Index: modules/comment/comment.admin.inc
===================================================================
--- modules/comment/comment.admin.inc    (revision 281)
+++ modules/comment/comment.admin.inc    (revision 282)
@@ -57,7 +57,7 @@
     array('data' => t('Time'), 'field' => 'timestamp', 'sort' => 'desc'),
     array('data' => t('Operations'))
   ));
-  $result = pager_query('SELECT c.subject, c.nid, c.cid, c.comment, c.timestamp, c.status, c.name, c.homepage, u.name AS registered_name, u.uid, n.title as node_title FROM {comments} c INNER JOIN {users} u ON u.uid = c.uid INNER JOIN {node} n ON n.nid = c.nid WHERE c.status = %d'. tablesort_sql($form['header']['#value']), 50, 0, NULL, $status);
+  $result = pager_query('SELECT c.subject, c.nid, c.cid, c.comment, c.timestamp, c.status, c.name, c.homepage, u.name AS registered_name, u.uid, n.title as node_title FROM {comments} c LEFT JOIN {users} u ON u.uid = c.uid INNER JOIN {node} n ON n.nid = c.nid WHERE c.status = %d'. tablesort_sql($form['header']['#value']), 50, 0, NULL, $status);

   // build a table listing the appropriate comments
   $destination = drupal_get_destination();
@@ -215,7 +215,7 @@
  *   The comment do be deleted.
  */
 function comment_delete($cid = NULL) {
-  $comment = db_fetch_object(db_query('SELECT c.*, u.name AS registered_name, u.uid FROM {comments} c INNER JOIN {users} u ON u.uid = c.uid WHERE c.cid = %d', $cid));
+  $comment = db_fetch_object(db_query('SELECT c.*, u.name AS registered_name, u.uid FROM {comments} c LEFT JOIN {users} u ON u.uid = c.uid WHERE c.cid = %d', $cid));
   $comment->name = $comment->uid ? $comment->registered_name : $comment->name;

   $output = '';
@@ -287,7 +287,7 @@
   comment_invoke_comment($comment, 'delete');

   // Delete the comment's replies
-  $result = db_query('SELECT c.*, u.name AS registered_name, u.uid FROM {comments} c INNER JOIN {users} u ON u.uid = c.uid WHERE pid = %d', $comment->cid);
+  $result = db_query('SELECT c.*, u.name AS registered_name, u.uid FROM {comments} c LEFT JOIN {users} u ON u.uid = c.uid WHERE pid = %d', $comment->cid);
   while ($comment = db_fetch_object($result)) {
     $comment->name = $comment->uid ? $comment->registered_name : $comment->name;
     _comment_delete_thread($comment);
Index: modules/comment/comment.module
===================================================================
--- modules/comment/comment.module    (revision 281)
+++ modules/comment/comment.module    (revision 282)
@@ -936,7 +936,7 @@

     if ($cid && is_numeric($cid)) {
       // Single comment view.
-      $query = 'SELECT c.cid, c.pid, c.nid, c.subject, c.comment, c.format, c.timestamp, c.name, c.mail, c.homepage, u.uid, u.name AS registered_name, u.signature, u.signature_format, u.picture, u.data, c.status FROM {comments} c INNER JOIN {users} u ON c.uid = u.uid WHERE c.cid = %d';
+      $query = 'SELECT c.cid, c.pid, c.nid, c.subject, c.comment, c.format, c.timestamp, c.name, c.mail, c.homepage, u.uid, u.name AS registered_name, u.signature, u.signature_format, u.picture, u.data, c.status FROM {comments} c LEFT JOIN {users} u ON c.uid = u.uid WHERE c.cid = %d';
       $query_args = array($cid);
       if (!user_access('administer comments')) {
         $query .= ' AND c.status = %d';
@@ -957,7 +957,7 @@
     else {
       // Multiple comment view
       $query_count = 'SELECT COUNT(*) FROM {comments} c WHERE c.nid = %d';
-      $query = 'SELECT c.cid as cid, c.pid, c.nid, c.subject, c.comment, c.format, c.timestamp, c.name, c.mail, c.homepage, u.uid, u.name AS registered_name, u.signature, u.signature_format, u.picture, u.data, c.thread, c.status FROM {comments} c INNER JOIN {users} u ON c.uid = u.uid WHERE c.nid = %d';
+      $query = 'SELECT c.cid as cid, c.pid, c.nid, c.subject, c.comment, c.format, c.timestamp, c.name, c.mail, c.homepage, u.uid, u.name AS registered_name, u.signature, u.signature_format, u.picture, u.data, c.thread, c.status FROM {comments} c LEFT JOIN {users} u ON c.uid = u.uid WHERE c.nid = %d';

