Removing Apache log noise - Jan van den Berg

Removing Apache log noise

29 April 2026

I noticed one of my sites was running slow. So I logged in and saw that my server load was climbing.

Being a webserver the first place to look are the serverlogs. With a quick tail -f in the /var/log/apache dir I saw 1000s of these flying by:

2a01:4f8:1c1c:79a1::1 - - [01/Apr/2026:22:01:38 +0200] "GET /images/WINKEL2025-24/Img9369.JPG HTTP/2.0" 200 46672 "-" "Mozilla/5.0 Joomla!/5.4.4 Joomla"<br>2a01:4f8:1c1c:79a1::1 - - [01/Apr/2026:22:01:39 +0200] "GET /images/WINKEL2025-24/Img9213.JPG HTTP/2.0" 200 21097 "-" "Mozilla/5.0 Joomla!/5.4.4 Joomla"<br>2a01:4f8:1c1c:79a1::1 - - [01/Apr/2026:22:01:39 +0200] "GET /images/WINKEL2025-24/Img9214.JPG HTTP/2.0" 200 21466 "-" "Mozilla/5.0 Joomla!/5.4.4 Joomla"<br>2a01:4f8:1c1c:79a1::1 - - [01/Apr/2026:22:01:39 +0200] "GET /images/WINKEL2025-24/Img9287.JPG HTTP/2.0" 200 40848 "-" "Mozilla/5.0 Joomla!/5.4.4 Joomla"<br>2a01:4f8:1c1c:79a1::1 - - [01/Apr/2026:22:02:51 +0200] "GET /images/WINKEL2020-05/Img2955.JPG HTTP/2.0" 200 45983 "-" "Mozilla/5.0 Joomla!/5.4.4 Joomla"<br>2a01:4f8:1c1c:79a1::1 - - [01/Apr/2026:22:02:51 +0200] "GET /images/WINKEL2020-05/Img2963.JPG HTTP/2.0" 200 51145 "-" "Mozilla/5.0 Joomla!/5.4.4 Joomla"<br>2a01:4f8:1c1c:79a1::1 - - [01/Apr/2026:22:02:51 +0200] "GET /images/WINKEL2020-05/Img2969.JPG HTTP/2.0" 200 42554 "-" "Mozilla/5.0 Joomla!/5.4.4 Joomla"<br>2a01:4f8:1c1c:79a1::1 - - [01/Apr/2026:22:02:51 +0200] "GET /images/WINKEL2020-05/Img2975.JPG HTTP/2.0" 200 38756 "-" "Mozilla/5.0 Joomla!/5.4.4 Joomla"<br>2a01:4f8:1c1c:79a1::1 - - [01/Apr/2026:22:02:51 +0200] "GET /images/WINKEL2020-05/Img2983.JPG HTTP/2.0" 200 40720 "-" "Mozilla/5.0 Joomla!/5.4.4 Joomla"<br>2a01:4f8:1c1c:79a1::1 - - [01/Apr/2026:22:02:51 +0200] "GET /images/WINKEL2020-05/Img2989.JPG HTTP/2.0" 200 38537 "-" "Mozilla/5.0 Joomla!/5.4.4 Joomla"<br>2a01:4f8:1c1c:79a1::1 - - [01/Apr/2026:22:02:51 +0200] "GET /images/WINKEL2020-05/Img2995.JPG HTTP/2.0" 200 39971 "-" "Mozilla/5.0 Joomla!/5.4.4 Joomla"<br>2a01:4f8:1c1c:79a1::1 - - [01/Apr/2026:22:02:51 +0200] "GET /images/WINKEL2020-05/Img2997.JPG HTTP/2.0" 200 43724 "-" "Mozilla/5.0 Joomla!/5.4.4 Joomla"<br>2a01:4f8:1c1c:79a1::1 - - [01/Apr/2026:22:02:51 +0200] "GET /images/WINKEL2020-05/Img3001.JPG HTTP/2.0" 200 37124 "-" "Mozilla/5.0 Joomla!/5.4.4 Joomla"<br>2a01:4f8:1c1c:79a1::1 - - [01/Apr/2026:22:02:52 +0200] "GET /images/WINKEL2020-05/Img3003.JPG HTTP/2.0" 200 39263 "-" "Mozilla/5.0 Joomla!/5.4.4 Joomla"<br>2a01:4f8:1c1c:79a1::1 - - [01/Apr/2026:22:02:52 +0200] "GET /images/WINKEL2020-05/Img3011.JPG HTTP/2.0" 200 36747 "-" "Mozilla/5.0 Joomla!/5.4.4 Joomla"<br>All within the same second.

That's not good.

Crawlers, bots? Sure. Of course. But that is not the whole story.

Because the IP is my own IP. And you can see the user-agent is Joomla.

So Joomla (please no inquiries at this point why I am running Joomla) is calling itself literally millions of times?

The server hosts (among other things) two Joomla Virtuemart shops with lots and lots of unique items (50k+). And when you load a category page in either shop, you will see a bunch of thumbs. Clicking a thumb will bring up the main image in a FancyBox popup.

Nice uh?

But you can probably tell where this is going.

The way this works is that calling a category page will normally load only the thumbs: small, fast.

Great.

But the popup code also pre-loaded ALL the full images...everytime.

So by just visiting a category, Joomla would load all full images for that category.

Not so great.

The FancyBox popup is a hack I put there myself. It's not something that is in the Virtuemart code.

But it worked. No second thought. However now it was stressing out my server.

I asked Gemini and changed this:

product_name ?>" href="images[0]->file_url ?>"><br>images[0]->displayMediaThumb('class="browseProductImage"', false);<br>?>

To this:

product_name ?>"<br>href="images[0]->file_url ?>">

images[0]->file_url_thumb ?>"<br>class="browseProductImage"<br>alt="product_name ?>"<br>width="225"<br>height="180"<br>loading="lazy" />

My serverlog for this month had 5.011.360 lines! And 4.278.761 of these lines were calls to itself. So 85% of all calls.

Bonkers. Yes, I agree.

$ wc -l access.log<br>5011360 posthistorie-access.log<br>$ grep Joomla access.log|wc -l<br>4278761<br>My server logs now have quieted down quite a bit.

Number of lines per hour for the last day:

grep Joomla access.log | awk '{print $4}' | grep "$(grep Joomla access.log | awk '{print $4}' | cut -d: -f1 | tr -d '[' | sort | tail -1)" | cut -d: -f2 | sort | uniq -c<br>13561 00<br>9909 01<br>5333 02<br>5175 03<br>4713 04<br>5286 05<br>7362 06<br>10914 07<br>8825 08<br>8113 09<br>11800 10<br>22920 11<br>7525 12<br>59 13<br>52 14<br>35 15<br>24 16<br>36 17<br>60 18<br>24 19<br>24 20<br>48 21<br>60 22<br>12 23<br>Wow!

Of course all of this would not be so much of a problem when only real customers visit the site, but the internet being what it is today, your site will get bombarded by crawlers, bots and what have you. And they will systematically try and visit all categories, hence the...