We had a site go to its knees under heavy server load, and tracked the problem to bad behavior.

Our sysadmin's investigation showed that

the bad_behavior module is making a query that isn't optimized correctly. It is currently doing a search through 13000 records on each request (without any indexing), which is hammering the server.
mysql> explain SELECT `ip` FROM `bad_behavior_log` WHERE `ip` LIKE '65.214.44.29' AND `http_response` = 403;
+----+-------------+------------------+------+---------------+------+---------+------+-------+-------------+
| id | select_type | table            | type | possible_keys | key  | key_len | ref  | rows  | Extra       |
+----+-------------+------------------+------+---------------+------+---------+------+-------+-------------+
|  1 | SIMPLE      | bad_behavior_log | ALL  | NULL          | NULL |    NULL | NULL | 13485 | Using where |
+----+-------------+------------------+------+---------------+------+---------+------+-------+-------------+

"

If I'm reading this correctly, then bad_behavior_log is just for logging ip addresses, so it should only affect users when logging is turned on.

That being said, the "IP" column on that table is of type "TEXT" (as are the majority of the fields in that table) as opposed to a VARCHAR.. This makes it difficult to index short of using a FULLTEXT index, which is extremely inefficient.

We've disabled the logging on the module for our sites -- for 4.7 sites, too. Sorry, no patch at the moment.

Comments

laura s’s picture

Actually, disabling logging seem to be impossible, even though the option is there in admin/settings/badbehavior. The setting won't save.

This is for 4.6 and 4.7 versions.

dpangier’s picture

Assigned: Unassigned » dpangier
Status: Active » Postponed

Logging of failed attempts is mandatory in current versions as it is used by part of the BB algorithm - verbose logging is switchable to log successful attempts too to aid with discovering properties of new spammers.

The upstream author has discovered this problem too (after being /.ed), and when he fixes up version 2.1 of Bad Behavior, I will upgrade to that,

dave reid’s picture

Status: Postponed » Fixed

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.