Open the project folder
Put the exported access log and a copy of your server settings in one folder, then open that folder in SmartCode Relay.
Workflows
Layer 7 DDoS protection: from exported log to runbook
03
A traffic spike on a small shop site
Your shop site slowed down last night. Why? A campaign or a layer 7 flood could both explain it. You have an exported access log and a copy of your server settings, and this guide turns them into a summary, a rate-limit draft and a runbook.
Summarise the requests
Ask the agent to run your log-summary script and save requests per address and per path to a CSV file.
Draft the rate limit
Let it edit the copy of your settings, read the diff, and run your own test command on that copy.
Write and check
Save ddos-runbook.txt, read it line by line, and use Plan only to list what remains before you apply anything.
Example: a one-page response runbook
Write ddos-runbook.txt for the shop site from the log summary and the provider notes.
- read_file
exports/summary.csvread - http_get
your provider's status pagefetched - write_file
ddos-runbook.txtsaved - grep
^step ddos-runbook.txt6 matches
Waiting for your OK before the next stepRejectAccept
ddos-runbook.txt
# ddos-runbook.txt - small shop site
# Owner: site admin
trigger: slow pages and an odd log summary
step 1: check the provider status page
step 2: raise the provider protection level
step 3: review the log summary for top paths
step 4: apply a rate limit, then test it
step 5: keep the origin address private
step 6: record times, rules and who was called
rollback: remove the limit if real visitors are refused
review: update this file after each incidentIt is plain text. Every step names an action for you or your provider, none contains an attack command, and the last two lines say how to roll back and when to review.
Two more workflows
Write thresholds for your own DDoS monitoring
Thresholds belong in the monitoring system you already run, and the agent only helps you choose the numbers. It sets no alerts itself. read_file opens the log summary from a normal busy day, grep searches it for the paths that matter, and write_file saves a short notes file with the values to enter. Dealing with a website DDoS attack goes better when thresholds were written down before the night they are needed. Use Plan only first to read the outline of the steps, since that mode runs nothing, then switch to Ask first so the agent can read the summary and write_file can save the notes. Check each number against your own analytics, then enter it yourself and watch the first alert with care.
Separate one busy address from many
Mitigating DDoS traffic from distributed IPs cannot rest on blocking one address, so compare the per-address and the per-path counts of your summary. Many small senders add up. Layer 7 DDoS protection leans on per-path limits, because every request looks normal on its own. Shell runs your log-summary script again so it groups by path, and grep searches the new summary for the paths you care about. When DDoS attacks look relentless and you cannot stop them at the server, the runbook says when to call the provider. Review the summary in Ask first mode and test any new limit on a copy.
