DDoS Attack Log Analysis Question

[Jim Ohlstein]

Maxim Dounin wrote:
> Hello!
> 
> On Fri, Oct 09, 2009 at 07:40:57PM -0400, Jim Ohlstein wrote:
> 
>> The nginx forum had a DDoS attack which took the site down this
>> morning.  In approximately 23 seconds there were just under 900,000
>> lines in the error log that looked like:
>>
>> 2009/10/09 10:21:38 [alert] 32576#0: accept() failed (24: Too many
>> open files)
>>
>> First question is do each of these entries represent an attempted
>> connection?
> 
> No.  This is configuration issue lead to infinite loop which can't 
> be resolved until more files can be opened.

Thank you. I found it hard to imagine that there were that many requests 
in such a small period directed at such a small site.

> 
> Since this looks like common configuration issue, probably we need 
> some accept pause in such situations...
> 
> Maxim Dounin
> 


-- 
Jim Ohlstein