发布于 4 天前
发布于 4 天前
y27
更新于 4 天前
0
0
7.32分,服务器的连接数达到9.3K,平时只有2,300,约31-46倍。其他资源正常。WAF攻击日志请求数没大的变化,每秒200-300
8.58分,服务器硬盘读113.6M,写降到了0。平时只有3-4M,约28-38倍。其他资源正常。WAF攻击日志请求数没有大的变化,每秒200-300
8.58分时,服务器挂掉
请问,是否部署时哪里配置有问题触发频繁读硬盘中的数据?
y27
更新于 4 天前
0
0
结合服务器日志发现是sync 半连接攻击导致。WAF是否有针对半连接请求的规则限制?
风熙.
更新于 4 天前
试试CC防护?
这个可能得套cdn来解决
y27
更新于 3 天前
CC一直是开着的,应该和这个没关系。
y27
更新于 3 天前
0
0
今天凌晨再次挂掉,检查那个时间点的日志出现这样的错误,请问是BUG吗:
/var/lib/postgresql/data/pg_log/postgresql-2025-11-16_005530.log:2025-11-16 05:10:37.236 CST [12485] ERROR: ON CONFLICT DO UPDATE command cannot affect row a second time
/var/lib/postgresql/data/pg_log/postgresql-2025-11-16_005530.log:2025-11-16 05:10:37.236 CST [12485] HINT: Ensure that no rows proposed for insertion within the same command have duplicate constrained values.
/var/lib/postgresql/data/pg_log/postgresql-2025-11-16_005530.log:2025-11-16 05:10:37.236 CST [12485] STATEMENT: INSERT INTO "policy_records" ("time","site_id","policy_id","req_count","pass_count") VALUES ($1,$2,$3,$4,$5),($6,$7,$8,$9,$10),($11,$12,$13,$14,$15),($16,$17,$18,$19,$20),($21,$22,$23,$24,$25),($26,$27,$28,$29,$30),($31,$32,$33,$34,$35),($36,$37,$38,$39,$40),($41,$42,$43,$44,$45),($46,$47,$48,$49,$50),($51,$52,$53,$54,$55),($56,$57,$58,$59,$60) ON CONFLICT ("policy_id","site_id","time") DO UPDATE SET "pass_count"=policy_records.pass_count+EXCLUDED.pass_count,"req_count"=policy_records.req_count+EXCLUDED.req_count RETURNING "id"
/var/lib/postgresql/data/pg_log/postgresql-2025-11-16_005530.log:2025-11-16 05:10:39.087 CST [27] LOG: checkpoint starting: time
/var/lib/postgresql/data/pg_log/postgresql-2025-11-16_005530.log:2025-11-16 05:11:28.248 CST [12496] ERROR: ON CONFLICT DO UPDATE command cannot affect row a second time
/var/lib/postgresql/data/pg_log/postgresql-2025-11-16_005530.log:2025-11-16 05:11:28.248 CST [12496] HINT: Ensure that no rows proposed for insertion within the same command have duplicate constrained values.
/var/lib/postgresql/data/pg_log/postgresql-2025-11-16_005530.log:2025-11-16 05:11:28.248 CST [12496] STATEMENT: INSERT INTO "policy_records" ("time","site_id","policy_id","req_count","pass_count") VALUES ($1,$2,$3,$4,$5),($6,$7,$8,$9,$10),($11,$12,$13,$14,$15),($16,$17,$18,$19,$20),($21,$22,$23,$24,$25),($26,$27,$28,$29,$30),($31,$32,$33,$34,$35),($36,$37,$38,$39,$40),($41,$42,$43,$44,$45) ON CONFLICT ("policy_id","site_id","time") DO UPDATE SET "pass_count"=policy_records.pass_count+EXCLUDED.pass_count,"req_count"=policy_records.req_count+EXCLUDED.req_count RETURNING "id"
/var/lib/postgresql/data/pg_log/postgresql-2025-11-16_005530.log:2025-11-16 05:11:45.255 CST [12508] ERROR: ON CONFLICT DO UPDATE command cannot affect row a second time
/var/lib/postgresql/data/pg_log/postgresql-2025-11-16_005530.log:2025-11-16 05:11:45.255 CST [12508] HINT: Ensure that no rows proposed for insertion within the same command have duplicate constrained values.
