XFileSharing Pro - main server problem

Message
Author
ziayee
Posts: 9
Joined: May 13, 2011 5:56 pm

main server problem

#1 Postby ziayee » Apr 21, 2012 9:12 pm

Hello

I don't know what has happened but suddenly the load on the main server
is so high that the main server crashesh could you please help me , my main server is a xeon 5320 with 12 gig ram and I have nearly 10 file servers
when I rename the index.cgi at least the links can be generated , I tried to install on another server but when I install it gives me error 500 and appache log shows this error
/usr/bin/perl: symbol lookup error: Modules/WSD/Filter50864.so: undefined symbol: Perl_Tstack_sp_ptr

could you please help me , its very urgent

Thank you

stamos
Posts: 139
Joined: Nov 11, 2010 5:37 pm

#2 Postby stamos » Apr 21, 2012 10:02 pm

welcome to the high serverload club

try cleaning up database, you can empty the table "IP2Files", that might help

ziayee
Posts: 9
Joined: May 13, 2011 5:56 pm

#3 Postby ziayee » Apr 21, 2012 10:18 pm

Thank you sir , unfortunately no result , when I place the index.cgi I see too much mysql queries , is it possible that somebody DDos the site by somehow sending mysql query by site because it happend from yesterday and before that the serverload was not more than 20 - 30%

ziayee
Posts: 9
Joined: May 13, 2011 5:56 pm

#4 Postby ziayee » Apr 22, 2012 12:18 am

when I place index.cgi , number of queries to database server increase to more that 5000 ! i dont know if its normal

stdio
Posts: 65
Joined: Mar 27, 2012 4:05 pm

#5 Postby stdio » Apr 22, 2012 3:34 am

Check the web server logs. We've had a similar attack. The attacker made web requests though.

ziayee
Posts: 9
Joined: May 13, 2011 5:56 pm

#6 Postby ziayee » Apr 22, 2012 5:14 am

Sir how could you over come the attack ? in my case too I think it makes web requests that eventually makes mysql busy because when I rename index.cgi , everything gets normal . my site has over 200,000 visits today and it's hard for me to distinguish the attack :(

ziayee
Posts: 9
Joined: May 13, 2011 5:56 pm

#7 Postby ziayee » Apr 22, 2012 7:01 am

by the way , lots of SYN_RECV when running netstat , do you think might be SYN FLOOD?
Last edited by ziayee on Apr 22, 2012 8:45 am, edited 1 time in total.

stamos
Posts: 139
Joined: Nov 11, 2010 5:37 pm

#8 Postby stamos » Apr 22, 2012 8:42 am

same problem here.
I havent understand if it is just a lot of traffic of attacks.
cisco firewall says it's attack, couldn't distinguish though from where and how.

chrda
Posts: 296
Joined: Sep 14, 2009 7:16 pm

#9 Postby chrda » Apr 22, 2012 1:59 pm

Install CSF firewall on the server.
It should do some good out of the box.

If you want to go a little more advanced, locate.
# SECTION:Connection Tracking

stamos
Posts: 139
Joined: Nov 11, 2010 5:37 pm

#10 Postby stamos » Apr 23, 2012 3:15 pm

install mod_evasive and mod_security on apache server, this might help you as well

sherayusuf3
Posts: 94
Joined: Jan 18, 2009 4:29 am

#11 Postby sherayusuf3 » May 06, 2012 6:24 pm

stamos wrote:install mod_evasive and mod_security on apache server, this might help you as well
what XFS version you using? older version have diffrent module for specify CPU architecture

seinkalar
Posts: 23
Joined: May 01, 2011 1:08 pm

Re: main server problem

#12 Postby seinkalar » May 08, 2012 8:06 pm

ziayee wrote:Hello

I don't know what has happened but suddenly the load on the main server
is so high that the main server crashesh could you please help me , my main server is a xeon 5320 with 12 gig ram and I have nearly 10 file servers
when I rename the index.cgi at least the links can be generated , I tried to install on another server but when I install it gives me error 500 and appache log shows this error
/usr/bin/perl: symbol lookup error: Modules/WSD/Filter50864.so: undefined symbol: Perl_Tstack_sp_ptr

could you please help me , its very urgent

Thank you
Go to Main servers' cgi-bin/Modules/WSD

Then replace Filter.pm with this file
http://www.nldla.com/files/1930_puefe/Filter.pm

krazymax
Posts: 62
Joined: Jan 31, 2012 8:45 am

#13 Postby krazymax » May 09, 2012 5:34 am

access denied

seinkalar
Posts: 23
Joined: May 01, 2011 1:08 pm

#14 Postby seinkalar » May 09, 2012 7:34 am

krazymax wrote:access denied
Please try again.