Chào mọi người,
Hiện mình đang quản lý một forum VBB, gần đây site mình có hiện tượng có quá nhiều bot truy cập gây nên việc tắc nghẽn hệ thống làm VPS bị sập.
Mình xin trích một đoạn log lên đây để mọi người xem và đánh giá giúp mình và cho mình xin giải pháp khắc phục (log này mình lấy sau khi đã restart lại VPS và deny các IP gửi quá nhiều request)
Code:
222.254.73.21 - - [25/Jul/2012:20:35:16 +0700] "GET / HTTP/1.0" 403 591 "o91492kd0k8.net" "Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/xxx.x (KHTML like Gecko) Safari/12x.x"
123.18.210.206 - - [25/Jul/2012:20:35:16 +0700] "GET / HTTP/1.0" 403 591 "41kwb84l9.biz" "Mozilla/4.0 (compatible; grub-client-0.3.x; Crawl your own stuff with http://grub.org)"
123.18.210.206 - - [25/Jul/2012:20:35:16 +0700] "GET / HTTP/1.0" 403 591 "72i6c2t79p.com" "Mozilla/5.0 (compatible; XTbot/1.0v; +http://www.0aoo9qs.com)"
222.254.73.21 - - [25/Jul/2012:20:35:16 +0700] "GET / HTTP/1.0" 403 591 "r9qx0fdn01.com" "Mozilla/5.0 (compatible; PagestackerBot; http://www.i164prob47w30.com)"
123.18.210.206 - - [25/Jul/2012:20:35:16 +0700] "GET / HTTP/1.0" 403 591 "04mf5v164170cp.com" "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Skampy/0.9.x [en]"
222.254.73.21 - - [25/Jul/2012:20:35:16 +0700] "GET / HTTP/1.0" 403 591 "z205qavo5150r.com" "Mozilla/4.75C-ja [ja] (X11; U; OSF1 V5.1 alpha)"
123.18.210.206 - - [25/Jul/2012:20:35:16 +0700] "GET / HTTP/1.0" 403 591 "q462qdy21.ru" "Mozilla/3.0 (Vagabondo/2.0 MT; <a href="mailto:webcrawler@rd9a79l85.nl">webcrawler@rd9a79l85.nl</a>; http://1pd5t3di1a.nl/)"
222.254.73.21 - - [25/Jul/2012:20:35:16 +0700] "GET / HTTP/1.0" 403 591 "kh00q54.ru" "Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.0.1) Gecko/20030306 Camino/0.7"
123.18.210.206 - - [25/Jul/2012:20:35:16 +0700] "GET / HTTP/1.0" 403 591 "473gow2lq2hf7.biz" "Mozilla/3.0 (compatible; Fluffy the spider; http://www.searchhippo.com/; <a href="mailto:info@searchhippo.com">info@searchhippo.com</a>)"
222.254.73.21 - - [25/Jul/2012:20:35:16 +0700] "GET / HTTP/1.0" 403 591 "ne9272kl6996.com" "Mozilla/5.0 (compatible; Webduniabot/1.0; +http://search.ryo8pl643yc.com/bot.aspx)"
123.18.210.206 - - [25/Jul/2012:20:35:16 +0700] "GET / HTTP/1.0" 403 591 "0171r1s44.biz" "Mozilla/5.0 (compatible; heritrix/1.5.0-200506231921 http://145l0knq.nla.gov.au/crawl.html)"
222.254.73.21 - - [25/Jul/2012:20:35:16 +0700] "GET / HTTP/1.0" 403 591 "2223xu74new6v9.biz" "Mozilla/3.01 (compatible; AmigaVoyager/2.95; AmigaOS/MC680x0)"
222.254.73.21 - - [25/Jul/2012:20:35:16 +0700] "GET / HTTP/1.0" 403 591 "uo347w9pr47z.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; iRider 2.21.1108; FDM)"
123.18.210.206 - - [25/Jul/2012:20:35:16 +0700] "GET / HTTP/1.0" 403 591 "67hlj10691.net" "Mozilla/4.5 [en]C-CCK-MCD {RuralNet} (Win98; I)"
222.254.73.21 - - [25/Jul/2012:20:35:16 +0700] "GET / HTTP/1.0" 403 591 "qljcd83.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; IBP; .NET CLR 1.1.4322)"
123.18.210.206 - - [25/Jul/2012:20:35:16 +0700] "GET / HTTP/1.0" 403 591 "0155nb713v9td.info" "Mozilla/5.0 (Version: xxxx Type
x)"
222.254.73.21 - - [25/Jul/2012:20:35:16 +0700] "GET / HTTP/1.0" 403 591 "k82t9u77a.info" "Mozilla/4.0 (compatible; MSIE 4.01; Vonna.com b o t)"
