My self-hosted #Nostr #Relay logs were growing, growING, GROWING!
So I set out yesterday to determine exactly what was going on.
Guess what I found?!? A handful of clients from different IP addresses were causing a continuous stream of error messages where the relay was complaining of a "filter item too small".
So I tweaked the logging settings to get dumps of the requests generating the errors.
Each error entry looked like the following:
[Ingester 0 ]INFO| [21] dumpInReq: ["REQ","6zn9yubmmkm557n78kkta2e7aahjbn",{"since":1746216000,"authors":["00","01","02","03","04","05","06","07","08","09","0a","0b","0c","0d","0e","0f","10","11","12","13","14","15","16","17","18","19","1a","1b","1c","1d","1e","1f","20","21","22","23","24","25","26","27","28","29","2a","2b","2c","2d","2e","2f","30","31","32","33","34","35","36","37","38","39","3a","3b","3c","3d","3e","3f","40","41","42","43","44","45","46","47","48","49","4a","4b","4c","4d","4e","4f","50","51","52","53","54","55","56","57","58","59","5a","5b","5c","5d","5e","5f","60","61","62","63","64","65","66","67","68","69","6a","6b","6c","6d","6e","6f","70","71","72","73","74","75","76","77","78","79","7a","7b","7c","7d","7e","7f","80","81","82","83","84","85","86","87","88","89","8a","8b","8c","8d","8e","8f","90","91","92","93","94","95","96","97","98","99","9a","9b","9c","9d","9e","9f","a0","a1","a2","a3","a4","a5","a6","a7","a8","a9","aa","ab","ac","ad","ae","af","b0","b1","b2","b3","b4","b5","b6","b7","b8","b9","ba","bb","bc","bd","be","bf","c0","c1","c2","c3","c4","c5","c6","c7","c8","c9","ca","cb","cc","cd","ce","cf","d0","d1","d2","d3","d4","d5","d6","d7","d8","d9","da","db","dc","dd","de","df","e0","e1","e2","e3","e4","e5","e6","e7","e8","e9","ea","eb","ec","ed","ee","ef","f0","f1","f2","f3","f4","f5","f6","f7","f8","f9","fa","fb","fc","fd","fe","ff"]}]
2025-05-02 13:12:41.038 ( 198.848s) [Ingester 0 ]INFO| sending error to [21]: bad req: filter item too small
The culprits were trying to request a list of articles with an author list that basically covers every possible Nostr ID... Or something along those lines.
If you're using a nostr relay you aren't paying for, remember to #zap your relay operator. They deserve a little love from time to time!
#sysadmin #admin #linux #cybersecurity
#nostr is not just #bitcoin
Ed Braaten, N7EKB
npub13r…wapgd
2025-05-03 16:24:56
Author Public Key
npub13r96f0unz2ejtnngz4p4w5nau3m6ds3cnadac09a24czkpf5kkaqrwapgdPublished at
2025-05-03 16:24:56Event JSON
{
"id": "c1373cc6344a38d428f9190f9e964d5efa282e27fd124755e03f9c02bf801510",
"pubkey": "88cba4bf9312b325ce68154357527de477a6c2389f5bdc3cbd55702b0534b5ba",
"created_at": 1746289496,
"kind": 1,
"tags": [
[
"t",
"Nostr"
],
[
"t",
"nostr"
],
[
"t",
"Relay"
],
[
"t",
"relay"
],
[
"t",
"zap"
],
[
"t",
"sysadmin"
],
[
"t",
"admin"
],
[
"t",
"linux"
],
[
"t",
"cybersecurity"
],
[
"t",
"nostr"
],
[
"t",
"bitcoin"
],
[
"r",
"198.848s"
]
],
