Hi,
I'm seeing some odd behaviour that is currently a suspect in bringing down our IdP on tuesday, although has also been happening quite a lot without any ill effects too.
We're seeing entries in idp-process.log like:
14:08:51.914 - INFO [Shibboleth-Access:73] - 20101103T140851Z|134.36.53.124|idp.dundee.ac.uk:443|/profile/Shibboleth/SSO|
14:08:51.976 - INFO [Shibboleth-Access:73] - 20101103T140851Z|134.36.53.124|idp.dundee.ac.uk:443|/profile/Shibboleth/SSO|
14:08:52.039 - INFO [Shibboleth-Access:73] - 20101103T140852Z|134.36.53.124|idp.dundee.ac.uk:443|/profile/Shibboleth/SSO|
14:08:52.085 - INFO [Shibboleth-Access:73] - 20101103T140852Z|134.36.53.124|idp.dundee.ac.uk:443|/profile/Shibboleth/SSO|
repeated 60odd times (or more) over a very short period. On Tuesday it was happening several times a second for >25 minutes, the IdP didn't seem to like it... As these are each initiating a login session I wonder if it just used up all the resources.
When you have a look in the apache logs and match these up these are requests that have come in from access to our ezproxy server, checking its logs I find
134.36.53.124 - - [03/Nov/2010:14:08:52 +0000] "GET http://libproxy.dundee.ac.uk:80/login?url=http://www.lexisnexis.com/idp/login.css HTTP/1.1" 302 0
134.36.53.124 - - [03/Nov/2010:14:08:52 +0000] "GET http://libproxy.dundee.ac.uk:80/login?url=http://www.lexisnexis.com/idp/login.css HTTP/1.1" 302 0
134.36.53.124 - - [03/Nov/2010:14:08:52 +0000] "GET http://libproxy.dundee.ac.uk:80/login?url=http://www.lexisnexis.com/idp/login.css HTTP/1.1" 302 0
etc etc etc
Now these aren't the correct login url which the user used. Has anyone any idea what could be generating these? The user had already been logged into ezproxy and been doing stuff and then this happens later in the session - I haven't been able to track down any users yet to find out what they did/saw. This seems to be happening with lexis nexis and westlaw. Now that these are both accessible through Shibb direct the EZProxy entries are redundant and are hidden on our library site, the people using these must have bookmarked them - one quick fix would be to remove the EZProxy route altogether but I'd like to know whats going on.
Cheers
Andy
************************************************************
Please consider the environment. Do you really need to print this email?
The University of Dundee is a registered Scottish charity, No: SC015096
|