Orthanc Service Unavailability Due to High DICOMWeb Traffic and Resource Exhaustion (Started 2 Days Ago)

Hello Orthanc Community,

We are currently experiencing repeated Orthanc service unavailability due to resource exhaustion and would appreciate your guidance.

Environment

  • Orthanc with PostgreSQL backend

  • AWS EC2 c6a.xlarge (4 vCPU, 8 GB RAM)

  • DICOMWeb enabled

Observed Behavior

  • High volume of DICOMWeb frame retrieval requests

  • Significant PostgreSQL activity

  • Severe memory pressure

  • Swap space nearly exhausted

  • High kswapd activity

  • Disk I/O saturation

  • Orthanc becomes unresponsive for periods of time

What We Have Observed

  • No evidence of Orthanc crashes

  • No PostgreSQL crashes

  • No container restart loops

  • No OOM-kill events

Our Nginx logs indicate approximately 438,000 requests originating from a client using the user-agent “python-httpx/0.28.1”. The requests are primarily targeting study, series, instance, metadata, and DICOMWeb frame retrieval endpoints.

One important observation is that this issue started only within the last two days. Prior to that, the Orthanc environment was operating normally.

We are trying to determine:

  1. Whether this pattern could indicate an automated crawler, bot, misconfigured integration, or excessive client-side polling.

  2. Whether anyone has seen similar behavior involving large numbers of DICOMWeb frame retrieval requests.

  3. What Orthanc-side or infrastructure-side mitigations would be recommended.

  4. Whether rate limiting, caching, request throttling, or specific Orthanc configuration changes could help prevent resource exhaustion.

  5. What monitoring metrics or logs would be most useful in identifying the root cause.

We would greatly appreciate any recommendations on both investigation and immediate mitigation steps.

Thank you for your assistance.

Hi,

Enable the trace logs for a few seconds, check the HTTP headers and you should be able to identify the user that is sending all these requests (you have authentication enabled right ?)

Hope this helps,

Alain.