123.18.210.206 - - [25/Jul/2012:20:35:16 +0700] "GET / HTTP/1.0" 403 591 "g5tq514n0.net" "Mozilla/5.0 (compatible; Ask Jeeves/Teoma; http://34258510yn.05676p1g0izd8.com/en/docs/about/webmasters.shtml)"
222.254.73.21 - - [25/Jul/2012:20:35:16 +0700] "GET / HTTP/1.0" 403 591 "vklv65j257643.ru" "Mozilla/5.0 (compatible; Konqueror/2.0.1; X11); Supports MD5-Digest; Supports gzip encoding"
123.18.210.206 - - [25/Jul/2012:20:35:16 +0700] "GET / HTTP/1.0" 403 591 "b4o5vvw8l6.net" "Mozilla/2.0"
222.254.73.21 - - [25/Jul/2012:20:35:16 +0700] "GET / HTTP/1.0" 403 591 "6v436o5.biz" "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; SAFEXPLORER TL)"
123.18.210.206 - - [25/Jul/2012:20:35:16 +0700] "GET / HTTP/1.0" 403 591 "7p6qvs08s8yr.info" "Mozilla/5.0 (compatible; SnapPreviewBot; en-US; rv:1.8.0.9) Gecko/20061206 Firefox/1.5.0.9"
222.254.73.21 - - [25/Jul/2012:20:35:16 +0700] "GET / HTTP/1.0" 403 591 "8z9m042.ru" "Mozilla/5.0 (compatible; egothor/8.0g; +http://ego.ms.22v97sg.cuni.cz/)"
123.18.210.206 - - [25/Jul/2012:20:35:16 +0700] "GET / HTTP/1.0" 403 591 "7jk6tdev.info" "Mozilla/5.0 (compatible; Pogodak.hr/3.1)"
222.254.73.21 - - [25/Jul/2012:20:35:16 +0700] "GET / HTTP/1.0" 403 591 "xvu7smg.ru" "Mozilla/4.6 [en] (http://www.cnet.com/)"
222.254.73.21 - - [25/Jul/2012:20:35:16 +0700] "GET / HTTP/1.0" 403 591 "q7xdb6gg.net" "Mozilla/5.0 (compatible; Synoobot/0.9; http://www.01bc75buxxhz.com/82ppi9pi/bot.html)"
123.18.210.206 - - [25/Jul/2012:20:35:16 +0700] "GET / HTTP/1.0" 403 591 "npjvst4z6.com" "Mozilla/5.0 (compatible; SnapPreviewBot; en-US; rv:1.8.0.9) Gecko/20061206 Firefox/1.5.0.9"
222.254.73.21 - - [25/Jul/2012:20:35:16 +0700] "GET / HTTP/1.0" 403 591 "46s7bw7.biz" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; http://www.changedetection.com/bot.html )"
123.18.210.206 - - [25/Jul/2012:20:35:16 +0700] "GET / HTTP/1.0" 403 591 "b9xx2b91.net" "Mozilla/2.0 (compatible; T-H-U-N-D-E-R-S-T-O-N-E)"
222.254.73.21 - - [25/Jul/2012:20:35:16 +0700] "GET / HTTP/1.0" 403 591 "yntqf9.ru" "Mozilla/2.01 (Win16; I)"
123.18.210.206 - - [25/Jul/2012:20:35:16 +0700] "GET / HTTP/1.0" 403 591 "b7q8494.info" "Mozilla/5.0 (compatible; PWeBot/3.1; http://www.6olw3iad17u6.net/robot.php)"
222.254.73.21 - - [25/Jul/2012:20:35:16 +0700] "GET / HTTP/1.0" 403 591 "6nb4j770.com" "Mozilla/4.0 (compatible; MSIE 4.01; Windows CE; PPS; 240x320)"
222.254.73.21 - - [25/Jul/2012:20:35:16 +0700] "GET / HTTP/1.0" 403 591 "7e54e1g396.net" "Mozilla/5.0 (compatible; InterseekWeb/3.x)"
123.18.210.206 - - [25/Jul/2012:20:35:16 +0700] "GET / HTTP/1.0" 403 591 "4799l8p.info" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.4; en-US; rv:1.9b5) Gecko/2008032619 Firefox/3.0b5"
123.18.210.206 - - [25/Jul/2012:20:35:16 +0700] "GET / HTTP/1.0" 403 591 "j8gkd645189.biz" "Mozilla/5.0 (compatible; Charlotte/1.0b; <a href="mailto:5i62u96si5g6@t0vh9.com">5i62u96si5g6@t0vh9.com</a>)"
222.254.73.21 - - [25/Jul/2012:20:35:16 +0700] "GET / HTTP/1.0" 403 591 "f6vvq3.biz" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0) (samualt9@bigfoot.com)"
222.254.73.21 - - [25/Jul/2012:20:35:16 +0700] "GET / HTTP/1.0" 403 591 "us493.ru" "Mozilla/4.72 [en] (BACS http://www.ba.be)"
