My blog server recently started dying at random, and then it started getting worse, and getting worse, faster and faster... (Sounds like sex don't it?)
Anyhow, after a lot of tracking (between load times on the server getting above 200) I was able to find an average of 70 queries a second on the MySQL db, but not the traffic coming in to any of the blogs to support that.
Finally I started manually tailing apache log files and came across this...
Code:
::1 - - [01/May/2007:21:50:06 -0700] "GET / HTTP/1.0" 200 1179
127.0.0.1 - - [01/May/2007:21:50:06 -0700] "POST / HTTP/1.0" 200 1179
127.0.0.1 - - [01/May/2007:21:50:07 -0700] "POST / HTTP/1.0" 200 1179
127.0.0.1 - - [01/May/2007:21:50:07 -0700] "POST / HTTP/1.0" 200 1179
::1 - - [01/May/2007:21:50:07 -0700] "GET / HTTP/1.0" 200 1179
127.0.0.1 - - [01/May/2007:21:50:07 -0700] "POST / HTTP/1.0" 200 1179
127.0.0.1 - - [01/May/2007:21:50:08 -0700] "POST / HTTP/1.0" 200 1179
::1 - - [01/May/2007:21:50:08 -0700] "GET / HTTP/1.0" 200 1179
::1 - - [01/May/2007:21:50:10 -0700] "GET / HTTP/1.0" 200 1179
127.0.0.1 - - [01/May/2007:21:50:11 -0700] "POST / HTTP/1.0" 200 1179
::1 - - [01/May/2007:21:50:11 -0700] "GET / HTTP/1.0" 200 1179
127.0.0.1 - - [01/May/2007:21:50:06 -0700] "POST / HTTP/1.0" 200 1179
127.0.0.1 - - [01/May/2007:21:50:12 -0700] "POST / HTTP/1.0" 200 1179
127.0.0.1 - - [01/May/2007:21:50:12 -0700] "POST / HTTP/1.0" 200 1179
127.0.0.1 - - [01/May/2007:21:50:12 -0700] "POST / HTTP/1.0" 200 1179
::1 - - [01/May/2007:21:50:12 -0700] "GET / HTTP/1.0" 200 1179
127.0.0.1 - - [01/May/2007:21:50:13 -0700] "POST / HTTP/1.0" 200 1179
127.0.0.1 - - [01/May/2007:21:50:13 -0700] "POST / HTTP/1.0" 200 1179
127.0.0.1 - - [01/May/2007:21:50:13 -0700] "POST / HTTP/1.0" 200 1179
127.0.0.1 - - [01/May/2007:21:50:13 -0700] "POST / HTTP/1.0" 200 1179
127.0.0.1 - - [01/May/2007:21:50:14 -0700] "POST / HTTP/1.0" 200 1179
127.0.0.1 - - [01/May/2007:21:50:11 -0700] "POST / HTTP/1.0" 200 1179
127.0.0.1 - - [01/May/2007:21:50:14 -0700] "POST / HTTP/1.0" 200 1179
127.0.0.1 - - [01/May/2007:21:50:14 -0700] "POST / HTTP/1.0" 200 1179
::1 - - [01/May/2007:21:50:15 -0700] "GET / HTTP/1.0" 200 1179
127.0.0.1 - - [01/May/2007:21:50:15 -0700] "POST / HTTP/1.0" 200 1179
WTF is ::1 as an IP, and why is my localhost hitting one of my sites with a POST every second or so? I grepped and found over 25,000 of these posts, no wonder my server was throwing a fit.
Anyone have any ideas how to track this down? I've removed the site from my httpd.conf for now, but that's hardly a solution, more of a bandaid...