1

I am experiencing intermittent, very odd jumps in server load that generally end in server being unavailable. Server runs a pretty high traffic website on Wordpress, Apache, MySQL. There is a plugin(hypercache) installed that minimizes mysql usage by caching full pages. However, everytime spike in load happens, mysql eventually becomes unavailable. Load average jumps from 2 to 30-40 during that time and apache seems to be handling a lot of requests(I've seen in the log file message about MaxClients being reached).

My question is this: how do I know if this is legitimate traffic or if it's a DoS attack? If it's DoS how do I determine what type of attack it is and protect myself against it?

Server runs FreeBSD 7, Apache 2.2, MySQL 5.1

Improve this question
2
  • 3
    What about the logs from your border router or firewall?
    – jl.
    Oct 7, 2010 at 18:53
  • To expand on jl's comment, check all associated logs - networking equipment, applications & servers.
    – user48838
    Oct 7, 2010 at 20:30

2 Answers 2

Reset to default
1

We notice a similar phenomenon, and if you enable Apache's server-status module, you can see what's going on. For us, it is caused by scanners looking for installations of phpMyAdmin to exploit. Because of the way WordPress processes every request, the load quickly shoots up. WP Super Cache for WordPress makes a HUGE difference. I also created some global RedirectMatch rules which intercept most of these scanner requests before hitting any PHP/MySQL-driven sites.

Improve this answer
1

You can see what's traffic comes to your server by installing TrafShow from FreeBSD ports. Much like ps ax but you see traffic flows instead of process IDs.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .