external ip and the everything was hitting the right spots internally and externally. Within probably 12 hours, the server started experiencing sluggish performance, the cpu usage was never at anything less than 50%, the webserver was getting about 29 hits per second and chewing through bandwidth.
!http://i56.tinypic.com/35hk0w8.png!
!http://i53.tinypic.com/2kijyc.png!
After looking at the webserver logs, there were lots of random entries that I can't explain.
!http://i53.tinypic.com/24dftxy.png!
After this happening we deleted the external dns record so that client.abc.com wouldn't point to our external ip and left it for the weekend. Coming back on monday, we've chewed through about 25 gig of traffic so it appears that it may take a while for our host to propagate dns fully...
I have turned off web services and the bandwidth and cpu usage went down and we're back to normal now. I've also restored from a time machine backup so there are no actual remains of anything to do with the modifications we made. (which is what makes me think that dns has not fully propagated as aside from the web settings, was the only thing that changed)
The software in question was a PHP file manager called mollify that was running on the client portion. Can anybody explain what was happening with the server and why it got all these random hits and chewed through bandwidth? We're running an external firewall with only a bunch of necessary ports forwarded (mail, web, ftp, vpn ect)
I need to get this software up and running soon so any helpful info on how to fix the network would be great. Anything you need to know just ask!
Thanks!

under settings>proxy the 'enable forward proxy' is turned on.
Yes, that's what you need to turn off. Absolutely.
This allows clients to connect to the server and request content from some other site. The server then retrieves that content and delivers it to the client, potentially caching it so that subsequent requests can be served from the cache rather than requiring another round-trip to the origin server.
In your current setup you're allowing anyone, anywhere, to connect to your server and request content from any other server on the internet. That's bad. That's why your bandwidth has spiked. It's why your CPU is running hot. It's why your logs are large (and growing fast).
If enabled _at all_, the forward proxy should only be available to clients on your LAN, so that it can cache common requests from your internal clients. For now I just suggest turning it off completely.

