Setup:
We are running pressflow behind a varnish proxy on two separate VMs all in a RH LAMP environment. We host internally so we have full control over the environment but just lack the expertise to fine tune this.
Issue:
Over the past two weeks we have seen traffic from questionable IPs that, based on the URLs that they hit, we causing extremely high CPU spikes; some as high as 12 but an average of 6-7. The only way we have been able to deal with this was to block the IPs and then the CPU goes down to <1.0. The URLs that were hit were items that are not cached, such as, calendar entries and the print & email features on various pages.
I read about mod_evasive as possible way to throttle the number of hits/connections from a single IP, but that isn't for apache 2.2.
Anyone have some pointers or a direction for us to go for this?
Thanks in advance!
Comments
Hardware
It sounds as though you didn't experience a random DDoS-style attack, but rather a repeated loading of paths that someone knew weren't cached. Is that accurate?
At least you found and dealt with the problem at hand -- I guess the question, then, is how you avoid the same usage spikes in the future. Or how to automate the response that you manually put in place this time.
Do you have a firewall or other hardware layer between your app server and the world? This is usually a better place to start.
I think you are correct...
I think you are correct...
Only because we haven't seen anything else since then plus the URLs that were being hit were dynamic links. Yes, that is the question. How can we avoid future usage spikes? A better VCL? Apache redirects, better PHP coding (Although we would need to figure out if/where there is a php problem first), etc.
Our Varnish/Proxy resides on a less secure DMZ on our FW, then the web head resides on a more secure DMZ off the firewall.
Do you know of any utilities to test to see if the issue might be our network infrastructure?
Thanks for the reply!