RE: xmlrpc.php causing system hang?
- From: "Dan C" <DanC@xxxxxxxxxxxxxxxxxxxxxxxxx>
- Date: Tue, 3 Jan 2006 13:18:03 -0800
we're seeing the same behavior on our server.
a couple of months ago, I was seeing something that I think is related. it
had to do with the number of bytez being posted to the php page, but only
through IE. if the bytes posted to a php page served through IIS exceeded a
certain amount, the page was never executed, and I saw a cgi timeout.
http://news.php.net/php.windows/26418
in this particular case, I set up IIS to use the isapi module instead of the
cgi executable, and it runs fine now.
seeing the logs, the size of the post is quite large, and I wonder if the
issue is related. some sort of bug in the interaction between PHP and IIS
related to the post size in IE.
"mlordi@xxxxxxxxx" wrote:
> Hello everyone! first time posting here. I have a windows 2000 server
> running iis 5. I am having this weird problem of late (started around
> 11/7/2005). I noticed in my event viewer under system that I have been
> getting these timeout messages from a file called xmlrpc.php. Now the
> weird thing is that this message is happening about every fifteen
> minutes. The exact error message is:
>
>
> The script started from the URL '/blog/xmlsrv/xmlrpc.php' with
> parameters '' has not responded within the configured timeout period.
> The HTTP server is terminating the script.
> For additional information specific to this message please visit the
> Microsoft Online Support site located at:
> http://www.microsoft.com/contentredirect.asp.
>
>
> The URL changes though to a few different locations.
> Here are some:
> blog/xmlrpc.php
> blogs/xmlrpc.php
> wordpress/xmlrpc.php
> blog/xmlsrv/xmlrpc.php
> blog/xmlsrv/xmlrpc.php
>
>
> Now eventually my webserver seems to not be able to handle the timeout
> sessions and then sometime overnight will eventually stop servering web
>
> requests. It seems as though everything is running normally (services
> and everything look fine.) But when you bring up the URL it comes up
> with a DNS error. Now if I go and stop and restart the WWW publishing
> service everything starts running fine again.
>
>
> I have found some information about a virus called lupii or lupper.
> This virus is targeted at Linux machines though.
>
>
> So does anyone know of other things I can check to make sure I am
> protected, or how to filter out these requests? I really need help
> since this is just getting so bothersome now. Any help or ideas are
> appreciated. Thank you very much for your time.
>
>
> Mark
>
>
.
- Prev by Date: Re: Viewability of shared folders ?
- Next by Date: Re: Directory security - what's needed for USER priv's?
- Previous by thread: security log and login hack
- Next by thread: Re: Directory security - what's needed for USER priv's?
- Index(es):
Relevant Pages
|