Similar Messages

  • RMAN Restore Error - media recovery requesting unknown log: thread 1 seq 7

    Im using RMAN to copy a database to another server. The new server is IDENTICAL to the old one. By identical I mean it has the same sever name, ip address, operating system, Oracle version and directory structure.
    The new server already has the instance created, (same name as the old server instance, paths etc)
    The backup files have been manually restored to the new server, same locations as they were on the old one. ( RMAN did an automatic controlfile backup and also the archivelogs on the old server ).
    Ive restored the control file on the new server from the RMAN backup pieces.
    Ive catalogued the RMAN backup pieces on the new server.
    I know the last sequence available in the archivelogs backup by running on the new server :
    list backup of archivelog all;
    List of Backup Sets
    ===================
    BS Key Size Device Type Elapsed Time Completion Time
    5 14.43M DISK 00:00:03 11-MAY-11
    BP Key: 9 Status: AVAILABLE Compressed: NO Tag: TAG20110511T163502
    Piece Name: C:\ORACLE\PRODUCT\10.2.0\FLASH_RECOVERY_AREA\SAT\BACKUPSET\
    011_05_11\O1_MF_ANNNN_TAG20110511T163502_6WOC5833_.BKP
    List of Archived Logs in backup set 5
    Thrd Seq Low SCN Low Time Next SCN Next Time
    1 2 550217 10-MAY-11 556559 11-MAY-11
    1 3 556559 11-MAY-11 559776 11-MAY-11
    1 4 559776 11-MAY-11 560093 11-MAY-11
    1 5 560093 11-MAY-11 560794 11-MAY-11
    BS Key Size Device Type Elapsed Time Completion Time
    7 15.50K DISK 00:00:01 11-MAY-11
    BP Key: 10 Status: AVAILABLE Compressed: NO Tag: TAG20110511T163653
    Piece Name: C:\ORACLE\PRODUCT\10.2.0\FLASH_RECOVERY_AREA\SAT\BACKUPSET\
    011_05_11\O1_MF_ANNNN_TAG20110511T163653_6WOC8PMP_.BKP
    List of Archived Logs in backup set 7
    Thrd Seq Low SCN Low Time Next SCN Next Time
    1 6 560794 11-MAY-11 560851 11-MAY-11
    So far its all going swimmingly well.
    Now I want to restore the datafiles and recover. So I ran :
    RMAN run { restore database; recover database; alter database open resetlogs; }
    This gave me the output below which goes great but I get a final error, I think the error is because its looking for an archive log thats not in the backup set, but it should be. However, I think SCN 560851 is for a log that hadnt been created yet on the old server when the backup was ran ?
    How do I address resolving the error ? Its worth pointing out log, "archive log filename=C:\ORACLE\PRODUCT\10.2.0\FLASH_RECOVERY_AREA\SAT\ARCHIVELOG
    \2011_05_11\O1_MF_1_6_6WOK1X4W_.ARC recid=10 stamp=750881741" isnt on the old server either which is why its not in the backup set.
    I can do a alter database open reset logs but Id prefer to know why its failing.
    Any help would be much appreciated.
    RMAN> run { restore database; recover database; alter database open resetlogs; }
    Starting restore at 11-MAY-11
    using channel ORA_DISK_1
    channel ORA_DISK_1: starting datafile backupset restore
    channel ORA_DISK_1: specifying datafile(s) to restore from backup set
    restoring datafile 00001 to C:\ORACLE\PRODUCT\10.2.0\ORADATA\SAT\SYSTEM01.DBF
    restoring datafile 00002 to C:\ORACLE\PRODUCT\10.2.0\ORADATA\SAT\UNDOTBS01.DBF
    restoring datafile 00003 to C:\ORACLE\PRODUCT\10.2.0\ORADATA\SAT\SYSAUX01.DBF
    restoring datafile 00004 to C:\ORACLE\PRODUCT\10.2.0\ORADATA\SAT\USERS01.DBF
    channel ORA_DISK_1: reading from backup piece C:\ORACLE\PRODUCT\10.2.0\FLASH_REC
    OVERY_AREA\SAT\BACKUPSET\2011_05_11\O1_MF_NNNDF_TAG20110511T163507_6WOC5CM7_.BKP
    channel ORA_DISK_1: restored backup piece 1
    piece handle=C:\ORACLE\PRODUCT\10.2.0\FLASH_RECOVERY_AREA\SAT\BACKUPSET\2011_05_
    11\O1_MF_NNNDF_TAG20110511T163507_6WOC5CM7_.BKP tag=TAG20110511T163507
    channel ORA_DISK_1: restore complete, elapsed time: 00:00:55
    Finished restore at 11-MAY-11
    Starting recover at 11-MAY-11
    using channel ORA_DISK_1
    starting media recovery
    channel ORA_DISK_1: starting archive log restore to default destination
    channel ORA_DISK_1: restoring archive log
    archive log thread=1 sequence=6
    channel ORA_DISK_1: reading from backup piece C:\ORACLE\PRODUCT\10.2.0\FLASH_REC
    OVERY_AREA\SAT\BACKUPSET\2011_05_11\O1_MF_ANNNN_TAG20110511T163653_6WOC8PMP_.BKP
    channel ORA_DISK_1: restored backup piece 1
    piece handle=C:\ORACLE\PRODUCT\10.2.0\FLASH_RECOVERY_AREA\SAT\BACKUPSET\2011_05_
    11\O1_MF_ANNNN_TAG20110511T163653_6WOC8PMP_.BKP tag=TAG20110511T163653
    channel ORA_DISK_1: restore complete, elapsed time: 00:00:01
    archive log filename=C:\ORACLE\PRODUCT\10.2.0\FLASH_RECOVERY_AREA\SAT\ARCHIVELOG
    \2011_05_11\O1_MF_1_6_6WOK1X4W_.ARC thread=1 sequence=6
    channel default: deleting archive log(s)
    archive log filename=C:\ORACLE\PRODUCT\10.2.0\FLASH_RECOVERY_AREA\SAT\ARCHIVELOG
    \2011_05_11\O1_MF_1_6_6WOK1X4W_.ARC recid=10 stamp=750881741
    unable to find archive log
    archive log thread=1 sequence=7
    RMAN-00571: ===========================================================
    RMAN-00569: =============== ERROR MESSAGE STACK FOLLOWS ===============
    RMAN-00571: ===========================================================
    RMAN-03002: failure of recover command at 05/11/2011 18:15:42
    RMAN-06054: media recovery requesting unknown log: thread 1 seq 7 lowscn 560851
    RMAN>
    Edited by: user12173666 on 11-May-2011 10:28

    You need to do incomplete recovery i.e. to ask RMAN to restore/recover to some specific point in time. This is usually done with some UNTIL clause or SET UNTIL statement. Example in your case:
    SET UNTIL SEQUENCE 7;See http://download.oracle.com/docs/cd/B19306_01/backup.102/b14194/rcmsynta065.htm#RCMRF160.

