Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I recently set up a cloud system on Amazon AWS for a big website. I usually use Elastic Beanstalk to deploy the application (written in Java Spring) and it's currently running on 4 micro instances.

I've set a rule to auto scale up when the CPU is over 70% for more than 2 minutes. I noticed that last night (when the traffic is usually very low), the system scaled up to 15 instances for a total of about 8 hours. I then noticed that the "traffic in" of the auto scaling group went from an average of 1,000,000 to an average of 30,000,000 (for about 10 minutes and every hour or so) with the "traffic out" remaining constant.

I know that we have competitors that may want our website to fall down. Are these the symptoms of a DDoS attack? Is there a way I can prevent this from happening? Is there a way to detect what caused the "traffic in" to increase?

share|improve this question
    
NetHogs can help. –  quanta May 28 '12 at 16:22
1  
Change that a little and it'd probably be closer to the truth, competitors that may want to scrape our website, though server logs often show it's Google, Yahoo, Bing, Yandex, Baidu, etc on a simultaneous spiderfest. –  Fiasco Labs May 29 '12 at 3:42
    
If it's http traffic (not https), refer to this thread forums.aws.amazon.com/message.jspa?messageID=147350 –  Itai Frenkel May 31 '12 at 19:45

1 Answer 1

The best way to determine what happened on your server is to check the logs. Look at what the Log4J properties file says the logs are being kept and read through them to see if there was a spike in requests from a particular IP/group of IP's.

You'll also do well to set up a NetworkIn alarm that lets you know when traffic to your instances is beyond whatever expect threshold for your application.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.