The way nginx in Ubuntu 9.10 prohibits a user_agent

Due to the release of Ubuntu 9.10, SRT Ubuntu source of the latest traffic is very bad ~ yesterday's average traffic is 9.6mb/s, calculate the day has 800GB ... More abominable is, an analysis of the log, there is a "http://www.aliyun.com/zixun/aggregation/29851.html" >mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1. NET CLR 1.1.4322;. NET CLR 2.0.50727) "User_agent (said to be thunder), very exaggerated, incredibly accounted for 80% of the traffic, look at my following log analysis:

$ tail-n 1000/var/log/nginx/mirror.access.log | Awk-f\ "' {a[$ (NF-1)]++}end{for (k in A) print A[k],k} ' | Sort-n | Tail
3 mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
4 samsung-sgh-e250/1.0 profile/midp-2.0 configuration/cldc-1.1 up. Browser/6.2.3.3.c.1.101 (GUI) mmp/2.0 (compatible; googlebot-mobile/2.1; +http://www.google.com/bot.html)
5 mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0. NET CLR 1.1.4322
6 Ubuntu apt-http/1.3 (0.7.20.2UBUNTU6)
mozilla/4.0 (compatible; MSIE 5.00; Windows 98)
mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Ubuntu apt-http/1.3 (0.7.23.1UBUNTU2)
mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; )
767 mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1. NET CLR 1.1.4322;. NET CLR 2.0.50727)

So, I have to find a way to ban the UA, or too much impact on access, recently a lot of users have access to the situation is not smooth. But this aspect of the information on the Internet is really not easy to find, so ask the ubuntu-cn of a leaf boss, finally found a way:
Create a/etc/nginx/agent.conf content as follows (note that spaces and parentheses need to be escaped using "\", which I have been groping for a long time):

if ($http _user_agent ~ "mozilla/4.0\ \ Compatible;\ Msie\ 6.0;\ Windows\ nt\ 5.1;\ Sv1;\. Net\ clr\ 1.1.4322;\. Net\ clr\ 2.0.50727\) "{return 404;}

Then in this site configuration include this conf file, such as/etc/nginx/sites-enabled/ubuntu-mirror add the following line: include/etc/nginx/agent.conf;

Thunderbolt V5.9, it seems very necessary to maintain a list of UA, but in that case the software will be more rogue.
For this crap, UA was identified on the Apache/lighttpd/nginx/squid. Do source OK, can make into admittance, only allow apt/wget these, do public service is really depressing.