On 26/12/2021 13.14, Per Jessen wrote:
Carlos E. R. wrote:
On 26/12/2021 12.43, Per Jessen wrote:
I am seeing a lot of traffic with GET URLs such as these:
GET /repositories/./Apache:/MirrorBrain/SLE_15_SP2/x86_64/http://build.opensuse.org/ GET /repositories/Apache/openSUSE_Leap_15.2/x86_64/https://software.opensuse.org/ GET /repositories/./Apache:/Shibboleth/SLE_12_SP2/repodata/http://build.opensuse.org/ GET /repositories/./Apache:/MirrorBrain/SLE_15_SP2/https://software.opensuse.org/
Of course they all result in a 404, but currently such requests take up almost 10% of our total http traffic.
Does anyone recognise that unusual request format, with 'https://software.opensuse.org/' or 'http://build.opensuse.org/' appended ?
This started on 6 December with a few hundred thousand requests, but grew to 2million by 13 December, now around 3.5-4million a day.
Maybe you should translate those log entries to what a web browser would have in the address bar to generate those entries.
Well, that is exactly what a browser would show too, but they are not coming from browsers, only from curl.
Me, I can not figure it out, not that familiar with apache.
Apache is not relevant. It could be any webserver.
Ok, I mean I'm not familiar with apache logs, I can not interpret them. I can not figure out what actual URL curl tried. Or do you mean that curl tried exactly: curl /repositories/./Apache:/MirrorBrain/SLE_15_SP2/https: \ //software.opensuse.org/ That is really weird. I tried this: Telcontar:/var/log/YaST2 # zgrep "/repositories/Apache \ /openSUSE_Leap_15.2/" y2log*gz Telcontar:/var/log/YaST2 # No hits. -- Cheers / Saludos, Carlos E. R. (from 15.2 x86_64 at Telcontar)