I get too connection error on my site from today...

PDOException: SQLSTATE[08004] [1040] Too many connections in lock_may_be_available() (line 167 of /home/sevensibir/domains/7sib.ir/public_html/includes/lock.inc).

I think its an attack, because when I run mysqltuner.pl I get:

[!!] Highest connection usage: 100%  (152/151)

but I know I have about 500 visit per day. how can I found if this is an attack. and how can I stop it?

  • You should ensure that your MySQL instance is only accessible over the network/Internet to hosts that need it.
    – EEAA
    May 27, 2012 at 17:54
  • how can I ensure that? May 27, 2012 at 17:55
  • Check that you have iptables rules that restrict access to your MySQL port.
    – EEAA
    May 27, 2012 at 17:59
  • I'm to linux expert, can you give me some terminal command? May 27, 2012 at 18:05
  • 1
    The general rule for firewalls is to set the default policy to drop and then add in rules that allow the minimum possible for your app to work. The commands to make that happen will not fit in a comment. Maybe time to search for iptables questions?
    – Ladadadada
    May 27, 2012 at 18:23

4 Answers 4


I think its an attack, because when I run mysqltuner.pl I get


There's nothing here to support your hypothesis. If you can't confirm that this level of traffic was abnormal then you haven't got adequate monitoring in place.

but I know I have about 500 visit per day

For capacity management this is a useless statistic. You need to know how many concurrent connections you have, how long they last, and what proportion of them are for static content. Thn you need to start asking yourself why so many connections are appearing at the database - you're may be allowing too many connections on the webserver.

The FIRST thing you need to do is get machinery in place to be able to answer these questions quickly, then you can start thinking about measures to ensure continuity of service. For DOS prevention there's a lot of things you do with iptables, using an application firewall or a feedback tool like fail2ban is helpful, but putting an event based reverse proxt server will have the biggest impact. Tuning your application, in particular the MySQL queries should give far greater capacity. A quick fix for capacity is, to check if your PHP code explicitly closes mysql connections - if not, then add an auto-prepend file which calls mysql_close() via register_shutdown_function()


Probably not an attack. Your application is opening too many connections to MySQL. This could result from a DDoS (or simply a lot of legitimate traffic). However, it's more likely that your application (Drupal) is not closing connections properly. This could be that it's not closing them at all (are you using "persistent" connections? -- if so don't) or just taking too long to complete and thus too long before closing the connection.

  • I think its not from drupal, when I reset mysqld after 3-4 seconds connections rise to 150 again. I have VPS which host only one website and I know I have under 500 visitor in day, my site is new... May 27, 2012 at 18:01
  • After reviewing the content of the site, I now think it's more likely that it's a DDoS attack. However, you should check that you're not using persistent connections in the Drupal settings.php file. If you're not, you need to look at caching, because Drupal is so poorly optimized. A reverse proxy cache like Varnish is the best choice. You can find Drupal-specific hosting that will set this up for you for around $30/month.
    – xofer
    May 27, 2012 at 18:11

You can read logs and see where those connections are coming from in your webserver's access log. Also make sure your mysql has a high enough max connections (see my.cnf and check max_connections=).

If you still feel you are under attack, you can try a HIDS like OSSEC. It automatically detects IP's that are doing too many requests to be human. You might need to finetune this for your application.

  • Max connections is set to 151, which should be plenty high enough.
    – xofer
    May 27, 2012 at 17:58
  • Is there any way without installing anything? to find if this is an attack, or the source of attack. I have DirectAdmin May 27, 2012 at 18:02

PDOException = your website's asking for a lot of information.

If your MySQL server isn't accessible from the net and is only contacted via localhost from your web server, then probably not. This is more of an indicator that your server is underpowered or MySQL is misconfigured and needs tuning to keep up with traffic being generated by your site.

To see if there's any attack on your website, you need to consult your server logs. Most people underestimate what kind of traffic their site generates when their customers, Google, Yahoo, Bing, Baidu and Yandex decide to scour their site all at once. Yes, it is a Denial of Service event but not an attack.

Your server's falling over because it can't handle the traffic. You need to read through your web server access logs to determine this, an analysis tool like Weblog Expert can help out in this process. Once you've determined the traffic sources, only then can you determine whether it's malicious or too much valid traffic on a server that can't keep up.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.