0

My server is running Debian 7.10 (Apache 2.2.22, MySQL 5.5.47, PHP5). It's a VPS.

I've tried to summarise the issue in the title. I'm running a very small, private WordPress blog which is only accessible if you're logged in. I know it's not getting any traffic at the moment. It's been running for a few months now, and it's been becoming increasingly unstable. As of yesterday, MySQL won't stay up for more than a few minutes, and if I run

    service mysql status

it tells me my queries per second average is between 300 and 500.

I have tried the following:

  1. apt-get --purge remove mysql*
  2. manually deleting all config and even log files
  3. reinstalling, changing root password

I don't understand what problem could persist beyond the above. Looking online, I can only find references to very high queries per second for high-traffic websites, but my website is definitely not getting any traffic. I dropped all the databases associated with my blog about 5 minutes ago, and checking mysqld status again, the average queries per second are still up around 150, and that's with only the following databases:

    +--------------------+
    | Database           |
    +--------------------+
    | information_schema |
    | mysql              |
    | performance_schema |
    +--------------------+

Thanks very much.

Edit to add:

This is the only result I get from running SHOW PROCESSLIST;

    mysql> SHOW PROCESSLIST;
    +-------+------+-----------+------+---------+------+-------+------------------+
    | Id    | User | Host      | db   | Command | Time | State | Info             |
    +-------+------+-----------+------+---------+------+-------+------------------+
    | 23078 | root | localhost | NULL | Query   |    0 | NULL  | SHOW PROCESSLIST |
    +-------+------+-----------+------+---------+------+-------+------------------+
    1 row in set (0.00 sec)
  • Try turning on the mysql general log, it logs all queries. That will give you a really good idea what it's doing. From there you can track it back to the source. dev.mysql.com/doc/refman/5.7/en/query-log.html – Tim Apr 24 '16 at 3:40
  • Thanks, TIm. I enabled that, and tailing that log file, I see hundreds of requests per second of the dbuser@localhost being denied (because I changed their password). Stopping apache stops the requests. – etteling Apr 24 '16 at 3:48
  • I wonder why Apache would be hitting MySQL. Is it Apache calling PHP, and PHP hitting the database? I think this is one you're going to have to do some more problem solving. – Tim Apr 24 '16 at 4:04
  • I decided to have a look at Apache's access log, and I'm getting hundreds of requests from an IP address in the Netherlands every second. My working theory is that somebody gained access to the plaintext wp_config.php file which includes the password for the Db user, and was using my MySQL install as part of a MySQL farm. I've changed the password now, and I guess I will set up IPTables to blacklist the IP address from which all the requests are coming. – etteling Apr 24 '16 at 4:11
  • For anyone else viewing this now -- it seems to be a WordPress vulnerability that was causing the problem. More details here: phpwpinfo.com/wordpress-xmlrpc-attacks-how-to-prevent – etteling Apr 24 '16 at 4:58

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.