I'm getting repeat requests for resources on my server and this is increasing the load greatly. Currently my load is at 2.5ish. I block individual IP addresses causing the problem but eventually the attacker seems to reappear with a different IP. Any ideas?
Here is my server log:
I'm getting repeat requests for '...' and 'GET'
A loadavg of 2.5 is not necessarily a big deal; it just describes the number of processes that are currently executing or waiting to execute instructions on your system's CPUs. Unless you're seeing high iowait, or processes monopolizing whole CPUs, you're probably just enjoying the standard performance profile of a web server dealing with both real requests and the inevitable script-kiddie vulnerability scans.
It's not worth trying to track these attackers down; they're constantly harvesting new IPs to scan from. Make sure your system is well-secured, and that you have a logging and log-analysis infrastructure in place to alert you when actual security events occur - that is, when one of these attackers actually gains elevated access.
This link I added to with the IPtables script is a good fix to lower the miscreants effect on the Server load.
Getting a lot of hits on my web server and it's taking down my httpd. Possible DDoS?
