XF 2.2 Too many Guests

[emaw]

Hi all, happy 2025!

Our forum is small and never has over 20 registered users logged in, but recently it's been getting stuck due to 3000+ "Guests"/unregistered visitors arriving at the same time, which eventually triggers this error:

• MySQL query error [1114]: The table 'xf_session_activity' is full

and the forum content becomes unavailable and displays a standard message on the front end about a problem generating content. Then it seems to resolve itself and the content comes back up, but this is happening more and more often - a few times a day now. I suspect content scrapers for AI but i just really want the forum to be stable again.

I've set the forum not to display to unregistered users, but that makes no difference

I've checked access logs - user agents and IP addresses are not showing any obvious (to me anyway) culprits whose IP I could block

I've looked up the database error and found various obscure suggestions but i hope there may be a better way to sort this out than fiddling with the database?

Any suggestions would be very much appreciates, thanks in advance

 

[nocte]

Well, if you want to get rid of bot traffic, so that even not a session is created (i.e. the bots don't even get to your server), then Cloudflare may be a good solution:

Connect, protect, and build everywhere

Make employees, applications and networks faster and more secure everywhere, while reducing complexity and cost.

www.cloudflare.com

 

[emaw]

Thank you!

I was hoping there might be a way to manage the load within xf??

and also expecting that other forums might have had the same experience?

 

[webbouk]

Have you tried xf2addons.com Access Log add-on

When you use the Access log add-on, you can easily see which IP range to block.

Link:

Access log

Description: Shows a list of bots, guests and members accessing your forum. I suggest following the information in this thread to block bad bot access to your forum: https://www.xf2addons.com/threads/deny-and-allow-bots-by-user-agent.1135/...

www.xf2addons.com

 

[nocte]

I was hoping there might be a way to manage the load within xf??

You can either block traffic (e.g. with Cloudflare) or (better solution) tweak your server (especially MySQL) so it can handle more requests.

But IMHO there is nothing to do on the XF level.

 

[Jja]

Thank you!

I was hoping there might be a way to manage the load within xf??

and also expecting that other forums might have had the same experience?

If have no access to server mysql tuning you might try to change xf_session_activity table storage engine to InnoDB

 

[emaw]

Have you tried xf2addons.com Access Log add-on

When you use the Access log add-on, you can easily see which IP range to block.

Link:

Access log

Description: Shows a list of bots, guests and members accessing your forum. I suggest following the information in this thread to block bad bot access to your forum: https://www.xf2addons.com/threads/deny-and-allow-bots-by-user-agent.1135/...

www.xf2addons.com

Thank you I have used Mighty Andy plugins before +1 from me,

I was able to do some server optimisations which seem to have improved the situation - I havent seen the MySQL query error [1114] for a couple of days,
(i also changed the xf setting for user "Online status timeout",not sure whether that will have made any difference, though?)

another Q; does the IP banning in the xfacp prevent users from browsing the site? or just from registering??

Many thanks all for wise advices

 

[emaw]

This issue has come up again

5000+ guest show up and

I'm getting:
Clear

MySQL query error [1114]: The table 'xf_session_activity' is full

and the forum says "Ooops We ran into some problems. An error occurred while the page was being generated. Please try again later."

 

[emaw]

I'm surprised if noone else has been hit by these recent swarms of bots from multiple ips?

 

[Paul B]

Many sites have been affected.

Block the IP addresses at the server.

 

[emaw]

oh i see some suggestions here: https://xenforo.com/community/threads/xf_session_activity-is-full.172623/

is there a query for phpmyadmin/mysql that would clean out that table?

 

[emaw]

Many sites have been affected.

Block the IP addresses at the server.

Thank you @Paul B

Unfortunately they seem to have unlimited IPs

 

[Bozza]

We have several concurrent threads on this @emaw, and I'm also being badly affected with my site being hit by 40,000+ concurrent guests, causing 'xf_session_activity' to blow out and people lose access to the site.

I'm not sure blocking IP addresses is a workable solution in this instance because, as you say, there are thousands of them from all over the place.

After trying to block a few ranges in .htacess, I've tried Cloudflare and then, within Cloudflare, blocking the most likely rogue countries which, for me at least, seemed to be China, Vietnam, Hong Kong, Indonesia, Singapore and Brazil.

This largely seemed to to the trick - the number of guests went way down and the site was performing well.

Unfortunately, some people were getting Cloudflare error 520 which was then stopping them getting to my site and once people get the error it doesn't tend to self-resolve. And there's no obvious pattern as to who was getting it. I could get it on my phone but not my laptop sitting next to it and on the same Wifi. I could open a different browser on the same phone and it would also work.

I tried various config changes within Cloudflare, but none fixed it until I paused the whole service.

That said, I've just seen this thread: https://xenforo.com/community/threads/solution-to-stop-cloudflare-520-errors.215300/ - so I'm trying that config change to see if that gets it working for everyone again.

