Difference between revisions of "Atomicorp WAF Rules Troubleshooting"

Revision as of 13:56, 12 September 2009

Site loads slowly when the rules are loaded

There can be a number of reasons for this. Below is a list of the more common issues:

1. RBL rules are activated, but there is no local DNS server on the system

Check to see if you have the RBL rules loaded. These rules use Real Time Blacklists distributed via DNS. This means that for every connection to your system, a DNS lookup is done against the blacklist to see if the source IP is listed. If you do not have a local DNS server, this can take a very long time depending on how busy the DNS server is that you are communicating with, and because the request is not cached your system is asking the DNS server the same question several times in a row. This is because of the way HTTP works. A typical user request may need to open 100 or more connections to your site, and each time a DNS request is made to the RBL.

The simple fast solution is to make sure you are running a local DNS server on your system and that it caches requestys. That way your RBL lookups are only to your local system, and if it already has the answer it will not have to ask the RBLs DNS server across the Internet. The difference in performance is night and day with a local DNS server, so we highly recommend you use on if you are going to use any RBL with any product.

2. The system is low on resources

As with any piece of software, the WAF will consume some resources on the system. If the system is short on resources the WAF has to compete with other parts of the system for those resources. Check to make sure you do not have any process that is using up RAM or cycles on the system.

3. Custom rules may be inefficient

If you are using custom rules, try disabling them. If a rule is written in an inefficient manner it can kill performance on the system.