1

We are running a forum software (Woltlab Burning Board) on our server and found out that if at least two users keep reloading the website very quick (keeping F5 button pressed), the server load goes up to > 15, leading to really slow server responses.

We also tried it with a fresh forum install without any plugins with the same results. The load seems to come from apache and not from the database (MySQL) or anything else.

The server has the following hardware which should be more than enough: Intel Xenon 4x3,3GHz 16GB RAM

Screenshot of the apache load while F5 pressed: https://i.stack.imgur.com/RNvEB.jpg

How could we prevent such a high server load? Thanks in advance

8
  • 1
    And what do you want from us now? Make your Apache faster so that those "attackers" can make even more requests per second this way (because they get the answers faster)...? Optimizing Apache may be a good idea but hardly the solution to this problem. May 10, 2013 at 17:24
  • So what would be a solution then? May 10, 2013 at 17:30
  • 2
    Limiting the amount of data / requests delivered to these users per second. But why limit: If someone does that then he should be blocked completely. May 10, 2013 at 17:42
  • 2
    Why are these users constantly reloading the page? Are you running some kind of contest, or did you annoy them? May 10, 2013 at 22:30
  • @MichaelHampton Question is not "why do they refresh", the question is "why does it lead to 100% cpu load and how to back this up". Really. They just found out. You cannot ask an attacker like, pliz stap ddos my website..
    – Daniel W.
    May 26, 2015 at 9:55

3 Answers 3

1

Look into using either Varnish or nginx to server and cache static content. They can act as a reverse proxy back to Apache. This works wonders in all the setups I have used.

The bigger issue might be poor programming in that software.

5
  • I don't see how serving static content could bring a server to such a load. May 10, 2013 at 23:27
  • Some HTTPd engines like Apache get overloaded so by spitting off the static you take load off from Apache. May 13, 2013 at 19:49
  • I have the same effect as the OP with nginx. 8 cores with 3 ghz each go to 100% when keep pressing F5.
    – Daniel W.
    May 26, 2015 at 9:52
  • @DanFromGermany Silly people are silly. Servers are not magic unicorns, they have finite resources which are taken up when people do silly things with them, like repeatedly press F5. If you're concerned with load, invest in a CDN, a HTTP cache like Varnish, key-caching like Memcache(d), Object caching like APC and use horizontally-scaling infrastructure like Amazon EC2. Repeatedly pressing F5 is essentially a DDoS. May 26, 2015 at 10:01
  • @CraigWatson I have also the same effect using a load balancer, several webservers including memcached+opcache. The servers can handle thousands of requests per seconds easily, but their CPU goes to 100% when a single user keeps pressing F5.
    – Daniel W.
    May 26, 2015 at 10:05
1

The technique your users are using is essentially the basic theory behind distributed denial-of-service (DDoS) attacks (i.e. flooding a server with so much traffic that it cannot cope).

My advice would be to educate your users to use the application a different way, or liaise with them to find out if there is a legitimate reason why they are using the application in that way and fix that reason.

If nothing else works, blocking the users (perhaps via fail2ban) is a last resort. Flooding the server with traffic by any means shouldn't be tolerated, and making things faster will only allow the problem users to flood the server with more traffic.

3
  • Asking attackers "Please don't attack my site anymore"....? fail2ban is a log analyzing parser, using regex. It's too slow.
    – Daniel W.
    May 26, 2015 at 9:54
  • 1
    @DanFromGermany "Attackers" != "Users repeatedly pressing F5". If you genuinely have DDoS attacks, you should look for specific DDoS mitigation practices. If you just have silly users, you should educate them. May 26, 2015 at 9:55
  • Yea but you cannot educate attackers and the server does not make a difference, they're all just "clients".
    – Daniel W.
    May 26, 2015 at 10:02
-1

A really nice way to limit the amount of requests you accept per time slot is nginx limit_req as described very nicely here. You really should get yourself a firewall of some sorts and have it run the nginx instance. That way, you would also be able to apply iptables and iproute2 rules to limit other kinds of traffic (since nginx is only about http).

I use Ubuntu for most things - it comes with ufw which is a nice wrapping around iptables. Rate limiting and such is done as described here. I like the wrapping bit, since both iptables and iproute2 can be a bit painful to handle IMHO.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .