DDOS unexpected success?

[aristotle]

My server which is running a couple of small sites on OLS was subject to an apparent DDOS attack last night, which was successful in that it took my sites offline, but the only (obvious) reason that the attack succeeded is that the OLS error log was filled with the lines:

2024-08-15 00:34:31.799292 [ERROR] [587501] [*:443] HttpListener::acceptConnection(): Accept failed:Too many open files!
2024-08-15 00:34:31.799295 [ERROR] [587501] [*:443] HttpListener::acceptConnection(): Accept failed:Too many open files!
2024-08-15 00:34:31.799298 [ERROR] [587501] [*:443] HttpListener::acceptConnection(): Accept failed:Too many open files!
2024-08-15 00:34:31.799302 [ERROR] [587501] [*:443] HttpListener::acceptConnection(): Accept failed:Too many open files!
2024-08-15 00:34:31.799305 [ERROR] [587501] [*:443] HttpListener::acceptConnection(): Accept failed:Too many open files!
2024-08-15 00:34:31.799309 [ERROR] [587501] [*:443] HttpListener::acceptConnection(): Accept failed:Too many open files!
2024-08-15 00:34:31.799312 [ERROR] [587501] [*:443] HttpListener::acceptConnection(): Accept failed:Too many open files!
2024-08-15 00:34:31.799316 [ERROR] [587501] [*:443] HttpListener::acceptConnection(): Accept failed:Too many open files!
2024-08-15 00:34:31.799319 [ERROR] [587501] [*:443] HttpListener::acceptConnection(): Accept failed:Too many open files!

until the server ran out of disk space...

My estimate is that there were 200000 requests per second for 7 minutes until the logging froze.

It seems unfortunate that OLS does not have a mechanism to limit the logging of identically repeated errors.

BTW, deleting some log files restored normal operation without needing to restart anything.

 

[Cold-Egg]

To fix the Too many open files!, you can increase the operating system file descriptor limit.
See https://docs.litespeedtech.com/cloud/images/wordpress/#how-do-i-fix-a-too-many-open-files-issue

No, I don't think the web server has the build-in function to check if the log is repeated.