1. Are you a current member with account or password issues?

    Please visit following page for more information

    Dismiss Notice

Data Base Errors every 12 hours.

Discussion in 'MEMBER RULES, GUIDELINES & ANNOUNCEMENTS' started by JonSidneyB, Nov 24, 2010.

  1. JonSidneyB
    • Administrator

    JonSidneyB Uber Prepared
    Staff Member

    Joined:
    Mar 28, 2006
    Messages:
    21,161
    Likes Received:
    12,084
    We are getting hit very very hard by a spider every 12 hours. It is asking for hundreds of sql connections in the same second. Blocking it at the server level does not help as the moment we block one another comes in and takes it's place.

    We where having this problem some months ago and finally got it resolved. Well it seems the problem is back. I have sent this company several messages and finally called them twice today.

    Until we can get this spider off our back we will likely have a problem every 12 hours again. We are now on day three of this problem.
     
  2. JonSidneyB
    • Administrator

    JonSidneyB Uber Prepared
    Staff Member

    Joined:
    Mar 28, 2006
    Messages:
    21,161
    Likes Received:
    12,084
    OK now,

    We are getting hit every hour now. Hopefully we will not crash again. I have been on the phone with the offending company and they said they are working on the issue. We literally had one ip address using 99% of the mysql connections.
     
  3. JonSidneyB
    • Administrator

    JonSidneyB Uber Prepared
    Staff Member

    Joined:
    Mar 28, 2006
    Messages:
    21,161
    Likes Received:
    12,084
    We might be bringing the forum down again. This time if it goes down it will be us causing it.

    If we bring it down it will be to do some repairs.
     
  4. DemskeetSkeet

    DemskeetSkeet Loaded Pockets

    Joined:
    Oct 3, 2008
    Messages:
    2,796
    Likes Received:
    124
    This is bad news Jon, hopefully this doesn't cost any extra money.

    Hope this gets resolved soon, thanks for keeping us updated.
     
  5. JonSidneyB
    • Administrator

    JonSidneyB Uber Prepared
    Staff Member

    Joined:
    Mar 28, 2006
    Messages:
    21,161
    Likes Received:
    12,084
    This is what my email looks like. Getting pounded by this one IP address.

    [​IMG]
     
  6. indigo_wolf

    indigo_wolf AKA Breezy

    Joined:
    Jul 9, 2009
    Messages:
    4,968
    Likes Received:
    8,210
  7. JonSidneyB
    • Administrator

    JonSidneyB Uber Prepared
    Staff Member

    Joined:
    Mar 28, 2006
    Messages:
    21,161
    Likes Received:
    12,084
    The bot that is hitting us is supposed to be one that checks for malware. They had a problem months ago of it doing to many queries at one time but they got it fixed. Well the problem is back again.

    No one else has a bot of this type that hits us this hard, they take it slow and gentle, this one launches hundreds at the same second.
     
  8. JonSidneyB
    • Administrator

    JonSidneyB Uber Prepared
    Staff Member

    Joined:
    Mar 28, 2006
    Messages:
    21,161
    Likes Received:
    12,084
    You have seen those messages saying something is a non-trusted site. If this spider will take a bit slower we will be ok and we will get a clean bil of health. Last time we had this problem that made some changes and where able to verify the site was safe.

    My concern is getting that non-trusted site stuck on the forum for anywone using Trend Micro.

    Last time I tried blocking a particular IP but as soon as I did that nother IP would show up and do the exact some thing.

    This is one of those cases that I think they do need to see that the site does not have malware but they need to slow down how fast the queries are.
     
  9. indigo_wolf

    indigo_wolf AKA Breezy

    Joined:
    Jul 9, 2009
    Messages:
    4,968
    Likes Received:
    8,210
    Is this a service you or your host pays for? i.e. Can you put in a support call in on it rather than burning your own wick to resolve it?

    ATB,
    Sam
     
  10. JonSidneyB
    • Administrator

    JonSidneyB Uber Prepared
    Staff Member

    Joined:
    Mar 28, 2006
    Messages:
    21,161
    Likes Received:
    12,084
    I don't pay for it.

    Several anti virus companies do this, the difference is their bots take it slower and don't take up all the connections. Of the anti virus companies only Trend Micro has brougt down the server.

    Outside of anti virus companies search engines visit regularly. Yahoo's used to be pretty agressive at mapping but never enough to bring things down, they fixed that after getting some complaints. Googles spider is very well behaved, it takes it's time and has almost no impact at all.

