Subject: Re: How to get all the keys from servers?

[Randy Wigginton]

Or, if you didn't want to hit your slow DB, create a well known key  
that contains all IPs over a certain threshhold.  Thus when a  
specific IP reaches 100 hits, put it on the list for later analysis.   
Once an hour or so, harvest the data.

This doesn't help much with AOL.  They put all their users through  
specific gateway addresses. (at least they did about 18 months ago)

On Dec 4, 2006, at 6:51 PM, Jason Pirkey wrote:

> Yes -- every X number of requests over the initial threshold -- a  
> simple if and mod.
>
> On 12/4/06, Jed Reynolds < lists at benrey.is-a-geek.net> wrote:
> Jason Pirkey wrote:
> > Jed:
> >
> > If you are analyizing for attacks, it would be easier to do a real
> > time analysis with memcached, because at that point you will have  
> the
> > IP address you are looking for -- do a hit to memcache to get its
> > counter and act accordingly (saving it to the database for later
> > analysis if it hits a certain threshold for instance.  This way you
> > will not have to do scanning of memcache and post processing.
>
> Good idea, Jason, thanks! So if I'm tracking a high volume IP the  
> way to
> track them is to record their status to database every 1,000 requests
> (e.g.) and not every request over the threshold.
>
> Jed
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.danga.com/pipermail/memcached/attachments/20061204/0caba0cc/attachment.htm