Over xmas our VB 4.2.3 forum saw a huge spike in online visitors. We average from 600 to 1000 online at any given time.
Starting xmas morning we had a sudden spike in "guest" visitors, to the tune of over 9,000. It created a new record of most users online, the previous one being closer to 2200 set a few years ago.
I immediately suspected DOS or something crazy but I contacted the host and they reviewed/audited the server and found nothing suspicious, just a lot of traffic, with popular pages being all over the place (not to any one URL for example).
I looked in Google Analytics but it did not represent these numbers. The traffic looked normal. I used their "real time" feature and it literally had about 30, even though the forum said I had over 9,000 online.
So what is the deal here? Google wrong? Webhost missed a DOS? VB reporting wrong activity or something with code/db getting hosed up?
At the same time we had this traffic spike, I started getting hundreds of emails over the next day or two that MySQL max_user_connections was reached. About a thousand of these emails came through. My max_user_connections happens to be set at 100 btw.
This attack, or bots, or users, or whatever, also used a lot of bandwidth. Just in these 2 days or so, it made December use twice as much bandwidth as any other given month. Normally the forum spits out about 5MB/minute or so, but during this spike it was hitting 70MB/minute or more. I've attached a screenshot from awstats.
Any ideas why this was? People are suggesting bots, but I can't imagine for no reason on xmas 9,000 bots all deciding to suck my bandwidth at the same time? And even so, we probably get bots all the time, why did VB think these were all guests and affect the online users count? I'm not sure what to make of this.
Starting xmas morning we had a sudden spike in "guest" visitors, to the tune of over 9,000. It created a new record of most users online, the previous one being closer to 2200 set a few years ago.
I immediately suspected DOS or something crazy but I contacted the host and they reviewed/audited the server and found nothing suspicious, just a lot of traffic, with popular pages being all over the place (not to any one URL for example).
I looked in Google Analytics but it did not represent these numbers. The traffic looked normal. I used their "real time" feature and it literally had about 30, even though the forum said I had over 9,000 online.
So what is the deal here? Google wrong? Webhost missed a DOS? VB reporting wrong activity or something with code/db getting hosed up?
At the same time we had this traffic spike, I started getting hundreds of emails over the next day or two that MySQL max_user_connections was reached. About a thousand of these emails came through. My max_user_connections happens to be set at 100 btw.
This attack, or bots, or users, or whatever, also used a lot of bandwidth. Just in these 2 days or so, it made December use twice as much bandwidth as any other given month. Normally the forum spits out about 5MB/minute or so, but during this spike it was hitting 70MB/minute or more. I've attached a screenshot from awstats.
Any ideas why this was? People are suggesting bots, but I can't imagine for no reason on xmas 9,000 bots all deciding to suck my bandwidth at the same time? And even so, we probably get bots all the time, why did VB think these were all guests and affect the online users count? I'm not sure what to make of this.
Comment