Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm running some web applications on an debian server and have to struggle with ddos attacks sometimes. It's eating up all my resources and I can't ssh anymore into the server. An idea was to drop all connections if the load avg is too high, so there are still resources for me and accept new connections if the load avg is low enough. Since this has to work under heavy load I'm afraid a cronjob wouldn't be fast enough or take too much resources.

tl;dr: Is there a way to configure the behavior if the load avg is above a specific threshold?

share|improve this question
    
Which DDoS type are you facing? –  quanta Aug 30 '12 at 14:53
    
@quanta At the moment I'm fine, but my server went down a few times after a huge load of http requests. I know there are more ways to address this problem but I want to build a second solution if the first one fails. –  sfx Aug 30 '12 at 15:07
    
Could you please show us a snippet of web server log when being DDoS? –  quanta Aug 30 '12 at 15:12
add comment

1 Answer

up vote 3 down vote accepted

While I think you should try to address the real problem at the firewall or network level, a quick-and-dirty approach to resource-based actions is to use the Monit utility.

Specifically, Monit can perform resource tests, alert you and take action based on those conditions.

IF resource operator value [[<X>] <Y> CYCLES] THEN action [ELSE IF SUCCEEDED [[<X>] <Y> CYCLES] THEN action]

So...

check system example.com
    if loadavg (1min) > 10 then alert

Or for something specific to Apache:

check process apache with pidfile /var/run/httpd.pid
start program = “/sbin/service httpd start”
stop program = “/sbin/service httpd stop”
if children > 250 then restart
if loadavg(5min) greater than 10 for 8 cycles then stop
if 3 restarts within 5 cycles then timeout
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.