[cobalt-users] RE: RE: Kernel: Oops (raqr4)

["Jon" <jjma100@xxxxxxxxxxx>]

Dan,

> > I had to reboot the cobalt via our apc switch today as the
> > connection to the server hung and on investigation I have
> > noticed alot of
> >
> > "possible SYN flooding on port 80. Sending cookies."
> in the kernel log
> >
>
> Can you get a quick look at /var/log/httpd/access and
> see what IP may be
> hitting you? Do you use robots.txt in your sites to
> block script
> directories? If you have a script that gets hit by an
> outfit called Web
> Clipping http://www.webclipping.com/ you could have
> problems. They hit
> my dmoz.org interface script once ignoring robots.txt.
> I recorded over
> 50,000 hits from them in a short period of time.

Our access log stopped at the time the logrotate script ran
(having problems with logrotate) so I couldn't check to see if we
were being blasted by outside sites. Reboot seems to have solved
the problem however I think it is related back to the old problem
of logrotate being unable to rotate the access log. Am keeping
eye on the server for potential problem recurring and have
written simple script to grep, then mail results, kernel log for
SYN flooding so that I can act.

Thanks

Jon