Is there a way to view IP addresses of anonymous users / guests? And/or the number of connections from each? My site has been getting hundreds and hundreds of page views per minute, for the last few hours, processor usage is maxed out to 100% too.

Have you checked out your logs of Nginx (or what ever you are using)? Those are bots and knockers. You don’t do anything with IPs. Those will change after few tries (IPs are useless anyway, they will always change anyway). You should start do geo-blocking (quite few sites are really true global) and ban plenty of user agent at server-level; at least all totally unnecessary and greedy SEO-scrapers, bots that identifie themselves as IE5.x etc.

[image] pfaffman: there should be rate limiting at play How is that rate limiting working actually (no, I didn’t search answer). Will it kick in after amount of requests in some timeframe per IP? Anyway, when there is ddos’ish situation in the meaning of for example if URL is mentioned in some stupid list then starts flood from IPs from China, Pakinstan, Iran, Irak, Vietnam and Russia plus a lot from big VPS-services, mainly from USA, France and Germany. When they try 3 times and changes IP rate limiting doesn’t help too much. I got at some point a lot stupid searches. And a lot means 5USD droplet by DigitalOcean crashed and I had almost zero requests from humans. This is more or less matter of webserver, not Discourse. Those knockers should kill before an app. I know that my situation/solutions are much easier than OP’s or most of webmasters here because I’m from Finland and my forum is pure finnish — so banning world wide is possible for me (well, outside of Finland living finns see that differently :wink: ) But regardless rate limiting at least false user agents should stop right away. How’s SSH-knockers? Those eat resources too.

If you’re having ddos issues then I would recommend cloudflare (which I almost never do). Make sure that you use the cloudflare template and then off the optimizations (or read carefully about configuring that).

It is not real ddos. But when there is a lot of same type requests those act like ddos, the result is same. I’m using Varnish and Fail2ban plus geo-blocking and these do the job for me.

[image] pfaffman: If you did a standard installation there should be rate limiting at play (and some is inside Rails). How did you install? Yup, I did a standard install. [image] pfaffman: If you’re having ddos issues My first thought was simply being slashdotted, but 24hrs later I’m still getting hammered. The quick temporary fix was to shut the front door and set the site to “login required”. Which worked, CPU usage dropped from 100% down to 3% within 60 seconds. As soon as I unlock the front door my /search page is instantly being hammered with rubbish like: /search?q=dogs+order:latest&page=2 /search?q=cats+order:latest&page=2 /search?q=fly+order:latest&page=2 etc This happens within 60 seconds of opening the site again. We’re a small niche group, not sure why anyone would target us with anything :roll_eyes: It’s only an estimate but according to Google Analytics we normally have 8 to 10 active users and this spikes to 1,000+ within seconds of me opening the site back up to the public again. All connections show as coming from various parts of USA, all direct with no referrers. I’ll leave the site closed to members only for a few days and see if it goes away, or see if I can limit the /search to logged in users only, and if not I’ll probably have to go the cloudflare route. Thanks everyone :+1:t2:

Yeah. That’s bizarre, but i guess that’s the internet. Ohh. What is the user agent? Maybe you could add to blocked crawler user agents?

Good question! I’ll see if I can find that on the Google Analytics report page :+1:t2:

I think you can also look in /var/discourse/shared/log/var-log/nginx/.... (or something very much like that). THere are some other settings like slow down crawler user agents if you search settings for “agent”

Found it in: /var/discourse/shared/standalone/log/var-log/nginx/access.log (downloading locally now) Thanks @pfaffman I’ll see if anything jumps out at me.

View IP address of guests / anonymous visitors?

Community Building Data & reporting

pfaffman (Jay Pfaffman) January 11, 2022, 10:13pm 3

If you did a standard installation there should be rate limiting at play (and some is inside Rails). How did you install?

Topic		Replies	Views
Anonymous views suddenly very high Data & reporting	48	2433	December 10, 2025
Pageviews from Anonymous Users have exploded but Google Analytics showed no traffic growth. How to find about where the increase come from? Data & reporting	23	2708	January 5, 2021
Discourse overloaded real traffic or DDOS? 100% CPU usage despite of decent traffic and high specs server Self-hosting server-resources	18	2676	September 25, 2021
How can I figure out why I have a big jump in anonymous pageviews Data & reporting	10	1487	March 9, 2022
MegaIndex bot did about 4,000 pageviews on one day Community Building	40	5111	December 2, 2023

View IP address of guests / anonymous visitors?

Related topics