Floodcheck fails when using "reply" - member crashed my site at my request!

[RS25.com]

I am running 3.08 and was talking to a member of mine who told me he could crash my server any time he wanted to. Fortunately, this is actually a reputable member, so nothing malicious was intended. I did not believe him, and asked for a demonstration.

Sure enough, 10 seconds later my server was 100% down, with the "Cannot connect to database" error.

I asked him how he did it and here are the steps:

1. Go into a long thread - this particular thread has over 6900 pages of posts (20 posts per page x 6900 pages = 138,000 posts)
2. Click "Reply" (not quick reply)
3. Enter any content for the post
4. Press ALT+S repeatedly, and as fast as you can. NOTE: You must use IE for this to work.

For some reason the flood check does not work, the server tries to post all the responses (successfully, I might add) and the server comes crashing down fairly often. This is more of a problem when lots of users are online.

Apparently my users are "kind" enough to do this in the middle of the night so my site is not impacted, nor are users. But still - this is an issue.

Floodcheck was set to 15 seconds. However, I have had it as high as 60 seconds and he says it makes absolutely no difference.

What's the fix?

[Floris]

Which version of vBulletin are you running?

[RS25.com]

As mentioned, 3.08.

I should add that it has over 6900 PAGES of posts (not 6900 posts as I originally said) at 20 posts per page. At this point I have removed the thread from public access, and my server has sped up considerably. I suspect the problem lies in the fact that MySql is taking a long time to open and update this thread, or something like that. This may be an issue for any thread with more than - who knows - 2000 or 3000 replies?

[RS25.com]

I have since deleted that post, and any other threads with 1000+ replies, and my server load has dropped DRAMATICALLY. I was seeing an average load of 15.xx with 100 users online, and am now seeing an average load of 0.36 with the same 100 users.

Guess those threads were killing the entire server.

Is this something that should be addressed for future releases? I dunno, that is up to you, but I think it is very interesting.

[Scott MacVicar]

Would have needed to see the thread in debug mode and what queries were causing the most problem.

The quick reply thing is just the fact your were sending 3-4 requests at the same time and they all executed the flood check at the same time so neither of them set it off.

[RS25.com]

Yeah, well... in the interests of my sanity I killed it.

I actually spoke with another forum owner who has a site much larger than mine and he, too, deletes long threads. It's something I never thought about in the ~4 years I've been using vBulletin, but maybe it's something you guys could document in a FAQ or Troublshooting section. I actually upgraded to a dedicated server a few months back to deal with this issue, and now realize that it was money wasted because it was completely uneeded. All I had to do was delete those threads.