I have Drupal 4.6.3 installed on a standard Apache server, hosted by Hostdime. Someone has been poking at the site - an admin page is being called every thirty seconds or so from different urls. Whoever it is has access to huge blocks of them, so ip blocking is not an option.
After several months I had apparently accumulated 500,000 or so entries in the access logs. This is now crashing mysql and bringing down the whole server. Hostdime has said I need to take the site off their server, or run it with something other than Drupal.
I really like Drupal and don't want to migrate if I can avoid it. I was wondering if anyone had any suggestions...
Modules installed include Bad Behavior, Tinymce, comment closer, gsitemap, menu, nodewords, ping, spam, statistics, subscriptions, syndication.
The error message forwarded by hostdime follows. I'm not a programmer and know nada about servers so it doesn't mean much to me but I'm including in case it sheds any light for them's that know.
Thanks very much for any help you can offer!
MySQL Overload
--------------
root@dime94 [~]# w
13:01:12 up 58 min, 1 user, load average: 12.11, 6.76, 5.62
29092 mysql 18 0 71988 70M 2516 R 9.1 3.4 0:10 1
mysqld
31475 mysql 16 0 71988 70M 2516 R 9.1 3.4 0:08 2
mysqld
31500 mysql 14 0 71988 70M 2516 R 9.1 3.4 0:02 1
mysqld
27310 mysql 14 0 71988 70M 2516 R 9.0 3.4 0:10 0
mysqld
31503 mysql 14 0 71988 70M 2516 R 8.9 3.4 0:08 1
mysqld
20814 mysql 13 0 71988 70M 2516 S 5.9 3.4 1:01 1
mysqld
23964 mysql 9 0 71988 70M 2516 S 5.2 3.4 1:06 0
mysqld
23792 mysql 9 0 71988 70M 2516 S 2.2 3.4 1:00 0
mysqld
29068 mysql 9 0 71988 70M 2516 S 2.1 3.4 0:03 3
mysqld
27167 nobody 9 0 29352 28M 20456 S 1.9 1.4 0:00 2 httpd
29042 mysql 11 0 71988 70M 2516 S 1.8 3.4 0:01 1
mysqld
19286 mysql 10 0 71988 70M 2516 S 1.7 3.4 1:12 2
mysqld
27408 nobody 9 0 29128 28M 20356 S 1.7 1.4 0:01 1 httpd
27435 mysql 10 0 71988 70M 2516 S 1.7 3.4 0:03 0
mysqld
17055 mysql 11 0 71988 70M 2516 S 1.6 3.4 2:11 1
mysqld
24187 mysql 11 0 71988 70M 2516 S 1.6 3.4 0:57 0
mysqld
31480 mysql 10 0 71988 70M 2516 S 1.6 3.4 0:00 3
mysqld
31497 mysql 9 0 71988 70M 2516 S 1.6 3.4 0:01 3
mysqld
31498 mysql 9 0 71988 70M 2516 S 1.6 3.4 0:01 1
mysqld
26100 nobody 9 0 29492 28M 20004 S 1.3 1.4 0:02 2 httpd
31486 nobody 11 0 27576 26M 20416 S 1.1 1.3 0:00 1 httpd
29246 mysql 20 0 71988 70M 2516 R 0.8 3.4 0:01 0
mysqld
| 5882 | (username)_drupal | localhost | (username)_drupal | Query
| 23 | Copying to tmp table | SELECT url, COUNT(url) AS hits,
MAX(timestamp) AS last FROM accesslog WHERE url NOT LIKE '%www.semit |
| 5890 | (username)_drupal | localhost | (username)_drupal | Query
| 23 | Copying to tmp table | SELECT url, COUNT(url) AS hits,
MAX(timestamp) AS last FROM accesslog WHERE url NOT LIKE '%www.semit |
| 5893 | (username)_drupal | localhost | (username)_drupal | Query
| 23 | Copying to tmp table | SELECT url, COUNT(url) AS hits,
MAX(timestamp) AS last FROM accesslog WHERE url NOT LIKE '%www.semit |
| 5903 | (username)_drupal | localhost | (username)_drupal | Query
| 16 | Copying to tmp table | SELECT url, COUNT(url) AS hits,
MAX(timestamp) AS last FROM accesslog WHERE url NOT LIKE '%www.semit |
| 5914 | (username)_drupal | localhost | (username)_drupal | Query
| 15 | Copying to tmp table | SELECT url, COUNT(url) AS hits,
MAX(timestamp) AS last FROM accesslog WHERE url NOT LIKE '%www.semit |
| 5928 | (username)_drupal | localhost | (username)_drupal | Query
| 2 | Copying to tmp table | SELECT url, COUNT(url) AS hits,
MAX(timestamp) AS last FROM accesslog WHERE url NOT LIKE '%www.semit |
Comments
if the problem is the number
if the problem is the number of entries in the access log
why don't you disable statistics?
or try to decrease the amount of time that statistics are
stored.
go to admin/settings/statistics
and configure "Discard access logs older than"
to a smaller value.
The run cron.php .
Fabio
Thanks
Thanks very much - that was part of the solution. I also had too many feeds running in the aggregator, and had to disable it; and I had to disable the Bad Behavior module. All those things were racking up huge numbers of database entries, which was crashing the server.
In addition, I started going to phpmyadmin and cleaning out the sessions table.
I actually just migrated over to Wordpress, with some regrets. I'll see if it does any better at handling the unwanted calls.
Thanks again for replying!
Andrew Schamess
Sounds like you didn't have cron tabs set
If you were running cron tasks and were keeping logs only a couple days, I can't imagine that you'd still get this amount of errors.
That said, maybe we should implement logging levels... something like error, warn, user, 404 and everything else. The configuration could be done in settings.php (or via the UI). I know that I'd like to get rid of some of the logging that goes on for my sites.
- Robert Douglass
-----
My sites: HornRoller.com, RobsHouse.net