Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

We are running a forum software (Woltlab Burning Board) on our server and found out that if at least two users keep reloading the website very quick (keeping F5 button pressed), the server load goes up to > 15, leading to really slow server responses.

We also tried it with a fresh forum install without any plugins with the same results. The load seems to come from apache and not from the database (MySQL) or anything else.

The server has the following hardware which should be more than enough: Intel Xenon 4x3,3GHz 16GB RAM

Screenshot of the apache load while F5 pressed: http://imgur.com/hc3RpbF

How could we prevent such a high server load? Thanks in advance

share|improve this question
1  
And what do you want from us now? Make your Apache faster so that those "attackers" can make even more requests per second this way (because they get the answers faster)...? Optimizing Apache may be a good idea but hardly the solution to this problem. –  Hauke Laging May 10 '13 at 17:24
    
So what would be a solution then? –  schlimpf May 10 '13 at 17:30
2  
Limiting the amount of data / requests delivered to these users per second. But why limit: If someone does that then he should be blocked completely. –  Hauke Laging May 10 '13 at 17:42
2  
Why are these users constantly reloading the page? Are you running some kind of contest, or did you annoy them? –  Michael Hampton May 10 '13 at 22:30
    
@MichaelHampton Question is not "why do they refresh", the question is "why does it lead to 100% cpu load and how to back this up". Really. They just found out. You cannot ask an attacker like, pliz stap ddos my website.. –  DanFromGermany May 26 at 9:55

3 Answers 3

Look into using either Varnish or nginx to server and cache static content. They can act as a reverse proxy back to Apache. This works wonders in all the setups I have used.

The bigger issue might be poor programming in that software.

share|improve this answer
    
I don't see how serving static content could bring a server to such a load. –  Hauke Laging May 10 '13 at 23:27
    
Some HTTPd engines like Apache get overloaded so by spitting off the static you take load off from Apache. –  Tiffany Walker May 13 '13 at 19:49
    
I have the same effect as the OP with nginx. 8 cores with 3 ghz each go to 100% when keep pressing F5. –  DanFromGermany May 26 at 9:52
    
@DanFromGermany Silly people are silly. Servers are not magic unicorns, they have finite resources which are taken up when people do silly things with them, like repeatedly press F5. If you're concerned with load, invest in a CDN, a HTTP cache like Varnish, key-caching like Memcache(d), Object caching like APC and use horizontally-scaling infrastructure like Amazon EC2. Repeatedly pressing F5 is essentially a DDoS. –  Craig Watson May 26 at 10:01
    
@CraigWatson I have also the same effect using a load balancer, several webservers including memcached+opcache. The servers can handle thousands of requests per seconds easily, but their CPU goes to 100% when a single user keeps pressing F5. –  DanFromGermany May 26 at 10:05

The technique your users are using is essentially the basic theory behind distributed denial-of-service (DDoS) attacks (i.e. flooding a server with so much traffic that it cannot cope).

My advice would be to educate your users to use the application a different way, or liaise with them to find out if there is a legitimate reason why they are using the application in that way and fix that reason.

If nothing else works, blocking the users (perhaps via fail2ban) is a last resort. Flooding the server with traffic by any means shouldn't be tolerated, and making things faster will only allow the problem users to flood the server with more traffic.

share|improve this answer
    
Asking attackers "Please don't attack my site anymore"....? fail2ban is a log analyzing parser, using regex. It's too slow. –  DanFromGermany May 26 at 9:54
1  
@DanFromGermany "Attackers" != "Users repeatedly pressing F5". If you genuinely have DDoS attacks, you should look for specific DDoS mitigation practices. If you just have silly users, you should educate them. –  Craig Watson May 26 at 9:55
    
Yea but you cannot educate attackers and the server does not make a difference, they're all just "clients". –  DanFromGermany May 26 at 10:02

A really nice way to limit the amount of requests you accept per time slot is nginx limit_req as described very nicely here. You really should get yourself a firewall of some sorts and have it run the nginx instance. That way, you would also be able to apply iptables and iproute2 rules to limit other kinds of traffic (since nginx is only about http).

I use Ubuntu for most things - it comes with ufw which is a nice wrapping around iptables. Rate limiting and such is done as described here. I like the wrapping bit, since both iptables and iproute2 can be a bit painful to handle IMHO.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.