HELP: Huge number of simultaneous connections to the db server

[CAG CheechDogg]

jl255, lately man a lot of people have been seeing a huge increase in hits from search bots for what ever reason, who really knows.

Who is your host, if it's hostgator like me, their recent sale of the company to some idiot would explain why, they just finished a huge migration of servers and it looks like those servers saw fresh blood and decided to hit them with all they have...

If you have access to your phpMyAdmin I would recommend you go in their look for your session table and empty it, that's only if you are comfortable with doing that.

What is your session timeout set at?

[WEBDosser]

One thing i would never do is have wordpress as a front end to vbulletin

[Max Taxable]

Originally Posted by jl255

My server admin checked and it doesn't seem like its a ddos. All the connections are started internally within the site

Was this a "tech support" person from your host? They are infamous for not knowing diddly squat.

[jl255]

perhaps, but they have been pretty knowledgable in the past 5yrs i've been with them.

--------------- Added [DATE]1381074746[/DATE] at [TIME]1381074746[/TIME] ---------------

what is a good session timeout setting??

mine is currently set at 7200

[Max Taxable]

Originally Posted by jl255

perhaps, but they have been pretty knowledgable in the past 5yrs i've been with them.

But, their first and only instinct is to blame, you. And that's their default answer. And I'm yet to find even one of them who understands vBulletin. His answer to you is a crock of crap, to put it bluntly..

what is a good session timeout setting??

mine is currently set at 7200

That's TWO HOURS! I use 15 minutes, 900 seconds.

BUT - see, if your host is right and the connections aren't visitors, but some unknown mystery glitch making vB itself duplicate connections, it wouldn't matter what your session time is.

Plus, this setting doesn't affect visitors, only users logged in. Your problem is with visitors.

I note in passing, you're now suddenly looking much better with:

Currently Active Users: 5194 (23 members and 5171 guests)

Looks like the "Ban Spiders by User Agent" mod is helping alot with the mystery, nonexistent "internal" connections.

[jl255]

it was still hovering at 20k 1hr ago. then i changed the session settings to 900 about 30mins ago and it came down.

[WEBDosser]

I suppose you haven't thought about disable the hook system?.

[jl255]

what do you mean? i tried disabling all plugins, and it didn't seem to improve things much.

[Max Taxable]

Originally Posted by jl255

it was still hovering at 20k 1hr ago. then i changed the session settings to 900 about 30mins ago and it came down.

The session timer sets the cookie time for those who are LOGGED IN. It also determines how long visitors will appear in who's online.

Have you analyzed the user agent strings of the mass visitors? Five minutes logged in as admin I can tell you precisely what is going on.


EDIT: Looking at your "who's online" as a guest myself, I can see many guests are trying to reply to threads, trying to start threads - these are SPAM BOTS. If I could see their user agent strings i could tell you alot more.

--------------- Added [DATE]1381079015[/DATE] at [TIME]1381079015[/TIME] ---------------

Originally Posted by jl255

what do you mean? i tried disabling all plugins, and it didn't seem to improve things much.

I've never seen a more horrendous web page test from Meehan. Look at this mess - 16 seconds first byte time? And your host thinks this is acceptable? Note: It is not. This server is undergoing a DDoS attack.

http://www.webpagetest.org/result/131006_X6_DJC/

http://www.webpagetest.org/result/13...DJC/1/details/


Your board is loading 217 requests per pageload when it should be more like 60. You have many 302 errors and even some 404 errors. It's loading over 1MB when it should be around 600kb. You have big problems independent and separate of the attack you're experiencing.

[jl255]

thanks alot max. you were right. there was a ddos attack. after the IP was blocked, everything pretty much went back to normal. really appreciate the assistance and the effort you took to help.