morganpyneHi,
I've recently been working on a reasonably busy WP 2.9.1 installation for a client and have noticed a huge number of hits in the webserver access log appearing to come from the VPS it is hosted on. Typical entries look like:
xxx.xxx.xxx.xxx - - [28/Feb/2010:18:49:09 +0000] "GET /wp-content/uploads/2008/11/image.jpg HTTP/1.0" 200 72642 "-" "-"
Where the xxx.xxx.xxx.xxx is the actual public IP address of the machine hosting the site. Since there is no Referrer and no User Agent provided it's difficult to figure out what's responsible for this. The volume of traffic in the logs makes it also difficult to see if there is any useful context to the requests. It appears that all the requests are confined to images in the uploads folder.
The site is running a large number of plugins. For completeness of this post here is the list : All in One SEO Pack, Audio player, Auto Thickbox, cforms, Cleaner Gallery, DISQUS Comment System, FD Feedburner Plugin, FLV Embed, Get Author Profile, Get Post Image, Google XML Sitemaps, Meebo for Sites, RSS Footer, RSSupplement, Special Post Properties, Twitter for WordPress, Viper's Video Quicktags, WP-Optimize, WP-PageNavi, WP Super Cache, WPtouch
I have a local dev copy of the site which does not exhibit this behaviour, and due to the busy high profile nature of the site in question I can't really poke and prod too much at it to find out what is causing the requests. Arbitrarily disabling plugins and modifying plugin source code isn't really an option right now.
My feeling is that one of the plugins is making curl or one of the php URL fopen wrapper calls based on some condition, but I'm not familiar enough with each plugin to say what or why.
If it comes to it, I will have to debug this the hard way, but I would rather benefit from somebody else's experience first. Has anybody seen anything like this before?
Thanks,
Morgan
neovaikhsan