[Forum] What could this traffic spike be? How do I tshoot?

[Zackw]

Over xmas our VB 4.2.3 forum saw a huge spike in online visitors. We average from 600 to 1000 online at any given time.
Starting xmas morning we had a sudden spike in "guest" visitors, to the tune of over 9,000. It created a new record of most users online, the previous one being closer to 2200 set a few years ago.

I immediately suspected DOS or something crazy but I contacted the host and they reviewed/audited the server and found nothing suspicious, just a lot of traffic, with popular pages being all over the place (not to any one URL for example).

I looked in Google Analytics but it did not represent these numbers. The traffic looked normal. I used their "real time" feature and it literally had about 30, even though the forum said I had over 9,000 online.

So what is the deal here? Google wrong? Webhost missed a DOS? VB reporting wrong activity or something with code/db getting hosed up?

At the same time we had this traffic spike, I started getting hundreds of emails over the next day or two that MySQL max_user_connections was reached. About a thousand of these emails came through. My max_user_connections happens to be set at 100 btw.

This attack, or bots, or users, or whatever, also used a lot of bandwidth. Just in these 2 days or so, it made December use twice as much bandwidth as any other given month. Normally the forum spits out about 5MB/minute or so, but during this spike it was hitting 70MB/minute or more. I've attached a screenshot from awstats.

Any ideas why this was? People are suggesting bots, but I can't imagine for no reason on xmas 9,000 bots all deciding to suck my bandwidth at the same time? And even so, we probably get bots all the time, why did VB think these were all guests and affect the online users count? I'm not sure what to make of this.

[webmastersun]

So what is the deal here? Google wrong? Webhost missed a DOS? VB reporting wrong activity or something with code/db getting hosed up?

At the same time we had this traffic spike, I started getting hundreds of emails over the next day or two that MySQL max_user_connections was reached. About a thousand of these emails came through. My max_user_connections happens to be set at 100 btw.

This attack, or bots, or users, or whatever, also used a lot of bandwidth. Just in these 2 days or so, it made December use twice as much bandwidth as any other given month. Normally the forum spits out about 5MB/minute or so, but during this spike it was hitting 70MB/minute or more. I've attached a screenshot from awstats.

Any ideas why this was? People are suggesting bots, but I can't imagine for no reason on xmas 9,000 bots all deciding to suck my bandwidth at the same time? And even so, we probably get bots all the time, why did VB think these were all guests and affect the online users count? I'm not sure what to make of this.

Google is not wrong, it could happen on websites

A member on my forum asked the same question http://www.webmastersun.com/threads/...denly-in-a-day

And you can find the answers/solutions by viewing your Google analytics to see where traffic source came from (as the link above mentioned)

Hope that helps!

[Zackw]

That doesn't really tell me much. All it shows is that traffic came mostly from organic followed by direct.

What bugs me is that VB reported so many more guest users but Google Analytics does not reflect all these users. This means they were likely bots. But if so, was is a few bots "pretending" to be 9,000 people" Or were 9,000 bots all hitting our site at the same time?
In 9 years running the forum I've never seen a huge spike in activity where VB treats the activity as actual users browsing the forum.

Since Google Analytics ignores bots, it's no help. But maybe there is some other feature within VB itself that can tell me something about all this traffic?

I hate seeing 9,000 mysterious "guest" users flood the forum for a day and a half and then disappear without a trace. There must be something I can do to figure out what this was about!

[Wayne Luke]

What do your server access logs say?

All vBulletin reports is the number of sessions created over time. It isn't really meant to be an accurate measurement of traffic. More of a quick glance for users.