Skip to content

SecConn(Read|Write)StateLimit warning floods errorlog #1432

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
emphazer opened this issue May 26, 2017 · 3 comments
Closed

SecConn(Read|Write)StateLimit warning floods errorlog #1432

emphazer opened this issue May 26, 2017 · 3 comments
Assignees
@zimmerle @victorhora

Comments

@emphazer
Copy link

apache 2.2.15, 2.4.6
rhel 6, 7

i guess it has something to do with the following commit #1340

[Fri May 26 12:12:19.354369 2017] [:warn] [pid 13045:tid 140075442624256] [client  x.x.x.251:41630] ModSecurity: going to loop through 2050 servers with 64 threads
[Fri May 26 12:12:19.355458 2017] [:warn] [pid 13045:tid 140075442624256] [client  x.x.x.251:41630] ModSecurity: threads in READ: 1 of 50, WRITE: 0 of 50, IP:  x.x.x.251
[Fri May 26 12:12:19.387705 2017] [:warn] [pid 13129:tid 140075392268032] [client  x.x.x.94:25222] ModSecurity: going to loop through 2050 servers with 64 threads
[Fri May 26 12:12:19.389408 2017] [:warn] [pid 13129:tid 140075392268032] [client  x.x.x.94:25222] ModSecurity: threads in READ: 1 of 50, WRITE: 0 of 50, IP:  x.x.x.94
[Fri May 26 12:12:19.393744 2017] [:warn] [pid 13045:tid 140075392268032] [client  x.x.x.94:25226] ModSecurity: going to loop through 2050 servers with 64 threads
[Fri May 26 12:12:19.394955 2017] [:warn] [pid 13045:tid 140075392268032] [client  x.x.x.94:25226] ModSecurity: threads in READ: 1 of 50, WRITE: 0 of 50, IP:  x.x.x.94
[Fri May 26 12:12:19.400368 2017] [:warn] [pid 13129:tid 140075367089920] [client  x.x.x.251:41636] ModSecurity: going to loop through 2050 servers with 64 threads
[Fri May 26 12:12:19.401456 2017] [:warn] [pid 13129:tid 140075367089920] [client  x.x.x.251:41636] ModSecurity: threads in READ: 1 of 50, WRITE: 0 of 50, IP:  x.x.x.251
[Fri May 26 12:12:19.405759 2017] [:warn] [pid 13045:tid 140075574433536] [client  x.x.x.94:25232] ModSecurity: going to loop through 2050 servers with 64 threads
[Fri May 26 12:12:19.406796 2017] [:warn] [pid 13045:tid 140075574433536] [client  x.x.x.94:25232] ModSecurity: threads in READ: 1 of 50, WRITE: 0 of 50, IP:  x.x.x.94
[Fri May 26 12:12:19.410287 2017] [:warn] [pid 13129:tid 140075582826240] [client  x.x.x.251:41638] ModSecurity: going to loop through 2050 servers with 64 threads
[Fri May 26 12:12:19.411273 2017] [:warn] [pid 13129:tid 140075582826240] [client  x.x.x.251:41638] ModSecurity: threads in READ: 1 of 50, WRITE: 0 of 50, IP:  x.x.x.251
[Fri May 26 12:12:19.439602 2017] [:warn] [pid 13045:tid 140075425838848] [client  x.x.x.251:41650] ModSecurity: going to loop through 2050 servers with 64 threads
[Fri May 26 12:12:19.441388 2017] [:warn] [pid 13045:tid 140075425838848] [client  x.x.x.251:41650] ModSecurity: threads in READ: 1 of 50, WRITE: 0 of 50, IP:  x.x.x.251
[Fri May 26 12:12:19.441494 2017] [:warn] [pid 13129:tid 140075358697216] [client  x.x.x.251:41654] ModSecurity: going to loop through 2050 servers with 64 threads
[Fri May 26 12:12:19.442030 2017] [:warn] [pid 13045:tid 140075325126400] [client  x.x.x.251:41656] ModSecurity: going to loop through 2050 servers with 64 threads
[Fri May 26 12:12:19.442911 2017] [:warn] [pid 13045:tid 140075325126400] [client  x.x.x.251:41656] ModSecurity: threads in READ: 2 of 50, WRITE: 0 of 50, IP:  x.x.x.251
[Fri May 26 12:12:19.442911 2017] [:warn] [pid 13129:tid 140075358697216] [client  x.x.x.251:41654] ModSecurity: threads in READ: 2 of 50, WRITE: 0 of 50, IP:  x.x.x.251
[Fri May 26 12:12:19.445522 2017] [:warn] [pid 13129:tid 140075316733696] [client  x.x.x.251:41658] ModSecurity: going to loop through 2050 servers with 64 threads
[Fri May 26 12:12:19.446835 2017] [:warn] [pid 13129:tid 140075316733696] [client  x.x.x.251:41658] ModSecurity: threads in READ: 1 of 50, WRITE: 0 of 50, IP:  x.x.x.251
[Fri May 26 12:12:19.470089 2017] [:warn] [pid 13045:tid 140075333519104] [client  x.x.x.94:25246] ModSecurity: going to loop through 2050 servers with 64 threads
[Fri May 26 12:12:19.471780 2017] [:warn] [pid 13045:tid 140075333519104] [client  x.x.x.94:25246] ModSecurity: threads in READ: 1 of 50, WRITE: 0 of 50, IP:  x.x.x.94
[Fri May 26 12:12:19.483665 2017] [:warn] [pid 13129:tid 140075566040832] [client  x.x.x.251:41672] ModSecurity: going to loop through 2050 servers with 64 threads
[Fri May 26 12:12:19.485098 2017] [:warn] [pid 13129:tid 140075566040832] [client  x.x.x.251:41672] ModSecurity: threads in READ: 1 of 50, WRITE: 0 of 50, IP:  x.x.x.251
[Fri May 26 12:12:19.518477 2017] [:warn] [pid 13045:tid 140075540862720] [client  x.x.x.94:25258] ModSecurity: going to loop through 2050 servers with 64 threads
[Fri May 26 12:12:19.520244 2017] [:warn] [pid 13045:tid 140075540862720] [client  x.x.x.94:25258] ModSecurity: threads in READ: 1 of 50, WRITE: 0 of 50, IP:  x.x.x.94
@victorhora
Copy link
Contributor

Looking at the logs and as we had this for debug (APLOG_TRACE) prior to the patch I'm thinking this looks like normal behaviour so maybe we should change APLOG_WARNING to APLOG_DEBUG or siblings.

@emphazer
Copy link
Author

@victorhora sounds good to me :-)
Because we had 40gb logs after 3 days...

zimmerle pushed a commit that referenced this issue May 30, 2017
@victorhora
Fixes issue #1432 by not logging normal behavior to error.log and usi…
1684400 
…ng APLOG_DEBUG instead
zimmerle pushed a commit that referenced this issue May 30, 2017
Adds info about pull request #1432
e5dbe59
@zimmerle
Copy link
Contributor

Fixed by @victorhora at #1436.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@zimmerle zimmerle

@victorhora victorhora

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@zimmerle @emphazer @victorhora