Forum running slow

[shineworld 89]

Could be the server is below DDoS...
Many forums are in same state, also our:

 

In my case, massive guest access to the pages, till 150000 for day, continuously increases the session table and session keys in the server database,

which slows down more and more every day, paralyzing the forum.

 

At the moment, the only solution I have is to periodically clean up the two tables, but this also disconnects all connected users...

 

I hope this is not the problem in this forum.

Edited October 8 by shineworld

[Lars Fosdal 1961]

@TBx has been notified.

[Tommi Prami 159]

Slowness seems to be ralated to time of day. Maybe.

Some time ago it was very slow, now just slow...

Adn very slow again, atleast  posting new message and editing existing is very slow,

Edited October 9 by Tommi Prami
More info

[Lars Fosdal 1961]

According to @TBx, the attack appears to be vectored towards DOSing the Apache server, more than it is about the forum software.

[Angus Robertson 696]

48,000 guests active over the past 24 hours is similar to a long term attack on one of my web sites. 

 

A Chinese hacker changed tactics over the months, from two IP addresses in Hong Kong, to VPNs around the world and currently a worldwide botnet that reached over one million IP addresses a week at the peak in July, now down to 30,000 a week, most from South America and the Far East, but over 100 different counties.  More detail at 

 

This was to an ICS web server, and I contained the problem by adding geographic blocking using IP addresses and ASN checking, so requests are terminated before being connected.  

 

Angus

 

[FPiette 394]

It is still very slow for me. I'm in Belgium if it matters.

[DelphiUdIT 271]

It's been slow for me since yesterday morning, with timeout as well.

[chmichael 16]

Somebody block those AI IPs

[DelphiUdIT 271]

21 minutes ago, chmichael said:

Somebody block those AI IPs

We'll have to get used to it... it's the "price" we pay for those who want increasingly efficient and high-performance AI.
... the problem is that we all pay this "price"...

[chmichael 16]

Do you care about 3rd Party AIs and let the forum be slow as turtle ?

Come on ... Block them! 

[Lars Fosdal 1961]

The attacks are distributed. It is not as simple as blocking a handful of IP adresses.

[salvadordf 40]

Check the user agents too. Sometimes those bots are so badly written that they identify as outdated browsers.

[DelphiUdIT 271]

Today seems that no lantency is present. Good news.

[Angus Robertson 696]

My experience of monitoring attacks is checking ASNs can be very productive, since attacks often come from multiple countries but the same or similar ASNs, ie the same cloud hosting businesses. 

 

ICS now has geo databases that get both country and ASN for IP addresses, which are reported in the server logs.  Not all my servers have public domains, but still get scanned by IP address for exploits in popular web management systems like WordPress.  The scanning IPs are often consecutive IPs from large hosting companies in multiple countries, like 1,000 Google IPs.  So my servers now reject traffic from a small list of mostly Chinese related ASNs, although not Google, yet. 

 

Angus

 

[FPiette 394]

3 hours ago, DelphiUdIT said:

Today seems that no lantency is present. Good news.

Same here: normal response time.

[corneliusdavid 277]

It had gotten to the point where I wasn't reading this forum much because there was a 3-5 second delay between each link click. Now, it's back to being fast, so it's usable once again! 

[Anders Melander 2137]

11 hours ago, Lars Fosdal said:

It is not as simple as blocking a handful of IP adresses. 

Has Cloudflare been considered or even tried? Maybe @TBx knows?

[Vincent Parrett 914]

Cloudflare would be good idea, however the forum owner would need to pay for the Pro plan as the free plan doesn't allow enough WAF rules needed to get forums working correctly. It's also not simple to configure for dynamic sites like forums, lots of trial and error unless someone has already documented it.

[Lars Fosdal 1961]

AFAIK, @TBx has been working on setting up for Cloudflare.

What is the approximate cost of a pro plan? 

[Vincent Parrett 914]

7 minutes ago, Lars Fosdal said:

AFAIK, @TBx has been working on setting up for Cloudflare.

What is the approximate cost of a pro plan? 

https://www.cloudflare.com/en-au/plans/

[Lars Fosdal 1961]

The question then is who will fund $240/year for the sites.

[Anders Melander 2137]

10 hours ago, Vincent Parrett said:

the free plan doesn't allow enough WAF rules needed to get forums working correctly.

I see. I assumed that the free plan would be usable but I guess not.

[DelphiUdIT 271]

2 hours ago, Lars Fosdal said:

The question then is who will fund $240/year for the sites. 

The community has given me so much and continues to give (and not just to me, I think), and to support it I can easily pay a fee if necessary.

[Lars Fosdal 1961]

1 hour ago, DelphiUdIT said:

I can easily pay a fee if necessary.

That is a decision for @Daniel and @TBx to make.

[Gord P 20]

7 hours ago, DelphiUdIT said:

The community has given me so much and continues to give (and not just to me, I think), and to support it I can easily pay a fee if necessary.

I am sure there would be more than a few people willing to chip in (spread the load around).  Maybe it is more hassle than it is worth to have a donate button or something though.