Add a way for admins to disable/and or adjust the limits for the "Unusual activity" mail

ERDDAP / erddap

ERDDAP is a scientific data server that gives users a simple, consistent way to download subsets of gridded and tabular scientific datasets in common file formats and make graphs and maps. ERDDAP is a Free and Open Source (Apache and Apache-like) Java Servlet from NOAA NMFS SWFSC Environmental Research Division (ERD).

Creative Commons Zero v1.0 Universal

76 stars 54 forks source link

Add a way for admins to disable/and or adjust the limits for the "Unusual activity" mail #139

Open ChrisJohnNOAA opened 3 months ago

ChrisJohnNOAA commented 3 months ago

Request from Frederic Leclercq:

Add a way how to disable/and or adjust the limits for the "Unusual activity" mail.

The 25% is hard coded: https://github.com/ERDDAP/erddap/blob/main/WEB-INF/classes/gov/noaa/pfel/erddap/LoadDatasets.java#L1253

It'd be great to have the option to tweak that percentage or turn off those emails. Whenever there's a client or bot messing up requests, we end up flooded with those emails.

ayushsingh01042003 commented 1 month ago

I'd like to try and work on this.

Maybe we can add an option (something like a link within the email) that will send a request to the server to disable these emails for a certain duration.

Can I get the steps to reproduce this email if possible?

Where do I set the email who will get the spam?
Is there anything specific I need to do with the datasets.xml file?
Any better solution also is appreciated :)

ChrisJohnNOAA commented 1 month ago

The email address is set in the setup.xml, for example if using the local Jetty server that is emailEverythingTo here: https://github.com/ERDDAP/erddap/blob/main/development/jetty/config/setup.xml#L67

I think we should add a parameter to the datasets.xml that allows specifying the unusual activity threshold. Maybe something like unusualActivityFailPercent that defaults to 25 and has -1 as an option to disable the email.

The failure counter is incremented in Erddap.java: https://github.com/ERDDAP/erddap/blob/main/WEB-INF/classes/gov/noaa/pfel/erddap/Erddap.java#L747

To get the email, you should be able to just send requests to a local server that cause errors. You could set up a specific kind of request to throw an exception (temporarily to make testing easier).