Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I setup a centos server by following howtoforge tutorials. It works fine but I noticed something and not sure how to solve it.

I open up Google Chrome open my site then press and hold F5 (refresh page) this makes browser send so many requests to server.

I check the log files and there are tens, hundreds of same url request from my ip. it doesn't even display requests like .js .css or image files. Just the address I refreshed and several lines one after the other like the one below.

This cause server to not respond after finish all.

I minimized sql queries to mysql and almost all data comes from APC cache. I enabled and checked the mysql query log and it runs only 2-3 queries per page display. rest comes from APC.

top command does not display high server load during this time but displays many apache processes.

How can I solve this issue? Is there a way to limit/block each ip not to request same url this many.

192.168.162.191 - - [06/Sep/2013:12:26:29 +0300] "GET /en/page1 HTTP/1.1" 200 10084 "http://domain.com/en/page1" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/29.0.1547.66 Safari/537.36"

EDIT 1

I pressed and holded F5 for 5 soconds and this happened. Server load normally is zero. No one is on server.

Page generation time is 200ms

Top output

top - 08:23:00 up 41 days, 11:32,  1 user,  load average: 0.12, 0.05, 0.01
Tasks: 490 total,   2 running, 488 sleeping,   0 stopped,   0 zombie
Cpu(s): 27.9%us,  5.6%sy,  0.0%ni, 66.5%id,  0.0%wa,  0.1%hi,  0.0%si,  0.0%st
Mem:   2979104k total,  2141960k used,   837144k free,   178948k buffers
Swap:  3112952k total,    14112k used,  3098840k free,   775020k cached

  PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND
18293 web1      20   0  146m  27m  16m R 83.9  1.0   0:02.96 php-cgi
25247 mysql     20   0  213m  57m 4996 S 22.9  2.0   3:34.66 mysqld
18465 web1      20   0  143m  22m  13m S  9.3  0.8   0:00.28 php-cgi
18467 web1      20   0  143m  22m  13m S  9.3  0.8   0:00.28 php-cgi
18431 web1      20   0  143m  22m  13m S  4.6  0.8   0:00.14 php-cgi
31704 apache    20   0 25204 3648  708 S  1.3  0.1   0:01.10 httpd
31701 root      20   0  151m  20m  11m S  1.0  0.7   0:02.34 httpd
18295 root      20   0  2836 1304  864 R  0.7  0.0   0:00.13 top
    9 root      20   0     0    0    0 S  0.3  0.0   0:12.50 ksoftirqd/1
 1378 root       0 -20     0    0    0 S  0.3  0.0   5:12.68 iscsi_q_30
18200 apache    20   0  151m  13m 4668 S  0.3  0.5   0:00.01 httpd
18330 apache    20   0  151m  13m 4676 S  0.3  0.5   0:00.01 httpd
    1 root      20   0  2900 1316 1164 S  0.0  0.0   0:05.91 init
    2 root      20   0     0    0    0 S  0.0  0.0   0:00.03 kthreadd
    3 root      RT   0     0    0    0 S  0.0  0.0   0:26.73 migration/0
    4 root      20   0     0    0    0 S  0.0  0.0   5:01.34 ksoftirqd/0
    5 root      RT   0     0    0    0 S  0.0  0.0   0:00.00 migration/0

Output of ps uax | grep httpd | wc -l is 238 . Idle is at around 20.

share|improve this question
add comment

2 Answers

Provide plz these info:

page generation time

output of:

top

and

ps uax | grep httpd | wc -l 

(maybe you need replace httpd with apache if u use debian) in moment of problem

share|improve this answer
    
Sorry for the delay, I edited my question –  Ergec Sep 9 '13 at 5:28
    
238 httpd childs is really much. We should find what job these childs do. lets try to monitor /server-status while load coming. –  dr-evil Sep 9 '13 at 9:34
add comment

apache + php/mysql is known to be ddosable by just pressing F5, if your setup is not tuned.

  • check mysql with some mysql-tuning-script like mysqltuner or mysql tuning primer and adjust acccordingly

  • check apache-error-logs

  • use mod_evasive to prevent your server from beeing dos'd by accident

  • use top/htop (for os), atop (for apache) and mytop (for mysql) to investigate the bottleneck

  • tune -> check -> tune -> check -> tune -> check -> be happy :)

share|improve this answer
    
yes trying to configure fail2ban and/or mod_evasive now to see how they perform. I'll keep question updated. –  Ergec Sep 11 '13 at 8:15
    
mod_evasive is by default very restrictive; soi just keepoing F5 pressed will likely result in error.403, but settings can be adjusted. –  that guy from over there Sep 11 '13 at 8:17
    
yes what I'm trying now with mod_evasive is to add ip to firewall for a period of time then expire, like I do with fail2ban. But couldn't succeed yet :/ . I guess I'll ask another question about this. –  Ergec Sep 11 '13 at 8:22
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.