Anyone having trouble with Bowfishing Country moving slow tonight. I can't get files to upload to my albums to put in post or nothing. Barley getting around the forum??? Any Ideals?:headbang:
BFC Moving Slow???
NorthWind99
41 - 60 of 97 Posts
Joined
·
985 Posts
not for me as of 0855 cst. just as slow as it was last night.
Joined
·
1,330 Posts
Yes we are aware. 3 people working on this nonstop. It appears to be an outside influence but finding and stopping these things is ridiculously difficult. That's why these have the ability to bring down sites like mastercard, amazon, ebay... etc.
Working on it.
Working on it.
Joined
·
2,856 Posts
are we about to delcare war......??? :cf: cause we got our Azz whooped in the first battle and im just sayin maybe we should go with the Gorilla warfare method!
Joined
·
285 Posts
Got my pictures uploaded. Thanks Alex, it's alot better now!
Joined
·
7,971 Posts
Was it actually a DOS attack? I know mentioned it but never confirmed it. It Sounds like you need a drink either way lol
Joined
·
1,330 Posts
Sort of. I believe it was just a script kiddie. Essentially one of the support files for the forums was being access directly and in rapid fashion. This in turn was generating errors but more importantly eating up server threads. The thread would climb so high that they would max the CPU at 100% and stay there. Secondarily because the thread count was maxing out it was causing Apache to orphan these threads and not follow through to the close state. This would in turn leave less threads for everything else.
rebooting the server would result in about 20 seconds of peace and then it would jump to 100% and hold.
Running through the logs files was brutal. at 18 requests per second and troublesome requests only happening 3-4 times a minute that meant there were A LOT of lines to dig through for clues.
So, changes to the file location, changes to the thread management for apache, changes to the access restrictions and a few other tweaks later and we are running at a good clip with only 1.5% of CPU on average use.
Problem is that these scripts shift targets and the only thing you gain is the experience next time as to what to look for.
The next thing will be to move the entire directory to a new one which breaks the scripts for a while but causes hell with search engines.
Hopefully it just wont come back. We may do a complete reboot later but dont like doing that remotely.
Just to improve any lingering speed issues.
and yes i need a drink.
rebooting the server would result in about 20 seconds of peace and then it would jump to 100% and hold.
Running through the logs files was brutal. at 18 requests per second and troublesome requests only happening 3-4 times a minute that meant there were A LOT of lines to dig through for clues.
So, changes to the file location, changes to the thread management for apache, changes to the access restrictions and a few other tweaks later and we are running at a good clip with only 1.5% of CPU on average use.
Problem is that these scripts shift targets and the only thing you gain is the experience next time as to what to look for.
The next thing will be to move the entire directory to a new one which breaks the scripts for a while but causes hell with search engines.
Hopefully it just wont come back. We may do a complete reboot later but dont like doing that remotely.
Just to improve any lingering speed issues.
and yes i need a drink.
Joined
·
10,939 Posts
:cf:wow, you must be smart cause i have not a clue what you just said.
Joined
·
10,939 Posts
thats what im talking about.
Joined
·
1,330 Posts
It was multiple IPs - mostly overseas but a couple domestic. Not surprising though with zombie clients that probably started out as malware.
Someone here got maleware. The script sees VB as an exploit and finds it in the history. Kicks the url back to other machines that hit the files from multiple locations.
At first i thought it was a SQL injection type of attack but if that was it they got nowhere.
truth is we may never know. When this stuff happens the sole focus is uptime. not educating ourselves about the exploit.
I doubt it is truly over. Will be watching for the zombie hour tonight. after 11pm eastcoast time as scripts are designed to hit their exploits at the time of most vulnerability... when the admins sleep.
Fortunately I dont
Maybe we will get lucky and wont have to deal with it again.
Have backup plans if needed. They are just a pain to deal with while a bunch of guys are busy counting to 1 million on live forum
Someone here got maleware. The script sees VB as an exploit and finds it in the history. Kicks the url back to other machines that hit the files from multiple locations.
At first i thought it was a SQL injection type of attack but if that was it they got nowhere.
truth is we may never know. When this stuff happens the sole focus is uptime. not educating ourselves about the exploit.
I doubt it is truly over. Will be watching for the zombie hour tonight. after 11pm eastcoast time as scripts are designed to hit their exploits at the time of most vulnerability... when the admins sleep.
Fortunately I dont
Maybe we will get lucky and wont have to deal with it again.
Have backup plans if needed. They are just a pain to deal with while a bunch of guys are busy counting to 1 million on live forum
Joined
·
831 Posts
Mine is still a little slow...is this something that is wrong? Or will it correct itself?
41 - 60 of 97 Posts
-
?
-
?
-
?
-
?
-
?
-
?
-
?
-
?
-
?
-
?
-
?
-
?
-
?
-
?
-
?
-
?
-
?
-
?
-
?
-
?
