mp3 transfer -- apache log analysis

[Greg Sims]

We have been having some server HTTP alerts from our monitoring system. I did some research in the apache access_logs and see a behavior that I don't understand. I pulled some data this morning in hopes that you could help me understand what is happening here and how to potentially correct it.

http://raystedman.org/4204Ref.txt contains a log sequence that accesses one mp3 file by one user. The mp3 file is http://raystedman.org/mp3/4204.mp3 and is almost 7 MB large. Normally I will only see one record in the access_log for a transfer like this one. This transfer is really a mess. Why does it require this huge number of log records to transfer this one file?

The user is working on transferring a group of .mp3 files at the same time. This can be seen at http://raystedman.org/mp3Ref.txt. The server doesn't have much else going on which can be seen here http://raystedman.org/22Ref.txt. We can also see the side effects of all this in server-status http://raystedman.org/22Stat.txt.

Any ideas? Thanks! Greg

 

[faris]

Just an idea, but...

He seems to be downloading several mp3 files not just one.

Could it be that this is a dial-up user using a download accelerator to split the files into multiple chunks? I've seen some accelerators splitting things into up to 16 chunks for no good reason.

And if he keeps losing the connection (or overloading the server or his pc or whatever), the download accelerator may then be coming back again over and over to re-start the download.

Like I say, just an idea. It may be nothing likr this at all.

 

[Greg Sims]

Thanks for the reply feris!

I believe your scenario is likely correct -- this user has limited resources for some reson (modem connection, limited RAM, ...) and is downloaded in small blocks.

It doesn't seem correct that this one slow uses should be able to run on 10-20 apache processes at a time. This seems very unfair to other users. Is there a way to limit apache resources on the server by IP Address or something simular?

Thanks again!