       $query_args = array($nid);
       if (!user_access('administer comments')) {

But I am not satisfied with the second solution because of some wrong placement with a few log records. I would like use this:

mv /var/log/nginx/access_log /var/log/nginx/access_log.processing -f;
mv /var/log/nginx/error_log /var/log/nginx/error_log.processing -f;
kill -USR1 `cat /usr/local/nginx/logs/nginx.pid`;
/usr/bin/perl /usr/local/awstats/wwwroot/cgi-bin/awstats.pl -LogFile=/var/log/nginx/access_log.processing -update
cat /var/log/nginx/access_log.processing | /usr/local/sbin/cronolog /var/log/nginx/%Y/%m/%d/access_log;
cat /var/log/nginx/error_log.processing | /usr/local/sbin/cronolog /var/log/nginx/%Y/%m/%d/error_log;
rm /var/log/nginx/access_log.processing /var/log/nginx/error_log.processing -f;

如果你想使用自己的rpc，可以从这里下载coolplayer- youtube-patch.zip，解压后将rpc.php覆盖原来目录/wp-content/plugins /coolplayer/下的rpc.php文件即可。

netstat -na | grep :80 |awk '{print $5}'|awk -F '::ffff:' '{print $2}' | grep ':' | awk -F: '{print $1}' | sort | uniq -c | sort -r | awk -F' ' '{if ($1 > 50) print $2}' | sed 's/^.*$/iptables -I RH-Firewall-1-INPUT 1 -p tcp -m tcp -s & --dport 80 --syn -j REJECT/' | sh

该脚本基于的基础是认为从一个IP过来的连接数过大（超过50个），则该IP可能在进行攻击。实际上可能误杀掉一些只能通过代理服务器访问的大公司用户，或者某些有点贪心的网络爬虫。可以在脚本中加入一些白名单以防止误杀，如：

netstat -na | grep :80 |awk '{print $5}'|awk -F '::ffff:' '{print $2}' | grep ':' | awk -F: '{print $1}' | sort | uniq -c | sort -r | awk -F' ' '{if ($1 > 50) print $2}' | grep -v xxx.xxx.xxx.xxx | sed 's/^.*$/iptables -I RH-Firewall-1-INPUT 1 -p tcp -m tcp -s & --dport 80 --syn -j REJECT/' | sh

df | grep “/var” | awk ‘{ print $5 }’ | awk -F”%” ‘{print $1}’ | awk ‘{ if ($1 > 90){print “alert.sh \”139xxxxxxxx\” \”insufficient disk space on /var. “,$1,”\”"} }’ | csh
ps -ef | grep httpd | grep -v cronolog | grep -v grep | grep -v root | wc -l | awk ‘{ if ($1 > 3000){print “alert.sh \”139xxxxxxxx\” \”apache process “, $1,”\”"} }’ | csh
echo ‘show processlist’ | mysql | grep -v Id | grep -v processlist | wc -l | awk ‘{ if ($1 > 3000){print “alert.sh \”139xxxxxxxx\” \”mysql process “, $1,”\”"} }’ | csh

alert.sh 脚本:

echo $2
echo -e “From:monitor<>\nReply-to:support <support.labs@etentec.com>\nSubject:$2\n\n$2\n.” | /usr/sbin/sendmail $1@139.com

for¹
do
    clear
    date
    echo -n ‘httpd process:             ‘;ps -ef | grep httpd | grep -v cronolog | grep -v grep | grep -v root | wc -l
    echo -n ‘http connection:   ‘;netstat -an | grep :80 | grep ESTABLISHED | wc -l
    echo -n ‘mysql process:             ‘;echo ‘show processlist’ | mysql | grep -v Id | grep -v processlist | wc -l
    echo -n ‘mysql connection:  ‘;netstat -an | grep 3306 | grep ESTABLISHED | wc -l
    echo ‘tcp connection stats:’;netstat -n | awk ‘/^tcp/ {++S[$NF]} END {for(a in S) print “   “,a, S[a]}’
    echo ‘sorted ESTABLISHED connections: ‘;netstat -na|grep ESTABLISHED|awk ‘{print $5}’|awk -F: ‘{print $1}’|sort|uniq -c|sort -r +0n
    echo ‘sorted SYN connections: ‘; netstat -na|grep SYN|awk ‘{print $5}’|awk -F: ‘{print $1}’|sort|uniq -c|sort -r +0n
    sleep 5
done

1. ; ;