    I have been on the phone several times today with Trend Micro now. They have called me back a couple times as well. A person this morning said it was fixed them boom, this evening we almost went down and many of you saw data base errors, I got them on the phone again then an hour later we got really slammed. They then started calling me. After we came back up that spider was back again, that is the screen shot I showed.
     
  11. JonSidneyB
    • Administrator

    JonSidneyB Uber Prepared
    Staff Member

    Joined:
    Mar 28, 2006
    Messages:
    21,161
    Likes Received:
    12,084
    The screen shot was the hit we took at 8:17 pm my time. The last data base errors I was getting was another round of hits at 8:23 but the last two hits didn't bring the server down, just have some of you the data base error message when you where online.

    I am in hopes they got it fixed and this is over.

    I still have emails to respond to but they are mixed in with thousands of data base error messages. I am going to start mass deleting messages so I can get to your emails.
     
  12. wabash

    wabash Loaded Pockets

    Joined:
    Mar 30, 2006
    Messages:
    174
    Likes Received:
    142
    are the IPs close in number?

    if so, try blocking a range of IPs. instead of blocking 150.170.66.184, you could block 150.170.66.XXX or 150.170.XXX.XXX

    use cpanel's "IP Deny Manager" to do this.
     
  13. JonSidneyB
    • Administrator

    JonSidneyB Uber Prepared
    Staff Member

    Joined:
    Mar 28, 2006
    Messages:
    21,161
    Likes Received:
    12,084
    The last time when I tried this they started coming from another country. I am going to start working the their Nippon office. If they don't get to do their scan we will get that unsafe site message popping up like some of you have seen on some safe sites.
     
  14. JonSidneyB
    • Administrator

    JonSidneyB Uber Prepared
    Staff Member

    Joined:
    Mar 28, 2006
    Messages:
    21,161
    Likes Received:
    12,084
    Ok, I am blocking it. Will see if they start hitting from a different range.
     
  15. JonSidneyB
    • Administrator

    JonSidneyB Uber Prepared
    Staff Member

    Joined:
    Mar 28, 2006
    Messages:
    21,161
    Likes Received:
    12,084
    We have been getting dinged a bit but not hard enough yet to stop traffic again yet.
     
  16. JonSidneyB
    • Administrator

    JonSidneyB Uber Prepared
    Staff Member

    Joined:
    Mar 28, 2006
    Messages:
    21,161
    Likes Received:
    12,084
    Wow,

    I got an e-mail from them this late at night. I was waiting for the UK office to open in 45 more minutes. Looks like I am getting someone working on this with me again.


    Emails from you guys are going to take a bit to get caught up on again.

    « Newest ‹ Newer 1361 - 1380 of thousands Older › I did a search on that IP address in my mail box and your mails are mixed in with these, I don't know pages of this I am going ot have to delete to find everyones messages.
     
  17. vegassprky
    • GITD Manix 2XL Owner
    • In Omnia Paratus

    vegassprky Loaded Circuits

    Joined:
    Mar 2, 2010
    Messages:
    11,578
    Likes Received:
    63,698
    How about deleting them all,but before that post here on the forum that when you say everyone re-emails you? Just an idea.
     
  18. JonSidneyB
    • Administrator

    JonSidneyB Uber Prepared
    Staff Member

    Joined:
    Mar 28, 2006
    Messages:
    21,161
    Likes Received:
    12,084
    I am guessing I am past 10k of them and I am getting data base error messages again but they are a little bit different now but it is still Trend Micro hitting us.

    I think doing a mass delete might be best after they quite flowing in.
     
  19. JonSidneyB
    • Administrator

    JonSidneyB Uber Prepared
    Staff Member

    Joined:
    Mar 28, 2006
    Messages:
    21,161
    Likes Received:
    12,084
    This is interesting, my box is still filling up but I am able to get into the forum and post. It is 2:52 AM here right now.

    [​IMG]
     
  20. wabash

    wabash Loaded Pockets

    Joined:
    Mar 30, 2006
    Messages:
    174
    Likes Received:
    142
    can you change the email address that the system uses to notify you? use a separate email address for machines to send to, versus the one you have for human correspondence.

    can you make a directory just for machine-sent emails, and create a filter in your email system that routes all the emails from the server straight to that directory. this would make deletion easier.