Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am experiencing intermittent, very odd jumps in server load that generally end in server being unavailable. Server runs a pretty high traffic website on Wordpress, Apache, MySQL. There is a plugin(hypercache) installed that minimizes mysql usage by caching full pages. However, everytime spike in load happens, mysql eventually becomes unavailable. Load average jumps from 2 to 30-40 during that time and apache seems to be handling a lot of requests(I've seen in the log file message about MaxClients being reached).

My question is this: how do I know if this is legitimate traffic or if it's a DoS attack? If it's DoS how do I determine what type of attack it is and protect myself against it?

Server runs FreeBSD 7, Apache 2.2, MySQL 5.1

share|improve this question

closed as too broad by Tom O'Connor Aug 25 '13 at 21:20

There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs.If this question can be reworded to fit the rules in the help center, please edit the question.

3  
What about the logs from your border router or firewall? –  jl. Oct 7 '10 at 18:53
    
To expand on jl's comment, check all associated logs - networking equipment, applications & servers. –  user48838 Oct 7 '10 at 20:30
add comment

2 Answers

We notice a similar phenomenon, and if you enable Apache's server-status module, you can see what's going on. For us, it is caused by scanners looking for installations of phpMyAdmin to exploit. Because of the way WordPress processes every request, the load quickly shoots up. WP Super Cache for WordPress makes a HUGE difference. I also created some global RedirectMatch rules which intercept most of these scanner requests before hitting any PHP/MySQL-driven sites.

share|improve this answer
add comment

You can see what's traffic comes to your server by installing TrafShow from FreeBSD ports. Much like ps ax but you see traffic flows instead of process IDs.

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.