Strange loop requests in Apache log

Strange requests and behavior when the website is behind Cloudflare.

Intro: We have been using Cloudflare for almost 5 years and never had problems, but since 2nd May 2024 we have load increase on the backend. The application that we have is the backend PHP API behind Apache, which is called by our clients via PHP Curl.

After starting analyzing the logs we found that there are strange loop requests to our API appearing after 2nd May, as:

xx.xx.xxx.xx - - [14/May/2024:02:32:46 -0700] “POST /template/build HTTP/1.1” 200 57 “-” “URL” --15–

when the normal request looks as:

xx.xx.xxx.xx - - [14/May/2024:02:32:46 -0700] “POST /template/build HTTP/1.1” 200 907158 “-” “URL” --1–

  • where, --15–, --1-- is a %T in Apache logs means the time taken to serve the request, in seconds. The strange thing is that all such requests have at least 15-seconds… And they appear continuously, again and again in loop.

After some investigation, we found that requests appear only when our API is behind the Cloudflare proxy, and the strange thing is that if we disable the proxying, the Apache requires to be restarted via apachectl -k restart. apachectl -k graceful - doesn’t work, requests still appearing in the log file…

We have 2 servers and the same issue on both… It looks like some mistake in code or a problem with Apache, but the problem doesn’t exist if we are turning off Cloudflare.

We have rules to bypass WAF and Cache. SSL is set to “Full”.

We tried:

  • disable Cloudflare IPv6 support
  • disable Web Sockets

Any thoughts? Thanks anyone for any suggestions.