  • Access request Audit log

    Hi experts,
    For all the access requests we are getting the complete audit trail and Even we will get whether Risk Analysis is scheduled in the Workflow.
    But is there any possibility to get the output of Risk Analysis in the audit trail?
    Please suggest.
    Thanks,

    Hi Sriram,
    in standard solution what you can see in audit log is the information risk analysis during access request was executed, there is no standard way to see this information in audit log.
    If you go for abap customization, please note this information is usualy very big and long and adding it to audit log my simply make audit log unclear...and very much complicated.
    Hope this helps,
    Filip

  • I try to run photoshop and it says i cannot log in and to try later or make sure im connected to the internet which i am?...

    i try to run photoshop and it says i cannot log in and to try later or make sure im connected to the internet which i am?...

    If you are using someone else's WiFi they may have restrictions in place.
      (cofee shop, etc..)
    Have you tried connecting using at least more than one particular WiFi network ?
    You might want to try googling for a bandwidth test site
      verify you have reasonable throughput..
        1 megabit up and 1 megabit down..
          (bandwidthplace.com is what I typically use..)

  • HT201356 I have accidentally deleted my alternate iCloud (email) address. Are there any possibilities to retrieve it back because my iPad is connected to that email address, and now, I can't log out from it on my iPad, because it doesn't exist?

    I have accidentally deleted my alternate iCloud (email) address. Are there any possibilities to retrieve it back because my iPad is connected to that email address, and now, I can't log out from it on my iPad, because it doesn't exist.
    I have alternate icloud email attached to my iPad and I accidentally delete it from appleid.apple.com. And now I can't log out that iCloud account because it doesn't exist and it can't recognize my password.

    If you mean that Find My Phone is asking for a password to a different Apple ID to your current Apple IDand that ID is a previous version of your current ID, not an entirely different one.
    This feature has been introduced to make stolen phones useless to those that have stolen them.
    However it can also arise when the user has changed their Apple ID details with Apple and not made the same changes to their iCloud account/Find My Phone on their device before upgrading to iOS 7, or if you restore from a previous back up made before you changed your details and some other circumstances.
    The only solution is to change your Apple ID back to its previous state with Apple at My Apple ID using your current password, you don’t need access to this address if it’s previously been used with your Apple ID, once you have saved these details enter the password as requested on your device and then turn off "find my phone" and delete the account from your device. It may take a short while to remove the account.
    You should then change your Apple ID back to its current state, save it once again and then log back in using your current Apple ID. Finally, turn "find my phone" back on once again.
    This article provides more information about Activation Lock.

  • GRC Access requests - Audit Log

    Dear All, GRC access requests is noticed with Provisioning failed messages. Access Request Audit Log is displayed with " Log on Failed / CPI - CALL: ThSAPCMRCV " message ( Screen shot enclosed ). Could you please share an insight on these messages and it's resolution. Thanks raj 

    Dear Raj,
    please check with your basis team if the connection to the system works. Basically it seems like you have a connection error as the log on does not work.
    Regards,
    Alessandro

  • HT2186 I just bought an iMac, while setting it up I was prompted to update the OS software. I tried to update it. It won't complete the update, and says "Error- requested timed out. (102) what does that mean? how do I fix it?

    I just bought an iMac, while setting it up I was prompted to update the OS software. I tried to update it. It won't complete the update, and says "Error- requested timed out. (102) what does that mean? how do I fix it?

    If you have more than one user account, these instructions must be carried out as an administrator.
    Launch the Console application in any of the following ways:
    ☞ Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)
    ☞ In the Finder, select Go ▹ Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.
    ☞ Open LaunchPad. Click Utilities, then Console in the icon grid.
    Select "/var/log/install.log" from the file list on the left. If you don't see that list, select
    View ▹ Show Log List
    from the menu bar. Then select the messages from the last installation or update attempt, starting from the time when you initiated it. If you're not sure when that was, start over and note the time. Copy them to the Clipboard (command-C). Paste into a reply to this message (command-V).
    If there are runs of repeated messages, post only one example of each. Don’t post many repetitions of the same message.
    When posting a log extract, be selective. Don't post more than is requested.
    Please do not indiscriminately dump thousands of lines from the log into this discussion.
    Important: Some private information, such as your name, may appear in the log. Edit it out by search-and-replace in a text editor before posting.

