Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I get too connection error on my site from today...

PDOException: SQLSTATE[08004] [1040] Too many connections in lock_may_be_available() (line 167 of /home/sevensibir/domains/7sib.ir/public_html/includes/lock.inc).

I think its an attack, because when I run mysqltuner.pl I get:

[!!] Highest connection usage: 100%  (152/151)

but I know I have about 500 visit per day. how can I found if this is an attack. and how can I stop it?

share|improve this question
    
You should ensure that your MySQL instance is only accessible over the network/Internet to hosts that need it. –  EEAA May 27 '12 at 17:54
    
how can I ensure that? –  Mohammad Ali Akbari May 27 '12 at 17:55
    
Check that you have iptables rules that restrict access to your MySQL port. –  EEAA May 27 '12 at 17:59
    
I'm to linux expert, can you give me some terminal command? –  Mohammad Ali Akbari May 27 '12 at 18:05
1  
The general rule for firewalls is to set the default policy to drop and then add in rules that allow the minimum possible for your app to work. The commands to make that happen will not fit in a comment. Maybe time to search for iptables questions? –  Ladadadada May 27 '12 at 18:23
show 1 more comment

4 Answers

up vote 2 down vote accepted

I think its an attack, because when I run mysqltuner.pl I get

No.

There's nothing here to support your hypothesis. If you can't confirm that this level of traffic was abnormal then you haven't got adequate monitoring in place.

but I know I have about 500 visit per day

For capacity management this is a useless statistic. You need to know how many concurrent connections you have, how long they last, and what proportion of them are for static content. Thn you need to start asking yourself why so many connections are appearing at the database - you're may be allowing too many connections on the webserver.

The FIRST thing you need to do is get machinery in place to be able to answer these questions quickly, then you can start thinking about measures to ensure continuity of service. For DOS prevention there's a lot of things you do with iptables, using an application firewall or a feedback tool like fail2ban is helpful, but putting an event based reverse proxt server will have the biggest impact. Tuning your application, in particular the MySQL queries should give far greater capacity. A quick fix for capacity is, to check if your PHP code explicitly closes mysql connections - if not, then add an auto-prepend file which calls mysql_close() via register_shutdown_function()

share|improve this answer
add comment

Probably not an attack. Your application is opening too many connections to MySQL. This could result from a DDoS (or simply a lot of legitimate traffic). However, it's more likely that your application (Drupal) is not closing connections properly. This could be that it's not closing them at all (are you using "persistent" connections? -- if so don't) or just taking too long to complete and thus too long before closing the connection.

share|improve this answer
    
I think its not from drupal, when I reset mysqld after 3-4 seconds connections rise to 150 again. I have VPS which host only one website and I know I have under 500 visitor in day, my site is new... –  Mohammad Ali Akbari May 27 '12 at 18:01
    
After reviewing the content of the site, I now think it's more likely that it's a DDoS attack. However, you should check that you're not using persistent connections in the Drupal settings.php file. If you're not, you need to look at caching, because Drupal is so poorly optimized. A reverse proxy cache like Varnish is the best choice. You can find Drupal-specific hosting that will set this up for you for around $30/month. –  xofer May 27 '12 at 18:11
add comment

You can read logs and see where those connections are coming from in your webserver's access log. Also make sure your mysql has a high enough max connections (see my.cnf and check max_connections=).

If you still feel you are under attack, you can try a HIDS like OSSEC. It automatically detects IP's that are doing too many requests to be human. You might need to finetune this for your application.

share|improve this answer
    
Max connections is set to 151, which should be plenty high enough. –  xofer May 27 '12 at 17:58
    
Is there any way without installing anything? to find if this is an attack, or the source of attack. I have DirectAdmin –  Mohammad Ali Akbari May 27 '12 at 18:02
add comment

PDOException = your website's asking for a lot of information.

If your MySQL server isn't accessible from the net and is only contacted via localhost from your web server, then probably not. This is more of an indicator that your server is underpowered or MySQL is misconfigured and needs tuning to keep up with traffic being generated by your site.

To see if there's any attack on your website, you need to consult your server logs. Most people underestimate what kind of traffic their site generates when their customers, Google, Yahoo, Bing, Baidu and Yandex decide to scour their site all at once. Yes, it is a Denial of Service event but not an attack.

Your server's falling over because it can't handle the traffic. You need to read through your web server access logs to determine this, an analysis tool like Weblog Expert can help out in this process. Once you've determined the traffic sources, only then can you determine whether it's malicious or too much valid traffic on a server that can't keep up.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.