"content": "My self-hosted #Nostr #Relay logs were growing, growING, GROWING!\n\nSo I set out yesterday to determine exactly what was going on.\n\nGuess what I found?!? A handful of clients from different IP addresses were causing a continuous stream of error messages where the relay was complaining of a \"filter item too small\".\n\nSo I tweaked the logging settings to get dumps of the requests generating the errors. \n\nEach error entry looked like the following: \n\n[Ingester 0 ]INFO| [21] dumpInReq: [\"REQ\",\"6zn9yubmmkm557n78kkta2e7aahjbn\",{\"since\":1746216000,\"authors\":[\"00\",\"01\",\"02\",\"03\",\"04\",\"05\",\"06\",\"07\",\"08\",\"09\",\"0a\",\"0b\",\"0c\",\"0d\",\"0e\",\"0f\",\"10\",\"11\",\"12\",\"13\",\"14\",\"15\",\"16\",\"17\",\"18\",\"19\",\"1a\",\"1b\",\"1c\",\"1d\",\"1e\",\"1f\",\"20\",\"21\",\"22\",\"23\",\"24\",\"25\",\"26\",\"27\",\"28\",\"29\",\"2a\",\"2b\",\"2c\",\"2d\",\"2e\",\"2f\",\"30\",\"31\",\"32\",\"33\",\"34\",\"35\",\"36\",\"37\",\"38\",\"39\",\"3a\",\"3b\",\"3c\",\"3d\",\"3e\",\"3f\",\"40\",\"41\",\"42\",\"43\",\"44\",\"45\",\"46\",\"47\",\"48\",\"49\",\"4a\",\"4b\",\"4c\",\"4d\",\"4e\",\"4f\",\"50\",\"51\",\"52\",\"53\",\"54\",\"55\",\"56\",\"57\",\"58\",\"59\",\"5a\",\"5b\",\"5c\",\"5d\",\"5e\",\"5f\",\"60\",\"61\",\"62\",\"63\",\"64\",\"65\",\"66\",\"67\",\"68\",\"69\",\"6a\",\"6b\",\"6c\",\"6d\",\"6e\",\"6f\",\"70\",\"71\",\"72\",\"73\",\"74\",\"75\",\"76\",\"77\",\"78\",\"79\",\"7a\",\"7b\",\"7c\",\"7d\",\"7e\",\"7f\",\"80\",\"81\",\"82\",\"83\",\"84\",\"85\",\"86\",\"87\",\"88\",\"89\",\"8a\",\"8b\",\"8c\",\"8d\",\"8e\",\"8f\",\"90\",\"91\",\"92\",\"93\",\"94\",\"95\",\"96\",\"97\",\"98\",\"99\",\"9a\",\"9b\",\"9c\",\"9d\",\"9e\",\"9f\",\"a0\",\"a1\",\"a2\",\"a3\",\"a4\",\"a5\",\"a6\",\"a7\",\"a8\",\"a9\",\"aa\",\"ab\",\"ac\",\"ad\",\"ae\",\"af\",\"b0\",\"b1\",\"b2\",\"b3\",\"b4\",\"b5\",\"b6\",\"b7\",\"b8\",\"b9\",\"ba\",\"bb\",\"bc\",\"bd\",\"be\",\"bf\",\"c0\",\"c1\",\"c2\",\"c3\",\"c4\",\"c5\",\"c6\",\"c7\",\"c8\",\"c9\",\"ca\",\"cb\",\"cc\",\"cd\",\"ce\",\"cf\",\"d0\",\"d1\",\"d2\",\"d3\",\"d4\",\"d5\",\"d6\",\"d7\",\"d8\",\"d9\",\"da\",\"db\",\"dc\",\"dd\",\"de\",\"df\",\"e0\",\"e1\",\"e2\",\"e3\",\"e4\",\"e5\",\"e6\",\"e7\",\"e8\",\"e9\",\"ea\",\"eb\",\"ec\",\"ed\",\"ee\",\"ef\",\"f0\",\"f1\",\"f2\",\"f3\",\"f4\",\"f5\",\"f6\",\"f7\",\"f8\",\"f9\",\"fa\",\"fb\",\"fc\",\"fd\",\"fe\",\"ff\"]}]\n2025-05-02 13:12:41.038 ( 198.848s) [Ingester 0 ]INFO| sending error to [21]: bad req: filter item too small\n\nThe culprits were trying to request a list of articles with an author list that basically covers every possible Nostr ID... Or something along those lines.\n\nIf you're using a nostr relay you aren't paying for, remember to #zap your relay operator. They deserve a little love from time to time!\n\n#sysadmin #admin #linux #cybersecurity \n\n#nostr is not just #bitcoin\n",
"sig": "f272f7f2770c1768ff3986c17fa6bffa6bc1b4dd7d73dabd26ffb1513fbf6413ddd142bc5fd2ba8ad45cb7d8163fb57b32781d48434d748e6594e1f46799caf4"
}