Massive SQL Activity in top from single web user - How to determine the problem?

Discussion in 'Server Operation' started by rwheindl, Nov 20, 2017.

  1. rwheindl

    rwheindl Member

    I got a complaint that my website was erroring with too many mysql connections. I ssh'd into the server and found another website was killing mysql with a ton of connections. For now I've changed max_connections=500 and max_user_connections=20, but the problem from this other site continues. How do I inspect what's causing this activity in top? I'm attaching a screenshot.

    I've checked the maillog, no activity, so the site doesn't seem to be hacked and sending spam.

    I've added the following to Sites > site.com > Options in ISPConfig:
    disable_functions = exec, passthru, shell_exec, system, proc_open, popen, curl_exec, curl_multi_exec, parse_ini_file, show_source, mail, eval

    No effect. How else can I determine the problem?
     

    Attached Files:

    Last edited: Nov 20, 2017
  2. florian030

    florian030 Well-Known Member HowtoForge Supporter

    scan the site for malware and/or use mytop to see the sql-queries.
     
  3. rwheindl

    rwheindl Member

    I believe the site was getting indexed by search engines. We never found any evidence of malware or spam. I added additional virtual CPUs to the VM and increased some of the memory settings in MySQL which seems to have stabilized things. I think it really was just under high load. After a few hours CPU activity returned to normal and since adding the increased performance settings, we've received no complaints.
     
  4. Dan Allen

    Dan Allen New Member

    It is good that the situation has stabilized. Are you interested in finding out what is going on with that high demand from that other site? I am curious to understand this as a kind of detective problem.
    I am stuck trying to figure out what could be happening, because I don't understand "another website was killing mysql with a ton of connections." .....oh, I think I get it now. Your site was making a lot of connections to mysql, in response to a high rate of hits coming into the web server. So it is your site that was just responding to that traffic through your website. And you now think it was google indexing your site because??? of it's ip address and user agent?

    yes, increasing the memory allocations and allowed connections from the defaults shipped with mysql usually is necessary... I think I see what was going on now.
     

Share This Page