[ic] mod_interchange and Apache MaxClients

[Ron Phipps]

> From: John Young
> Sent: Wednesday, December 21, 2005 5:55 PM
> 
> John1 wrote:
> 
> > I am surprised that not more Interchange sites have reported being
> > affected by this on this mailing list.  So far only 3 of us have
> > reported experiencing this problem which would suggest that it is
> > something peculiar to our installations, and yet I am sure it isn't.
If
> > anyone else is seeing the same problem with there Interchange site
going
> > down please post a brief reply to this thread - thanks.
> 
> 
> Well, I'll offer up that I see those same worm-initiated requests
> every day and my server hasn't suffered from it.  I'm using a modified
> IC 5.1.x with mod_interchange (slightly old version).

I think we've found it occurs regardless of IC/mod_interchange/apache
version.  At least in my case I've tried different versions of Apache
and mod_interchange and have seen posts from people using different
versions of IC (we are on modified version of 4.8.x).  It'll be
interesting to see if we have this same problem when we move to the
latest and greatest.

> If you can't reproduce the worm in a lab, then perhaps you can set up
> another server, and using mod_rewrite or some such thing on your
> production
> server redirect those requests to the secondary server.  Doesn't have
to
> be an additional physical box -- could just be additional instances of
> Apache and Interchange (provided you have the memory).  That might
protect
> your production server as well as give you a place to work on figuring
> the thing out (by turning things on and off, etc.).
> 
> -John Young

We do have the resources to setup such a system, nearly identical to the
existing server.  Is there a way to use an apache module perhaps to copy
all requests from one server to another?  We don't really want to just
rewrite the worm requests, because we need to recreate the complete
traffic patterns as well.  I will look into this some more.  A
reproducible case would really be the easy route to help debug this
issue.

-Ron