Add a juju action to report on top visits by IP
Bug #1916748 reported by
Tom Haddon
This bug affects 2 people
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
K8s Content Cache Charm |
Confirmed
|
Medium
|
Unassigned |
Bug Description
During a potential DoS attack it's useful to quickly retrieve a list of most visits by IP. During a recent issue, an SRE ran the following:
juju run --application content-
This should really be a juju action so it's very obvious and easy for anyone to do this.
Changed in charm-k8s-content-cache: | |
status: | New → Confirmed |
importance: | Undecided → Medium |
To post a comment you must log in.
This command would be better as it supports IPv6 as well as includes the sites or listen stanzas being hit:
| awk '/Feb 25 06:/ && $6 !~ /127.0.0.1/ {print $6 " " $8 }' /var/log/ haproxy. log | sed -e 's/:[0-9]* / /' | sort | uniq -c | sort -k1 -n -r | head
We also want to replace the date/time "Feb 25 06:" with the last 20 mins or so.