main server problem

ziayee · Joined: 13 May 2011 Posts: 9

Hello

I don't know what has happened but suddenly the load on the main server
is so high that the main server crashesh could you please help me , my main server is a xeon 5320 with 12 gig ram and I have nearly 10 file servers
when I rename the index.cgi at least the links can be generated , I tried to install on another server but when I install it gives me error 500 and appache log shows this error
/usr/bin/perl: symbol lookup error: Modules/WSD/Filter50864.so: undefined symbol: Perl_Tstack_sp_ptr

could you please help me , its very urgent

Thank you

stamos · Joined: 11 Nov 2010 Posts: 139

welcome to the high serverload club

try cleaning up database, you can empty the table "IP2Files", that might help

ziayee · Joined: 13 May 2011 Posts: 9

Thank you sir , unfortunately no result , when I place the index.cgi I see too much mysql queries , is it possible that somebody DDos the site by somehow sending mysql query by site because it happend from yesterday and before that the serverload was not more than 20 - 30%

ziayee · Joined: 13 May 2011 Posts: 9

when I place index.cgi , number of queries to database server increase to more that 5000 ! i dont know if its normal

stdio · Joined: 27 Mar 2012 Posts: 61 Location: Europe

Check the web server logs. We've had a similar attack. The attacker made web requests though.

ziayee · Joined: 13 May 2011 Posts: 9

Sir how could you over come the attack ? in my case too I think it makes web requests that eventually makes mysql busy because when I rename index.cgi , everything gets normal . my site has over 200,000 visits today and it's hard for me to distinguish the attack Sad

ziayee · Joined: 13 May 2011 Posts: 9

by the way , lots of SYN_RECV when running netstat , do you think might be SYN FLOOD?

stamos · Joined: 11 Nov 2010 Posts: 139

same problem here.
I havent understand if it is just a lot of traffic of attacks.
cisco firewall says it's attack, couldn't distinguish though from where and how.

chrda · Joined: 14 Sep 2009 Posts: 298

Install CSF firewall on the server.
It should do some good out of the box.

If you want to go a little more advanced, locate.
# SECTION:Connection Tracking

stamos · Joined: 11 Nov 2010 Posts: 139

install mod_evasive and mod_security on apache server, this might help you as well

sherayusuf3 · Joined: 18 Jan 2009 Posts: 94 Location: Jakarta Indonesia

seinkalar · Joined: 01 May 2011 Posts: 23 Location: Yangon

krazymax · Joined: 31 Jan 2012 Posts: 62

access denied

seinkalar · Joined: 01 May 2011 Posts: 23 Location: Yangon