android.git.linaro.org/gitweb causes high server load

[Paul Sokolovsky]

There was a case of very high android.git.linaro.org load during Jelly Bean release/sync, see lp:1023151. At that time, ps ax showed lot of gitweb.cgi and gzip processes running. After gitweb was disabled as part of mentioned bug, the load subsided back to <10 figures.

gitweb is tentatively disabled until Jul 25, and this ticket is to analyze the situation and considering changes we can make to rectify the situation and enable gitweb earlier.

[Paul Sokolovsky (pfalcon)]

Ok, my hypothesis of what happened here is: Google for a while doesn't offer a gitweb or equivalent for AOSP code browsing. Now Google releases JellyBean. A lot of people want to get their hands on it, including "amateurs", who don't do git. Now suppose that a link(s) gets posted on somewhere like xda-developers saying "you can download JB as tarball from here" and pointing to "snapshot" download link as supported by gitweb. End result: we get DDoSed.

So, the culprit is with very high probability a "snapshot download" feature, which rather should be disabled in our install. Makes sense to look for other high-load features at the same time.

[Paul Sokolovsky (pfalcon)]

Docs fro gitweb:

http://repo.or.cz/w/alt-git.git?a=blob_plain;f=gitweb/README

http://support.rubyforge.org/svn/trunk/support/gitweb/gitweb.cgi (inline comments)

So, according to the them,

$feature{'snapshot'}{'default'} = [];

Needs to be set in /etc/gitweb.conf or equivalent to disable snapshots.

Other things worth turning off:

$feature{'grep'}{'default'} = [0];
$feature{'pickaxe'}{'default'} = [0];

[Paul Sokolovsky (pfalcon)]

Updated https://rt.linaro.org//Ticket/Display.html?id=533 with this info.

[Paul Sokolovsky (pfalcon)]

gitweb was re-enabled today with config updated as described above. No signs of gitweb hogging CPU so far.