|
16 | 16 | using System.ServiceProcess; |
17 | 17 | using System.Text.RegularExpressions; |
18 | 18 | using System.Threading; |
| 19 | +using System.Diagnostics; |
19 | 20 |
|
20 | 21 | namespace EvlWatcher |
21 | 22 | { |
@@ -45,6 +46,7 @@ public class EvlWatcher : ServiceBase, IEvlWatcherService |
45 | 46 | /// all loaded tasks |
46 | 47 | /// </summary> |
47 | 48 | private static readonly List<LogTask> _logTasks = new List<LogTask>(); |
| 49 | + private static readonly Dictionary<LogTask, DateTime> _logTasksPerfWarningIssued = new Dictionary<LogTask, DateTime>(); |
48 | 50 |
|
49 | 51 | /// <summary> |
50 | 52 | /// adds some extra output |
@@ -331,6 +333,7 @@ private void PushBanList() |
331 | 333 | .Union(_serviceconfiguration.BlacklistAddresses) |
332 | 334 | .Distinct() |
333 | 335 | .Where(address => !IsWhiteListed(address)) |
| 336 | + .Where(address => !address.Equals(IPAddress.Any)) |
334 | 337 | .ToList(); |
335 | 338 |
|
336 | 339 | _firewallApi.AdjustIPBanList(banList); |
@@ -492,40 +495,48 @@ private void Run() |
492 | 495 |
|
493 | 496 | if (eventsForThisTask.Count > 0) |
494 | 497 | { |
495 | | - DateTime start = DateTime.Now; |
| 498 | + var start = Stopwatch.GetTimestamp(); |
496 | 499 |
|
497 | 500 | t.ProvideEvents(eventsForThisTask); |
498 | 501 |
|
499 | | - if (DateTime.Now.Subtract(start).TotalMilliseconds > 500) |
500 | | - _logger.Dump($"Warning: Task {t.Name} takes a lot of resources. This can make your server vulnerable to DOS attacks. Try better boosters.", SeverityLevel.Warning); |
| 502 | + var end = Stopwatch.GetTimestamp(); |
| 503 | + |
| 504 | + if (end - start > 50000000) |
| 505 | + { |
| 506 | + if (!_logTasksPerfWarningIssued.ContainsKey(t) || DateTime.Now > _logTasksPerfWarningIssued[t].AddHours(24)) |
| 507 | + { |
| 508 | + _logger.Dump($"Warning: Task {t.Name} takes a lot of resources. This can have different reasons, maybe you get a lot of events (problems in domain configuration, stale hidden credentials..), or the event processing is too slow. This can cause EvlWatcher to produce CPU spikes. Try better boosters, or try to find the root problem,", SeverityLevel.Warning); |
| 509 | + _logTasksPerfWarningIssued[t] = DateTime.Now; |
| 510 | + } |
| 511 | + } |
501 | 512 | } |
502 | 513 | } |
503 | 514 | } |
504 | 515 | } |
505 | 516 |
|
506 | | - List<IPAddress> blackList = new List<IPAddress>(); |
| 517 | + List<IPAddress> polledTempBansOfThisCycle = new List<IPAddress>(); |
| 518 | + List<IPAddress> polledPermaBansOfThisCycle = new List<IPAddress>(); |
507 | 519 |
|
508 | 520 | //let the tasks poll which ips they want to have blocked / or permanently banned |
509 | 521 | foreach (LogTask t in _logTasks) |
510 | 522 | { |
511 | 523 | if (t is IPBlockingLogTask ipTask) |
512 | 524 | { |
513 | | - SetPermanentBanInternal(ipTask.GetPermaBanVictims().ToArray()); |
514 | | - |
515 | | - List<IPAddress> blockedIPs = ipTask.GetTempBanVictims(); |
| 525 | + List<IPAddress> polledTempBansOfThisTask = ipTask.GetTempBanVictims(); |
| 526 | + List<IPAddress> polledPermaBansOfThisTask = ipTask.GetPermaBanVictims(); |
516 | 527 |
|
517 | | - _logger.Dump($"Polled {t.Name} and got {blockedIPs.Count} temporary and {_serviceconfiguration.BlacklistAddresses.Count()} permanent ban(s)", SeverityLevel.Verbose); |
| 528 | + _logger.Dump($"Polled {t.Name} and got {polledTempBansOfThisTask.Count} temporary and {polledPermaBansOfThisTask.Count()} permanent ban(s)", SeverityLevel.Verbose); |
518 | 529 |
|
519 | | - foreach (IPAddress blockedIP in blockedIPs) |
520 | | - if (!blackList.Contains(blockedIP)) |
521 | | - blackList.Add(blockedIP); |
| 530 | + polledPermaBansOfThisCycle.AddRange(polledPermaBansOfThisTask.Where(ip => !polledPermaBansOfThisCycle.Contains(ip)).ToList()); |
| 531 | + polledTempBansOfThisCycle.AddRange(polledTempBansOfThisTask.Where(ip => !polledTempBansOfThisCycle.Contains(ip)).ToList()); |
522 | 532 | } |
523 | 533 | } |
524 | 534 |
|
525 | 535 | _logger.Dump($"\r\n-----Cycle complete, sleeping {_serviceconfiguration.EventLogInterval} s......\r\n", SeverityLevel.Debug); |
526 | | - |
527 | | - _lastPolledTempBans = blackList; |
528 | 536 |
|
| 537 | + SetPermanentBanInternal(polledPermaBansOfThisCycle.ToArray(), pushBanList: false); |
| 538 | + _lastPolledTempBans = polledTempBansOfThisCycle; |
| 539 | + |
529 | 540 | PushBanList(); |
530 | 541 | } |
531 | 542 | catch (Exception executionException) |
@@ -570,12 +581,13 @@ private void Run() |
570 | 581 | } |
571 | 582 | } |
572 | 583 |
|
573 | | - private void SetPermanentBanInternal(IPAddress[] addressList) |
| 584 | + private void SetPermanentBanInternal(IPAddress[] addressList, bool pushBanList=true) |
574 | 585 | { |
575 | 586 | foreach (IPAddress address in addressList) |
576 | 587 | _serviceconfiguration.AddBlackListAddress(address); |
577 | 588 |
|
578 | | - PushBanList(); |
| 589 | + if (pushBanList) |
| 590 | + PushBanList(); |
579 | 591 | } |
580 | 592 |
|
581 | 593 |
|
|
0 commit comments