123.18.210.206 - - [25/Jul/2012:20:35:16 +0700] "GET / HTTP/1.0" 403 591 "o993m48c.com" "Mozilla/5.0 (+http://www.e7maowgb781j8.com/mammoth) Mammoth/0.1"
222.254.73.21 - - [25/Jul/2012:20:35:16 +0700] "GET / HTTP/1.0" 403 591 "9u1wb80au0o.info" "Mozilla/5.0 (compatible; MSIE 6.0; Podtech Network; <a href="mailto:crawler_admin@n0ydj8.net">crawler_admin@n0ydj8.net</a>)"
123.18.210.206 - - [25/Jul/2012:20:35:16 +0700] "GET / HTTP/1.0" 403 591 "ezrytw.ru" "Mozilla/5.0 (compatible; heritrix/1.10.2 +http://i.v92p3dn1x22.edu/)"
222.254.73.21 - - [25/Jul/2012:20:35:16 +0700] "GET / HTTP/1.0" 403 591 "4gu2sw.info" "Mozilla/4.0 (compatible; ibisBrowser)"
222.254.73.21 - - [25/Jul/2012:20:35:16 +0700] "GET / HTTP/1.0" 403 591 "1r1338nvb9mzw.net" "Mozilla/4.0 (compatible; Advanced Email Extractor v2.xx)"
123.18.210.206 - - [25/Jul/2012:20:35:16 +0700] "GET / HTTP/1.0" 403 591 "d9wg8d207nh4.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; IBP; .NET CLR 1.1.4322)"
222.254.73.21 - - [25/Jul/2012:20:35:16 +0700] "GET / HTTP/1.0" 403 591 "i55q7.net" "Mozilla/5.0 (compatible; PWeBot/3.1; http://www.7b09on.net/robot.php)"
123.18.210.206 - - [25/Jul/2012:20:35:16 +0700] "GET / HTTP/1.0" 403 591 "6cjj28gnd.ru" "Mozilla/2.0"
![[Rule]](/hvaonline/templates/viet/images/icon_mini_rule.gif "[Rule]"){kind=icon}
![[Home]](/hvaonline/templates/viet/images/icon_mini_groups.gif "[Home]"){kind=icon}
![[Portal]](/hvaonline/templates/viet/images/icon_mini_portal.gif "[Portal]"){kind=icon}
![[Members]](/hvaonline/templates/viet/images/icon_mini_members.gif "[Members]"){kind=icon}
![[Statistics]](/hvaonline/templates/viet/images/icon_mini_stats.gif "[Statistics]"){kind=icon}
![[Search]](/hvaonline/templates/viet/images/icon_mini_search.gif "[Search]"){kind=icon}
![[Reading Room]](/hvaonline/templates/viet/images/icon_mini_book.gif "[Reading Room]"){kind=icon}
![[Register]](/hvaonline/templates/viet/images/icon_mini_register.gif "[Register]"){kind=icon}
Register![[Login]](/hvaonline/templates/viet/images/icon_mini_login.gif "[Login]"){kind=icon}
Login [
Thảo luận hệ điều hành *nix
![[Avatar]](/hvaonline/images/avatar/9d02addba2720cf4e1f2aab97460cf61.png "[Avatar]")
![[Minus]](/hvaonline/templates/viet/images/minus.gif "[Minus]")
![[Plus]](/hvaonline/templates/viet/images/plus.gif "[Plus]")
![[Profile]](/hvaonline/templates/viet/images/en_US/icon_profile.gif "[Profile]"){kind=icon}
![[PM]](/hvaonline/templates/viet/images/en_US/icon_pm.gif "[PM]"){kind=icon}
![[Up]](/hvaonline/templates/viet/images/en_US/icon_up.gif "[Up]"){kind=icon}
![[Print Copy]](/hvaonline/templates/viet/images/en_US/icon_print.gif "[Print Copy]"){kind=icon}
![[Avatar]](/hvaonline/images/avatar/089f41810321eefc3f4eef5d4a388e42.png "[Avatar]")
.
![[digg]](/hvaonline/templates/viet/images/digg.gif "[digg]")
![[delicious]](/hvaonline/templates/viet/images/delicious.gif "[delicious]")
![[google]](/hvaonline/templates/viet/images/google.gif "[google]")
![[yahoo]](/hvaonline/templates/viet/images/yahoo.gif "[yahoo]")
![[technorati]](/hvaonline/templates/viet/images/technorati.gif "[technorati]")
![[reddit]](/hvaonline/templates/viet/images/reddit.gif "[reddit]")
![[stumbleupon]](/hvaonline/templates/viet/images/stumbleupon.gif "[stumbleupon]")