only problem with this, is that with very high hit sites, you have the possibility of overwriting data. (read,read,write,write issue). That is what Jed was trying to prevent. That is what is nice about the increment command in memcache --- it is atomic.
<br><br><div><span class="gmail_quote">On 12/4/06, <b class="gmail_sendername">Randy Wigginton</b> <<a href="mailto:krw@nobugz.com">krw@nobugz.com</a>> wrote:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div style="">Or, if you didn't want to hit your slow DB, create a well known key that contains all IPs over a certain threshhold. Thus when a specific IP reaches 100 hits, put it on the list for later analysis. Once an hour or so, harvest the data.
<div><br></div><div>This doesn't help much with AOL. They put all their users through specific gateway addresses. (at least they did about 18 months ago)<div><span class="e" id="q_10f4fffab204a5e5_1"><div><br><div><div>On Dec 4, 2006, at 6:51 PM, Jason Pirkey wrote:
</div><br><blockquote type="cite">Yes -- every X number of requests over the initial threshold -- a simple if and mod.<br><br><div><span class="gmail_quote">On 12/4/06, <b class="gmail_sendername">Jed Reynolds</b> <<a href="mailto:lists@benrey.is-a-geek.net" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
lists@benrey.is-a-geek.net</a>> wrote:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">Jason Pirkey wrote:<br>> Jed:<br>><br>
> If you are analyizing for attacks, it would be easier to do a real<br>> time analysis with memcached, because at that point you will have the<br>> IP address you are looking for -- do a hit to memcache to get its
<br>> counter and act accordingly (saving it to the database for later<br>> analysis if it hits a certain threshold for instance. This way you<br>> will not have to do scanning of memcache and post processing.<br>
<br>Good idea, Jason, thanks! So if I'm tracking a high volume IP the way to<br>track them is to record their status to database every 1,000 requests<br>(e.g.) and not every request over the threshold.<br><br>Jed<br></blockquote>
</div><br></blockquote></div><br></div></span></div></div></div>
</blockquote></div><br>