XF 1.5 forum down due to low memory

[vbuser]

Yesterday my forum went down briefly along with much of my server's services after being "hit hard." My host provider made some changes but I was wondering if there was any changes I could make to the forum settings.

MESSAGE FROM HOST PROVDER

It seems that there was an IP that was hitting the forums extremely hard at that time frame and drove up the load on the server. The log information is below as far as where the IP is from and what it was hitting.

http://www.abuseipdb.com/check/176.104.85.138

```
ISP:  SPD Kurilov Sergiy Oleksandrovich
Host Name:  176.104.85.138
Organization:  CHP Kurilov Sergey Oleksandrovich
Country:  Ukraine (UA)
Region/State:  18 Poltavs'ka Oblast'
City:  Kremenchug
```
All the hits were in the 10AM hour
grep 176.104.85.138 xxxxx | awk '{print $4}' | cut -d: -f1-2 | uniq -c 
  5038 [08/Feb/2016:10

Looking at hits per minute it was extremely aggressive. 
grep 176.104.85.138 xxxxx | awk '{print $4}' | cut -d: -f1-3 |sort |  uniq -c

```
  26 [08/Feb/2016:10:13
  748 [08/Feb/2016:10:14
  473 [08/Feb/2016:10:15
  696 [08/Feb/2016:10:16
  553 [08/Feb/2016:10:17
  62 [08/Feb/2016:10:18
  502 [08/Feb/2016:10:35
  398 [08/Feb/2016:10:36
  769 [08/Feb/2016:10:37
  603 [08/Feb/2016:10:38
  208 [08/Feb/2016:10:39
```
Looking at what it was hitting over the 10AM hour that it was connecting to the server.
grep 176.104.85.138 xxxxx | awk '{print $11}' |sort | uniq -c | sort -rn | head

```
  3909 "http://xxxxx/forum/"
  162 "http://xxxxx"
  128 "http://xxxxx/"
  119 "http://xxxxx/past_contests.htm"
  65 "http://xxxxx/sitemap.htm"
```
grep 176.104.85.138 xxxxx | awk '{print $7}' |cut -d"/" -f1-3 | sort | uniq -c | sort -rn | head

```
  1308 /forum/index.php?threads
  574 /forum/index.php?members
  478 /forum/index.php?misc
  417 /forum/index.php?forums
  390 /forum/data
  216 /forum/index.php?goto
  194 /forum/index.php?attachments
  132 /forum/index.php?tags
  52 /forum/index.php?media
  30 /forum/index.php?posts
```
With the resources that are available on the server, the default options that were in place are obviously too high so I lowered them to settings more in line with the way the sites on the server run. This should keep the server from having the load drive up like that if someone hits it that hard again.

SAMPLE ERROR MESSAGE IN ADMINCP

Error Info

Zend_Db_Adapter_Mysqli_Exception: No such file or directory - library/Zend/Db/Adapter/Mysqli.php:333 
Generated By: Unknown Account, Yesterday at 10:37 AM

Stack Trace

#0 /home/xxxxx/public_html/forum/library/Zend/Db/Adapter/Abstract.php(315): Zend_Db_Adapter_Mysqli->_connect()
#1 /home/xxxxx/public_html/forum/library/XenForo/Application.php(728): Zend_Db_Adapter_Abstract->getConnection()
#2 [internal function]: XenForo_Application->loadDb(Object(Zend_Config))
#3 /home/xxxxx/public_html/forum/library/XenForo/Application.php(971): call_user_func_array(Array, Array)
#4 /home/xxxxx/public_html/forum/library/XenForo/Application.php(1002): XenForo_Application->lazyLoad('db', NULL)
#5 /home/xxxxx/public_html/forum/library/XenForo/Application.php(1607): XenForo_Application::get('db')
#6 /home/xxxxx/public_html/forum/library/XenForo/Model.php(161): XenForo_Application::getDb()
#7 /home/xxxxx/public_html/forum/library/XenForo/Model/DataRegistry.php(138): XenForo_Model->_getDb()
#8 /home/xxxxx/public_html/forum/library/XenForo/Model/DataRegistry.php(97): XenForo_Model_DataRegistry->_getMultiFromDb(Array)
#9 /home/xxxxx/public_html/forum/library/XenForo/Dependencies/Abstract.php(147): XenForo_Model_DataRegistry->getMulti(Array)
#10 /home/xxxxx/public_html/forum/library/XenForo/FrontController.php(127): XenForo_Dependencies_Abstract->preLoadData()
#11 /home/xxxxx/public_html/forum/index.php(13): XenForo_FrontController->run()
#12 {main}

Request State

array(3) {
  ["url"] => string(79) "http://xxxxxxxxxx.com/forum/index.php?threads/xxxxx.8893/"
  ["_GET"] => array(1) {
  ["threads/xxxxx_8893/"] => string(0) ""
  }
  ["_POST"] => array(0) {
  }
}

SAMPLE ERROR MESSAGE IN ADMINCP

Error Info

Zend_Db_Statement_Mysqli_Exception: Mysqli statement execute error : Wait on a lock was aborted due to a pending exclusive lock - library/Zend/Db/Statement/Mysqli.php:214 
Generated By: Unknown Account, Yesterday at 10:38 AM

Stack Trace

#0 /home/xxxxx/public_html/forum/library/Zend/Db/Statement.php(297): Zend_Db_Statement_Mysqli->_execute(Array)
#1 /home/xxxxx/public_html/forum/library/Zend/Db/Adapter/Abstract.php(479): Zend_Db_Statement->execute(Array)
#2 /home/xxxxx/public_html/forum/library/Zend/Db/Adapter/Abstract.php(632): Zend_Db_Adapter_Abstract->query('UPDATE `xf_sess...', Array)
#3 /home/xxxxx/public_html/forum/library/XenForo/Session.php(846): Zend_Db_Adapter_Abstract->update('xf_session', Array, 'session_id = 'a...')
#4 /home/xxxxx/public_html/forum/library/XenForo/Session.php(582): XenForo_Session->saveSessionToSource('a11f3de863d13b3...', true)
#5 /home/xxxxx/public_html/forum/library/XenForo/Controller.php(414): XenForo_Session->save()
#6 /home/xxxxx/public_html/forum/library/XenForo/Controller.php(358): XenForo_Controller->updateSession(Object(XenForo_ControllerResponse_View), 'XenForo_Control...', 'Style')
#7 /home/xxxxx/public_html/forum/library/XenForo/FrontController.php(358): XenForo_Controller->postDispatch(Object(XenForo_ControllerResponse_View), 'XenForo_Control...', 'Style')
#8 /home/xxxxx/public_html/forum/library/XenForo/FrontController.php(134): XenForo_FrontController->dispatch(Object(XenForo_RouteMatch))
#9 /home/xxxxx/public_html/forum/index.php(13): XenForo_FrontController->run()
#10 {main}

Request State

array(3) {
  ["url"] => string(114) "http://xxxxxxxxxx.com/forum/index.php?misc/style&redirect=/forum/index.php?threads/xxxxx.8940/"
  ["_GET"] => array(2) {
  ["misc/style"] => string(0) ""
  ["redirect"] => string(51) "/forum/index.php?threads/xxxxx.8940/"
  }
  ["_POST"] => array(0) {
  }
}

 

[Paul B]

If the problem was due to some sort of DDoS or saturation attack, there's nothing you can do in the XF software to mitigate that.

 

[TPerry]

Yep, looks like someone was the victim of a DDOS... and that has to be taken care of at server & network level.