1

I am experiencing intermittent, very odd jumps in server load that generally end in server being unavailable. Server runs a pretty high traffic website on Wordpress, Apache, MySQL. There is a plugin(hypercache) installed that minimizes mysql usage by caching full pages. However, everytime spike in load happens, mysql eventually becomes unavailable. Load average jumps from 2 to 30-40 during that time and apache seems to be handling a lot of requests(I've seen in the log file message about MaxClients being reached).

My question is this: how do I know if this is legitimate traffic or if it's a DoS attack? If it's DoS how do I determine what type of attack it is and protect myself against it?

Server runs FreeBSD 7, Apache 2.2, MySQL 5.1

closed as too broad by Tom O'Connor Aug 25 '13 at 21:20

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 3
    What about the logs from your border router or firewall? – jl. Oct 7 '10 at 18:53
  • To expand on jl's comment, check all associated logs - networking equipment, applications & servers. – user48838 Oct 7 '10 at 20:30
1

We notice a similar phenomenon, and if you enable Apache's server-status module, you can see what's going on. For us, it is caused by scanners looking for installations of phpMyAdmin to exploit. Because of the way WordPress processes every request, the load quickly shoots up. WP Super Cache for WordPress makes a HUGE difference. I also created some global RedirectMatch rules which intercept most of these scanner requests before hitting any PHP/MySQL-driven sites.

1

You can see what's traffic comes to your server by installing TrafShow from FreeBSD ports. Much like ps ax but you see traffic flows instead of process IDs.

Not the answer you're looking for? Browse other questions tagged or ask your own question.