Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a VPS with Ubuntu. I host a small website (~10 visitors at the same time). Sometimes the website starts lagging. It lags so bad that my SSH connection starts lagging too. Running top says that 2 instances of apache2 take up 50% CPU each.

I assume this is a DoS attack. I've copy-paste installed a few iptables scripts that made sense, but this has not helped.

I installed libapache2-mod-evasive -- I'm sure it blocks the attacker, but I'm still lagging.

What can I do? Can I at least find the IP of the attacker?

I have strong experience with Linux, but almost zero experience with being a server admin.

share|improve this question
    
Are you serving static files or dynamic content. The lag could be due to inefficient database queries when creating dynamic content. – Stacey Richards Sep 15 '11 at 13:53
    
@Stacey, content is PHP+MySQL. I agree that it could be from that, but I know for a fact that it's not. Not only do I log slow queries, but my database server is on another VPS. More importantly CPU is used up by apache2, not mysqld – Mikhail Sep 15 '11 at 15:10
    
Do the queries return large amounts of data that take a long time for PHP to process? Do you log script execution time in addition to query times? – Stacey Richards Sep 15 '11 at 15:14
up vote 3 down vote accepted

Check the Apache access log for repeated attempts by a similar IP address, /var/log/httpd/access_log is the usual location.

You may also be interested in an automated solution such as DDoS Deflate or PSAD. I'd also strongly recommend mod_security for Apache itself.

share|improve this answer
    
I definitely use modsec. Are there user-friendly viewers / statistic analyzers for access_log ? – Mikhail Sep 15 '11 at 13:01
    
@Mikhail there are many, AWStats being one of the bigger ones: awstats.sourceforge.net – John T Sep 15 '11 at 22:46

Have you hardened Apache or your OS?

Are you able to post any logs?

This may help a bit.

http://httpd.apache.org/docs/2.0/misc/security_tips.html

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .