3

My server was having performance issues, things loading slow, pages not loading, etc so I ran the "top" command after logging in via SSH. I noticed the CPU kept jolting up to 40%, on and off, when literally no one is accessing the website. I have other (much less powerful) servers with resting heartrates at 1-5% so I know something is wrong. I log into MySQL, enable general logging and this is what I find:

    event_time Descending 1     user_host   thread_id   server_id   command_type    argument 
    2014-09-20 04:35:07     [root] @ localhost []   46833   0   Connect     root@localhost on
    2014-09-20 04:35:07     [root] @ localhost []   46834   0   Connect     root@localhost on
    2014-09-20 04:35:04     [root] @ localhost []   46832   0   Connect     root@localhost on
    2014-09-20 04:35:03     [root] @ localhost []   46829   0   Connect     root@localhost on
    2014-09-20 04:35:03     [root] @ localhost []   46830   0   Connect     root@localhost on
    2014-09-20 04:35:03     [root] @ localhost []   46831   0   Connect     root@localhost on
    2014-09-20 04:34:58     [root] @ localhost []   46828   0   Connect     root@localhost on
    2014-09-20 04:34:57     [root] @ localhost []   46827   0   Connect     root@localhost on
    2014-09-20 04:34:48     [root] @ localhost []   46826   0   Connect     root@localhost on
    2014-09-20 04:34:41     [root] @ localhost []   46823   0   Connect     root@localhost on
    2014-09-20 04:34:41     [root] @ localhost []   46824   0   Connect     root@localhost on
    2014-09-20 04:34:41     [root] @ localhost []   46825   0   Connect     root@localhost on
    2014-09-20 04:34:39     [root] @ localhost []   46822   0   Connect     root@localhost on
    2014-09-20 04:34:37     [root] @ localhost []   46821   0   Connect     root@localhost on
    2014-09-20 04:34:36     [root] @ localhost []   46820   0   Connect     root@localhost on
    2014-09-20 04:34:33     [root] @ localhost []   46819   0   Connect     root@localhost on
    2014-09-20 04:34:30     [root] @ localhost []   46818   0   Connect     root@localhost on
    2014-09-20 04:34:29     [root] @ localhost []   46815   0   Connect     root@localhost on
    2014-09-20 04:34:29     [root] @ localhost []   46816   0   Connect     root@localhost on

There is literally something like 100 "connect" commands mySQL is processing every minute. I'm sure this is what is causing my performance issues. But my problem is that I don't know where these commands are coming from or how I might go about tracing the source. Any ideas?

1 Answer 1

0

Getting BruteForced, or simply stuck in a connect loop, could more likely be a faulty application you installed, what was your recent installation?

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .