2

I get a strange request every 2 seconds from 127.6.205.1. My production.log (Ruby on Rails) file looks like so:

> ...
I, [2015-01-16T15:05:23.491062 #79682]  INFO -- : Started GET "/" for 127.6.205.1 at 2015-01-16 15:05:23 -0500
I, [2015-01-16T15:05:23.493081 #79682]  INFO -- : Processing by HomeController#index as HTML
I, [2015-01-16T15:05:23.499908 #79682]  INFO -- :   Rendered home/index.haml within layouts/application (5.2ms)
I, [2015-01-16T15:05:23.500405 #79682]  INFO -- : Completed 200 OK in 7ms (Views: 6.2ms | ActiveRecord: 0.0ms)
I, [2015-01-16T15:05:25.508127 #79682]  INFO -- : Started GET "/" for 127.6.205.1 at 2015-01-16 15:05:25 -0500
I, [2015-01-16T15:05:25.510744 #79682]  INFO -- : Processing by HomeController#index as HTML
I, [2015-01-16T15:05:25.518685 #79682]  INFO -- :   Rendered home/index.haml within layouts/application (6.2ms)
I, [2015-01-16T15:05:25.519226 #79682]  INFO -- : Completed 200 OK in 8ms (Views: 7.2ms | ActiveRecord: 0.0ms)
I, [2015-01-16T15:05:27.524949 #79682]  INFO -- : Started GET "/" for 127.6.205.1 at 2015-01-16 15:05:27 -0500
I, [2015-01-16T15:05:27.527011 #79682]  INFO -- : Processing by HomeController#index as HTML
I, [2015-01-16T15:05:27.532497 #79682]  INFO -- :   Rendered home/index.haml within layouts/application (3.7ms)
I, [2015-01-16T15:05:27.532950 #79682]  INFO -- : Completed 200 OK in 6ms (Views: 4.8ms | ActiveRecord: 0.0ms)
...

As a result the file became too large (700MB), took all available disk space and my blog http://dortonway.me crashed.

Now I removed log file and my blog works as usual, but it's a temporary solution.

So what is it? I can write a bash script to remove production.log or somehow block this IP, but I don't think that it's a good solution.

Michael Hampton
  • 237,123
  • 42
  • 477
  • 940
dortonway
  • 121
  • 1
  • In general, anything in 127.0.0.0/8 is a loopback address. I've never actually seen that address on any network or host. Are you actually routing this subnet? This looks like a local host issue. Netstat and other tools should help you find a process on your system that is making this connection. – tep Jan 16 '15 at 22:46

1 Answers1

0

You could use the logrotate for your file.

http://linux.die.net/man/8/logrotate

and set a limit and a rotation. To block some ips you could try something like fail2ban.

http://www.fail2ban.org/wiki/index.php/Main_Page

René Höhle
  • 1,418
  • 3
  • 17
  • 26