<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">Am 01.11.2016 um 23:35 schrieb Cox, Eric S <<a href="mailto:eric.cox@kroger.com" class="">eric.cox@kroger.com</a>>:</div><br class="Apple-interchange-newline"><div class=""><div style="font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt;" class=""><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt;" class="">Currently we track all access logs realtime via an in house built log aggregation solution. Various algorithms are setup to detect said IPS whether it be by hit rate, country, known types of attacks etc. These IPS are typically identified within a few mins and we reload to banned list every 60 seconds. We just moved some services from apache where we were doing this without any noticable performance impact. Have this working in nginx but was looking for general suggestion on how to optimize if at all possible.<span class="Apple-converted-space"> </span><br class=""></span></div></div></blockquote></div><br class=""><div class=""><br class=""></div><div class="">Ah, if you already have the data pre-processed…</div><div class=""><br class=""></div><div class="">I’d move blocking to the host’s firewall, as suggested.</div><div class=""><br class=""></div><div class="">Long term, I want to do this (or at least be able to), too. </div><div class=""><br class=""></div><div class="">We (MSP) have a rather large number of firewalls and telling the network-guys „Block this IP at all of them“ does not work (it would probably take them the better part of the day).</div><div class="">They don’t believe in automation...</div></body></html>