Eskimo North


[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Web Server




     The problems we had with the web server today were the result of several
factors.

     First factor is that I made changes to the kernel configuration last night
to improve performance at the cost of additional memory utilization.

     I've changed this configuration back to the prior configuration for now.

     Second factor is that I was running backups on the machine which greatly
increases the load because it flushes the disk cache continuously.

     Third factor is what I think was a denial of service attack.  Someone from
one IP trying to download several hundred mp3's from the web server
simultaneously and they didn't have the bandwidth on their end to take them
rapidly.

     The end result was hundreds of Apache processes sitting idle for the most
part but caching data to send because the remote side wasn't ready to accept
it.

     Because there were close to 400 simultaneous processes trying to send to
one IP address, I don't believe this was normal usage, but rather an
intentional denial of service attack.  I will be adding software to this server
to limit simultaneous connections from one IP address to a reasonable number in
the future.

-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
 Eskimo North Linux Friendly Internet Access, Shell Accounts, and Hosting.
   Knowledgable human assistance, not telephone trees or script readers.
 See our web site: http://www.eskimo.com/ (206) 812-0051 or (800) 246-6874.