IP blocking

[anewday]

from /usr/local/apache/logs/error_log

2008-03-25 22:01:29.991 [NOTICE] [121.x.x.x] is over per client soft connection limit: 20 for 32 seconds, close connection!

Soft Limit 40
Hard Limit 60
Grace 20

Why did the IP get blocked for opening only 20 connections and why does it show 32 seconds?

 

[mistwang]

Maybe you have not apply your configuration change yet? It should use 40.
show 32 seconds is because that it is not being checking very frequently.

 

[anewday]

I restarted lsws after making the changes. So does that mean it's actually 32 seconds soft limit or just displayed that way in the logs?

A suggestion: add option to send an email whenever an IP is blocked, CSF has this. Also, there isn't any way to view the blocked IPs, better if you can view and unblock before the banning period is over.