  • I am trying to use ichat and when I try to log in it says my account has been suspended bc of suspicious use...help

    i am trying to use ichat and when I try to log in it says my account has been suspended bc of suspicious use...help

    Hi,
    I would guess this is  an AIM valid Screen Name such as an Apple issued @mac.com account.
    I would also guess you travel to other countries.
    There have been several posts about @mac.com names and people who travel and use their Screen Name elsewhere having the name Suspended.
    Can you Log in here  https://settings.aim.com/ ?
    Is this where you saw the Suspended message ?
    For AIM issued name the answer is to change your Password as this tends to prove you own the account.
    This does not work for Apple IDs used as  AIM Valid Screen Names as AIM can't tell when the password is changed (They can only see it when you log in)
    AIM's Suspended Account page has an email ([email protected]) on it to contact if your account remains Suspended.
    However you need to be very clear that you have an Apple Issued Name and that you know that resetting the password that works for AIM Names and that you would like them to reset the account.
    More recently this has been a sticking point.  It seems the Contact you get does not always know about the agreement that AIM recognises Apple Issued IDs as Valid Screen Names and that the AIM  servers can only view the passwords at specific times (or at least confirm them) so you changing it will make no difference and that they have to step in manually.
    10:39 PM      Saturday; October 20, 2012
    Please, if posting Logs, do not post any Log info after the line "Binary Images for iChat"
      iMac 2.5Ghz 5i 2011 (Mountain Lion 10.8.2)
     G4/1GhzDual MDD (Leopard 10.5.8)
     MacBookPro 2Gb (Snow Leopard 10.6.8)
     Mac OS X (10.6.8),
     Couple of iPhones and an iPad
    "Limit the Logs to the Bits above Binary Images."  No, Seriously

  • I need help with resetting my ichat. When i try to login now it wont let me... it says "AOL Instant Messenger password" and then "iChat can't log in to ... because your login ID or password is incorrect. How do I reset this if I cant log in?

    I need help with resetting my ichat. When i try to login now it wont let me... it says "AOL Instant Messenger password" and then "iChat can't log in to ... because your login ID or password is incorrect. How do I reset this if I cant log in? When I try to press online the same thing pops up and I have no way of logging in or asking for help.

    Hi,
    iChat (it would help to know which version) can accept Apple IDs as valid AIM Screen Names.
    However if you have iChat 5 or earlier you cannot use ones ending in @me.com or @icloud.com issued by iCloud. (they can be used in iChat 6 or Messages as these versions make a double login to AIM and Apple to allow the use of the password).
    In addition if you are using an Apple ID for an AIM Screen Name the password still needs to keep to the 16 character limit that AIM has.
    AN @mac.com name can be used on any version of iChat  (Until the 30th June 2014)
    As it does not need a double check with Apple you can use it to log in to the AIM Web pages
    Login here with an AIM Name registered at AIM or and @mac.com name and see if you get any suspended account messages.
    Sometimes account can be suspended. Usually because something has triggered the "Unusual Activity" item.
    About a year ago many @mac.com users that travelled out of their own country found themselves suspended when they got home.
    If the Name checks out of if an Apple ID the password in known to be 16 characters or Less then do this:-
    In Lion upwards open a Finder Window and use the Go Menu whilst holding down the ALT key.
    Select the Library that appears in the menu list.
    Navigate to Preferences.
    (If you have version earlier than Lion the just navigate to ~/Library/Preferences (that's the Library in you Home - Little House icon - folder)
    Fnd com.apple.ichat.aim.plist (even if you are using Messages)
    Drag the file to the Trash and Restart the app.
    7:39 pm      Thursday; May 29, 2014
    ​  iMac 2.5Ghz i5 2011 (Mavericks 10.9)
     G4/1GhzDual MDD (Leopard 10.5.8)
     MacBookPro 2Gb (Snow Leopard 10.6.8)
     Mac OS X (10.6.8),
     Couple of iPhones and an iPad

  • "I just updated the software on my iphone 4 and prior to updating I could double click and start the camera without logging in, now I can't.  How do I fix?

    I just updated the software on my iphone 4 and prior to updating I could double click and start the camera without logging in, now I can't.  How do I fix?

    Nothing to fix...things have changed...slide the camera icon up now..no more double tap.

  • I was in Lightroom and had a power surge and now Lightroom will not launch....what can I do to fix it?

    I was in Lightroom and had a power surge and now Lightroom will not launch. It encountered an error when reading from its preview cache and needs to quit. Lightroom will attempt to fix the next time it launches. I have shut my system down and Lightroom still will not launch. Does anyone have any suggestions?

    delete your preview cache (.lrdata folder).
    Here has location:
    Preference and other file locations in Lightroom 5
    If not enough info, search this forum for "delete preview cache".
    Rob

  • RE: Downloading and updating apps. I log in correctly and agree as required; but immediately I am timed out and cannot complete the update or download. Checked on my PC, my password is correct.

