Lee

I think you'll find the behavior you're wanting is how it does work, but it has been sometime since I've looked at this. My understanding is nginx variables are lazy...

I would start with generating a flamegraph of the server when it's not under attack and when it is under attack. That will help with identifying where the CPU increase...

What if you try: ``` geoip2 /var/lib/GeoIP/GeoLite2-Country.mmdb { auto_reload 24h; $geoip2_country_name source=$http_cf_connecting_ip country names en; $geoip2_country source=$http_cf_connecting_ip default=XX country iso_code; } ```

If you can provide a small fully working config that can replicate the issue, I could take a look. But I've tried to replicate locally and can't: config: ``` lee@debian:~/nginx-1.24.0/install$...