/var/lib/postgresql/data/pg_log/postgresql-2025-11-16_005530.log:2025-11-16 05:11:45.255 CST [12508] STATEMENT: INSERT INTO "policy_records" ("time","site_id","policy_id","req_count","pass_count") VALUES ($1,$2,$3,$4,$5),($6,$7,$8,$9,$10),($11,$12,$13,$14,$15),($16,$17,$18,$19,$20),($21,$22,$23,$24,$25),($26,$27,$28,$29,$30),($31,$32,$33,$34,$35),($36,$37,$38,$39,$40),($41,$42,$43,$44,$45),($46,$47,$48,$49,$50) ON CONFLICT ("policy_id","site_id","time") DO UPDATE SET "pass_count"=policy_records.pass_count+EXCLUDED.pass_count,"req_count"=policy_records.req_count+EXCLUDED.req_count RETURNING "id"
/var/lib/postgresql/data/pg_log/postgresql-2025-11-16_005530.log:2025-11-16 05:12:02.260 CST [12541] ERROR: ON CONFLICT DO UPDATE command cannot affect row a second time
/var/lib/postgresql/data/pg_log/postgresql-2025-11-16_005530.log:2025-11-16 05:12:02.260 CST [12541] HINT: Ensure that no rows proposed for insertion within the same command have duplicate constrained values.
/var/lib/postgresql/data/pg_log/postgresql-2025-11-16_005530.log:2025-11-16 05:12:02.260 CST [12541] STATEMENT: INSERT INTO "policy_records" ("time","site_id","policy_id","req_count","pass_count") VALUES ($1,$2,$3,$4,$5),($6,$7,$8,$9,$10),($11,$12,$13,$14,$15),($16,$17,$18,$19,$20),($21,$22,$23,$24,$25),($26,$27,$28,$29,$30),($31,$32,$33,$34,$35),($36,$37,$38,$39,$40),($41,$42,$43,$44,$45),($46,$47,$48,$49,$50),($51,$52,$53,$54,$55),($56,$57,$58,$59,$60) ON CONFLICT ("policy_id","site_id","time") DO UPDATE SET "pass_count"=policy_records.pass_count+EXCLUDED.pass_count,"req_count"=policy_records.req_count+EXCLUDED.req_count RETURNING "id"
/var/lib/postgresql/data/pg_log/postgresql-2025-11-16_005530.log:2025-11-16 05:12:36.267 CST [12571] ERROR: ON CONFLICT DO UPDATE command cannot affect row a second time
/var/lib/postgresql/data/pg_log/postgresql-2025-11-16_005530.log:2025-11-16 05:12:36.267 CST [12571] HINT: Ensure that no rows proposed for insertion within the same command have duplicate constrained values.
/var/lib/postgresql/data/pg_log/postgresql-2025-11-16_005530.log:2025-11-16 05:12:36.267 CST [12571] STATEMENT: INSERT INTO "policy_records" ("time","site_id","policy_id","req_count","pass_count") VALUES ($1,$2,$3,$4,$5),($6,$7,$8,$9,$10),($11,$12,$13,$14,$15),($16,$17,$18,$19,$20),($21,$22,$23,$24,$25),($26,$27,$28,$29,$30),($31,$32,$33,$34,$35),($36,$37,$38,$39,$40),($41,$42,$43,$44,$45),($46,$47,$48,$49,$50) ON CONFLICT ("policy_id","site_id","time") DO UPDATE SET "pass_count"=policy_records.pass_count+EXCLUDED.pass_count,"req_count"=policy_records.req_count+EXCLUDED.req_count RETURNING "id"
雷池-ll
更新于 3 天前
这边可以进入交流群提供/获取更详细的内容,目前waf不具备处理SYN半连接洪泛的能力,因为这类攻击发生在 TCP 建立连接之前,是网络层问题,不是应用层问题。
y27
更新于 10 分钟前
嗯,syn我用iptables拦了。不是这个的问题,拦完之后还是连接每天晚上挂。
现在问题找其他人处理了。已解决