Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We are running a forum software (Woltlab Burning Board) on our server and found out that if at least two users keep reloading the website very quick (keeping F5 button pressed), the server load goes up to > 15, leading to really slow server responses.

We also tried it with a fresh forum install without any plugins with the same results. The load seems to come from apache and not from the database (MySQL) or anything else.

The server has the following hardware which should be more than enough: Intel Xenon 4x3,3GHz 16GB RAM

Screenshot of the apache load while F5 pressed: http://imgur.com/hc3RpbF

How could we prevent such a high server load? Thanks in advance

share|improve this question
1  
And what do you want from us now? Make your Apache faster so that those "attackers" can make even more requests per second this way (because they get the answers faster)...? Optimizing Apache may be a good idea but hardly the solution to this problem. –  Hauke Laging May 10 '13 at 17:24
    
So what would be a solution then? –  schlimpf May 10 '13 at 17:30
2  
Limiting the amount of data / requests delivered to these users per second. But why limit: If someone does that then he should be blocked completely. –  Hauke Laging May 10 '13 at 17:42
2  
Why are these users constantly reloading the page? Are you running some kind of contest, or did you annoy them? –  Michael Hampton May 10 '13 at 22:30
add comment

2 Answers 2

Look into using either Varnish or nginx to server and cache static content. They can act as a reverse proxy back to Apache. This works wonders in all the setups I have used.

The bigger issue might be poor programming in that software.

share|improve this answer
    
I don't see how serving static content could bring a server to such a load. –  Hauke Laging May 10 '13 at 23:27
    
Some HTTPd engines like Apache get overloaded so by spitting off the static you take load off from Apache. –  Tiffany Walker May 13 '13 at 19:49
add comment

The technique your users are using is essentially the basic theory behind distributed denial-of-service (DDoS) attacks (i.e. flooding a server with so much traffic that it cannot cope).

My advice would be to educate your users to use the application a different way, or liaise with them to find out if there is a legitimate reason why they are using the application in that way and fix that reason.

If nothing else works, blocking the users (perhaps via fail2ban) is a last resort. Flooding the server with traffic by any means shouldn't be tolerated, and making things faster will only allow the problem users to flood the server with more traffic.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.