    Re: Downloading and updating apps. I log in correctly and agree as required. But before a download happens i get a message "session timed out" and I cannot complete the download. This happens in a matter of seconds. Anyone?

    Have you checked to see if you credit card is out of date?  You may need to update your credit card on file.......

  • ITunes is updated and works fine and I am able to log onto my account. When I go to purchase a song, I get the error message "Your Apple ID has been disabled". I've tried different methods: changing passwords, making a new account with another email addre

    iTunes is updated and works fine and I am able to log onto my account. When I go to purchase a song, I get the error message "Your Apple ID has been disabled". I've tried different methods: changing passwords, making a new account with another email address, and emailing itunes tech support. I am curious as to how many others have been experiencing the same issue. When I googled the error, it seemed like it was happening extremely often with many people.
    We all love their products, but they always come with a lot of issues and horrible customer support.
    My apple Id is [email protected]

    My Iphone 4 is telling me the same thing and I believe I figured out what the problem is.  I had some fraudulent charges on my itunes account, so I call my bank and disputed the charges.  Right after I did that, I started getting the message "Your apple ID has been disabled."  I just realized today that the charges are not fraudulent, they are "in app purchases."  One of my daughters downloaded the game Top Girl which is FREE, but in the game Top Girl you use money in the game to purchase things.  It just so happens that the money you use to purchase things is real money MY Money!!!.  My daughter thought she was using play money in the game and had no idea she was using real money.  She spent $106.00 buying stuff.  Now I have to call the bank and tell them to release the hold and pay Itunes.  I'm hoping this solves the problem.  Here is the link to learn how to disable "in app purchase" on your iphone or ipad.
    http://www.ikidapps.com/2010/12/parents-avoid-accidental-app-purchases-how-to-tu rn-off-in-app-purchasing.html

  • I upgraded from 10.4.11 to 10.5.0 using a drop in DVD and now I can't log in...

    I upgraded from 10.4.11 to 10.5.0 using a drop in DVD and now I can't log in...
    This was on a G5 imac. I tried booting to the DVD and resetting the password but this did not help.
    I did see the 2 user accounts still there when I reset the password so that gives me hope that my data is all there intact.
    I need help getting past this login screen PLEASE!    
    The login name is blank and I've tried everything to get past it.
    I heard from a tech that there was a problem when upgrading from 10.4.11 to 10.5.0 instead of the 10.5.3 or whatever, and it was a known issue when using the 10.5.0 disc to upgrade and he said that there was information on apple's site on what to do when this happens but I have not come accross this info as of yet.
    I would really appreciate any help anyone can give me.
    Thanks!!!
    Tim

    OK I finally got passed the above problem by just trying to type it in over and over and over and it finally took!
    It seems as though I may have typed it wrong or misspelled something but I could swear I put it in the same way everytime!
    NOW...
    when I type : passwd username
    replacing username with the short name it says
    paddwd: Unknown user name 'username'
    someone told me that possibly the home folder is still there and intact but the login may have gotten trashed and that i may need to recreate the user login. Does that sound like a possibility?

  • Diff bet credit memo and credit memo request

    Hi
    Can any one tell the difference between Credit Memo and Credit Memo Request
    Thanks in advance

    Hi,
    Below is the information on crdit memo request.
    Definition: A credit memo request is a sales document used in complaints processing to request credit for a customer.
    Use: If the price calculated for the customer was too high (for example, with the wrong scaled prices or because a discount was forgotten), you can create a credit memo request. The credit memo request can be automatically blocked for checking. Once it has been approved, you can remove the block.The system uses the credit memo request to create a credit memo.
    Structure: A credit memo request is another type of sales document like a standard order. For more information on sales documents, see Working with Sales Documents.A credit memo request starts the billing process.
    =============================================
    Below mentioned is the information on Credit Memo.
    Definition: The term credit memo always refers to a credit memo from the vendor. Therefore, posting a credit memo always leads to a debit posting on the vendor account.
    Use: As in the case of invoices, credit memos refer to purchase orders or goods receipts. They are used to correct the purchase order history if the quantity invoiced was too high, for example, if an invoice was too high or if part of the quantity was returned.
    When you post a credit memo, the total quantity in the purchase order history is reduced by the credit memo quantity.
    If you do not want the total quantity invoiced to be reduced, you must post the credit memo as a subsequent credit.
    Hope this helps. Please let me know if you need more information and please assign points.
    Rgds
    Manish

Maybe you are looking for