MySQL flood attack?

[Addicted2HD]

Hi,

I have a dedicated server that hosts 4 websites, one has a vBulletin installed. All websites were running very slow this morning, the host narrowed it down to the MySQL service consuming much of the CPU's resources. Once that service was stopped performance on all the other websites was back to normal.

I have denied access to everyone aside from me and another IP address to the site with vBulletin and turned the MySQL service back on and everything is working fine.

Before I open the site back up to everyone can someone point me in the direction of a way to see if there was some kind of flood attack against the site? I'm looking through the server's logs but don't know what I should be looking for that would jump out at me.

Any suggestions would be much appreciated.

Thanks,
Scott

[Vaupell]

Well the old flood attack was a small program designed by some blackhats.

Then at a given time, they all entered the same url in the program and
just let it run on their computers.

what the program did, was just goto the website and refresh, stop
goto the website, refresh, stopgoto the website, refresh, stop

well until either the user aborted or the server crasshed due to overload.

later came more hardcore versions that changed proxy servers
pr refresh, meaning a new ip and a new session so websites
with long sessions was a target..

Thats a flood attack, dosent leave a "real log" only a visitor trace and a ip
so if you have had a exceptionel ammount of visitors "check ur stastistics"
then i could have been a possible flood attack..

But the last few days "After 3.8" release alot of vb sites have been attacked with
sql injections. but that shoulndt increase the workload, ewen if they found a loophole.
injections should run as a normal command. check wiki about those.

Questions

Do you host your self ?
Is it possible your host (if not self) is backing up.
i know when my host is backing up, things slow WAY DOWN!! haha
scared me a few times.

Anything unusual in logs ?
Unusual ammount of new users ?
People posting some images on your forum. ?

[Marco van Herwaarden]

Just re-open the sites. If the CPU overloads again in a very short time, then it is likely it is an attack.

[ZomgStuff]

Do you happen to use bluehost?