When replying, type your text above this line. ---------------------------------------------- Notification of Incident Change Incident: Re: excessive scanning of collab.mcs.anl.gov Incident Number: 62221 Priority: Medium Status: Active Date: 12/05/2012 Time: 10:24:34 Creation Date: 07/27/2012 Creation Time: 14:06:08 Created By: Dana Stasiak View Incident in Browser: https://tickets.anl.gov/MRcgi/MRlogin.pl?DL=62221DA12 Detail: Entered on 12/05/2012 at 10:24:34 CST (GMT-0600) by Dmitriy Sklyar: Ken has unblocked one of the servers to take at the current traffic. Further actions will be taken based on results. Entered on 10/03/2012 at 11:42:15 CDT (GMT-0500) by David Salbego: Dmitriy, He provided that information. Look at his command line cut-and-pastes. --dave Open Footprints Ticket: Assignees [Duplicate message snipped] Entered on 10/03/2012 at 11:39:12 CDT (GMT-0500) by Dmitriy Sklyar: Can you please verify which GSA server these excessive scans are coming from, http://search.anl.gov/ or http://public-search.anl.gov ? Entered on 10/03/2012 at 11:17:45 CDT (GMT-0500) by Denice DiGiacomo: Entered on 10/03/2012 at 11:03:19 CDT (GMT-0500) by [email protected]:I unblocked to 2 scanner IPs a while back for the collab.mcs.anl.gov Confluence site. Looking at the logs from yesterday, I'm still seeing over 100,000 hits per day, per bot, so no real change.root@blizzard:/var/log/apache2# grep 130.202.84.131 blizzard.access_log.2012Oct02 | wc -l133292root@blizzard:/var/log/apache2# grep 146.137.96.101 blizzard.access_log.2012Oct02 | wc -l124296Ken----- Original Message -----From: "Ken Raffenetti" <[email protected]>To: [email protected]: Thursday, September 20, 2012 9:34:14 AMSubject: Re: INFO: Re: excessive scanning of collab.mcs.anl.gov, Ticket No. 62221, Status=PendingI haven't gotten around to unblocking the bots. I will try to get to ittoday and monitor for excessive scanning.Ken RaffenettiSystems Administration AssociateMCS Division - Argonne National LaboratoryOn 09/17/2012 05:13 PM, Argonne Service Desk wrote:> [Duplicate message snipped] Entered on 09/24/2012 at 17:25:47 CDT (GMT-0500) by Dana Stasiak: Thanks Ken. We'll wait to hear back from you before closing this ticket. Dana Entered on 09/20/2012 at 09:37:12 CDT (GMT-0500) by [email protected]: I haven't gotten around to unblocking the bots. I will try to get to it today and monitor for excessive scanning. Ken Raffenetti Systems Administration Associate MCS Division - Argonne National Laboratory On 09/17/2012 05:13 PM, Argonne Service Desk wrote:

[Duplicate message snipped]

Entered on 09/17/2012 at 17:13:04 CDT (GMT-0500) by Dana Stasiak: Ken, have you seen any more evidence of this behavior? Dana Entered on 07/27/2012 at 14:28:07 CDT (GMT-0500) by Dmitriy Sklyar: I have switched both internal and external GSAs to scheduled crawl and specified minimum load for Normal 0 false false false EN-US X-NONE X-NONE /* Style Definitions */ table.MsoNormalTable {mso-style-name:"Table Normal"; mso-tstyle-rowband-size:0; mso-tstyle-colband-size:0; mso-style-noshow:yes; mso-style-priority:99; mso-style-parent:""; mso-padding-alt:0in 5.4pt 0in 5.4pt; mso-para-margin:0in; mso-para-margin-bottom:.0001pt; mso-pagination:widow-orphan; font-size:10.0pt; font-family:"Times New Roman","serif";} collab.mcs.anl.gov and Normal 0 false false false EN-US X-NONE X-NONE /* Style Definitions */ table.MsoNormalTable {mso-style-name:"Table Normal"; mso-tstyle-rowband-size:0; mso-tstyle-colband-size:0; mso-style-noshow:yes; mso-style-priority:99; mso-style-parent:""; mso-padding-alt:0in 5.4pt 0in 5.4pt; mso-para-margin:0in; mso-para-margin-bottom:.0001pt; mso-pagination:widow-orphan; font-size:10.0pt; font-family:"Times New Roman","serif";} www.alcf.anl.gov. Please remove the blocks and let me know if the situation improves. If the blocks remain in place, no results from these sites will show up in the internal/external site search. Entered on 07/27/2012 at 14:09:19 CDT (GMT-0500) by Malikah Reed: assigning to web services Entered on 07/27/2012 at 14:06:08 CDT (GMT-0500) by Dana Stasiak: Craig, Ken, Please accept my apologies for the difficulties you have been experiencing. I have asked Dmitry to turn down the host load schedule for these servers. I am also creating a ticket to track this to completion. We have been recrawling the the collection due to some changes we are making for inside Argonne. Dana On Jul 27, 2012, at 2:32 PM, "Craig Stacey" <[email protected]> wrote: I'd go ahead and block it until it gets figured out. -- Craig (from my mobile) Ken Raffenetti <[email protected]> wrote: This scanning is still out of control. In yesterday's logs I see about 300,000 requests from each of the lab's google bots. Is there something I should be doing to these sites to prevent this excessive scanning? root@blizzard:/var/log/apache2# grep 146.137.96.101 blizzard.access_log.2012Jul26 | wc -l 277670 root@blizzard:/var/log/apache2# grep 130.202.84.131 blizzard.access_log.2012Jul26 | wc -l 292253 There are only about 200 pages on this entire site. Can we get support from Google with regards to this problem? A similar issue caused me to block the ANL google bots from www.alcf.anl.gov because it was affecting site performance. Ken Raffenetti Systems Administration Associate MCS Division - Argonne National Laboratory On 07/10/2012 09:29 AM, Ken Raffenetti wrote:

Google Admins,

I'm seeing a pretty outrageous number of requests to http://collab.mcs.anl.gov. Is there any way the scanning frequency can be turned down on this site?

In July alone, I see 1.5 million requests. This is similar to what was happening with www.alcf.anl.gov, which I eventually just blocked from being crawled by the internal Google bot.

root@blizzard:/var/log/apache2# grep 146.137.96.101 *.access_log.2012Jul* | wc -l | uniq -c 1 1522255

Current Assignees: Web Services, Dmitriy Sklyar CC(s): (permanent) [email protected], [email protected], [email protected] Customer Information: Last Name: Raffenetti First Name: Kenneth Email Address: [email protected] Badge: 56518 Login ID: b56518 ANL Division: MCS Costcenter: 145 Building: 240 Room: 2135 Phone: (630) 252-3358 This is an automated message sent by the Numara FootPrints ticket tracking system, which is operated by CIS.