This has all been a bloody nightmare though!

 

[Alvin63]

I'd also suggest using cloudflare. If you set up your DNS with cloudflare, you can use the Xenforo cloudflare app, which makes things a lot easier.

There is a setting in that under Bots, called AI labyrinth. Which apparently sends any bots who ignore robots.txt into a maze of no follow links.

There's also bot fight mode and you can block all AI bots with a different setting (although this blocks verified AI bots as well but maybe you're not too worried about that?). The app in XF lets you just turn these things on and off with a button,

Once set up with Cloudflare, it might be that the traffic reduces anyway, even before you use the app. Within the app also is a setting to proxy link unfurling and an image setting (if you use that), which stops your server IP being revealed. If bots can see that then they can bypass cloudflare. So to me the app is worth it just for that one proxy setting.

Thread '[DigitalPoint] App for Cloudflare®'

May 20, 2022

digitalpoint submitted a new resource:

[DigitalPoint] Cloudflare - Configure and manage Cloudflare from within XenForo.

Features
Everything is available from within XenForo (you do not need to go to Cloudflare for things) via the Cloudflare API. This allows you give admins permission to do certain things (for example block IP addresses within Cloudflare without giving them access to your Cloudflare account).

It simplifies/automates much of the configuration and usage of Cloudflare with XenForo.

• Manage all Cloudflare settings/options for your zone...

• digitalpoint
• Replies: 2,721
• Forum: Add-on releases [2.x]

• 
• 

 

[emaw]

We have several concurrent threads on this @emaw, and I'm also being badly affected with my site being hit by 40,000+ concurrent guests, causing 'xf_session_activity' to blow out and people lose access to the site.

I'm not sure blocking IP addresses is a workable solution in this instance because, as you say, there are thousands of them from all over the place.

After trying to block a few ranges in .htacess, I've tried Cloudflare and then, within Cloudflare, blocking the most likely rogue countries which, for me at least, seemed to be China, Vietnam, Hong Kong, Indonesia, Singapore and Brazil.

This largely seemed to to the trick - the number of guests went way down and the site was performing well.

Unfortunately, some people were getting Cloudflare error 520 which was then stopping them getting to my site and once people get the error it doesn't tend to self-resolve. And there's no obvious pattern as to who was getting it. I could get it on my phone but not my laptop sitting next to it and on the same Wifi. I could open a different browser on the same phone and it would also work.

I tried various config changes within Cloudflare, but none fixed it until I paused the whole service.

That said, I've just seen this thread: https://xenforo.com/community/threads/solution-to-stop-cloudflare-520-errors.215300/ - so I'm trying that config change to see if that gets it working for everyone again.

This has all been a bloody nightmare though!

I'm hoping this might be fixable without resorting to cloudflare, for various reasons i'd prefer not to use it.

Someone suggested adjusting a regular cron job to empty out that table more often https://xenforo.com/community/threads/the-table-xf_session_activity-is-full.228324/post-1750329 , that sounds like it might do the trick, but seems not to be possible in the admincp

I'd really appreciate to get this sorted out - it's a critical issue for our forum

 

[emaw]

I'm hoping this might be fixable without resorting to cloudflare, for various reasons i'd prefer not to use it.

Someone suggested adjusting a regular cron job to empty out that table more often https://xenforo.com/community/threads/the-table-xf_session_activity-is-full.228324/post-1750329 , that sounds like it might do the trick, but seems not to be possible in the admincp

I'd really appreciate to get this sorted out - it's a critical issue for our forum

The mighty @AndyB has kindly advised me to follow these steps https://www.xf2addons.com/threads/using-htaccess-to-block-bad-bots.1135/

... which seems to have seen off the bots - "members online" looks normal again

I can't thank you enough for that Andy and for your super-helpful advice on a few other issues in the cp

 

[MySiteGuy]

I'm hoping this might be fixable without resorting to cloudflare, for various reasons i'd prefer not to use it.

Someone suggested adjusting a regular cron job to empty out that table more often https://xenforo.com/community/threads/the-table-xf_session_activity-is-full.228324/post-1750329 , that sounds like it might do the trick, but seems not to be possible in the admincp

I'd really appreciate to get this sorted out - it's a critical issue for our forum

You can also convert the sessions table into an Innodb table. XF works fine with it that way, and it doesn't have any performance issues.

 

[80sDude]

The mighty @AndyB has kindly advised me to follow these steps https://www.xf2addons.com/threads/using-htaccess-to-block-bad-bots.1135/

... which seems to have seen off the bots - "members online" looks normal again

I can't thank you enough for that Andy and for your super-helpful advice on a few other issues in the cp

Isn't @AndyB great?

 

[Erel]

You can also convert the sessions table into an Innodb table. XF works fine with it that way, and it doesn't have any performance issues.

Is it a matter of changing the table type with phpmyadmin?