Lighttpd mod_evasive.c

TsyMiroro

Hi!

From latsts snapshot I have message in the console in the screen of my install.

PC install
2.1-RC0 (i386)
built on Mon Jul 8 09:31:24 EDT 2013
FreeBSD 8.3-RELEASE-p8

Installed packages :

squid3
lightsquid
file manager
freeradius

The message is like this


...
Jul 11 08:05:06 lighthttpd[50926]: (mod_evasive.c.183) 172.24.0.226 turned away. Too many connections.
Jul 11 08:05:07 lighthttpd[50926]: (mod_evasive.c.183) 172.24.0.226 turned away. Too many connections.
Jul 11 08:05:07 lighthttpd[50926]: (mod_evasive.c.183) 172.24.0.226 turned away. Too many connections.
Jul 11 08:05:07 lighthttpd[50926]: (mod_evasive.c.183) 172.24.0.226 turned away. Too many connections.
Jul 11 08:05:07 lighthttpd[50926]: (mod_evasive.c.183) 172.24.0.226 turned away. Too many connections.
Jul 11 08:05:07 lighthttpd[50926]: (mod_evasive.c.183) 172.24.0.226 turned away. Too many connections.
Jul 11 08:05:07 lighthttpd[50926]: (mod_evasive.c.183) 172.24.0.226 turned away. Too many connections.
Jul 11 08:05:08 lighthttpd[50926]: (mod_evasive.c.183) 172.24.0.226 turned away. Too many connections.
...

172.24.0.226 is a PC in my LAN
50926 is a PID of lighttpd

I found nothing in /var/log/* that can help. A "tail -f " in log-files in this directory didn't print this message.
And log-files seems to not be fully text message.


[2.1-RC0][admin@pfsense.pc]/var/log(7): tail -f lighttpd.log
CLOG|�

In this moment, my firewall works, but these messages are not a normal issue.

.

eri--

Its just opening too many connections simultaneously.
There is a mitigation for this in lighttpd with mod_evasive and when this expires you see that log message.

dhatz

@TsyMiroro:

I found nothing in /var/log/* that can help. A "tail -f " in log-files in this directory didn't print this message.
And log-files seems to not be fully text message.
[2.1-RC0][admin@pfsense.pc]/var/log(7): tail -f lighttpd.log
CLOG|�
In this moment, my firewall works, but these messages are not a normal issue.

Btw the reason you couldn't browse the logfiles is because pfSense uses the clog (circular log) format.

Don't use tail -f /var/log/…log use clog -f /var/log/…log instead.

TsyMiroro

If I'm not wrong, lighthhtpd is the daemon behind the webConfigurator (the http admin interface).

Noone without me have access this, and I usually get access via ssh, exeptionally with http.

Why this client get access to lighthhtpd?

I think that if it is a normal issue, it doesn't print message in console.