The CF Server

[Remeniz]

Excellent.

After a slow start this morning it has been good all round.

 

[JogaBonito1502]

Everything is running excellent. I'm pretty sure you fixed the problem. Before today, even when pages loaded fast, everything didn't load at the same time. Today, everything pops up simultaneously in a matter of milliseconds.

 

[VINMAN46]

sites loading alot faster now think you nailed the problem

 

[Comp_Pro]

The IIS doesn't work for me, the past few days the site has been running very slowly and didnt even work at all in some cases, I just though it was a DDOS or something ...

 

[David Lindon]

The IIS doesn't work for me, the past few days the site has been running very slowly and didnt even work at all in some cases, I just though it was a DDOS or something ...

Yes I've switched IIS off, how is it today?

 

[CrackerJacker1]

What exactly does this IIS? How did it effect the site being off?

 

[David Lindon]

What exactly does this IIS? How did it effect the site being off?

IIs is just another web server program which is written by MS. I enabled it to see if it was my apache config or the server itself so in effect I had to web servers running on the same machine. Since apache is now running fine I no longer needed to run IIS

 

[CrackerJacker1]

Oh sweet lol. Good to know. Are you running this at like your home or local office

 

[David Lindon]

Oh sweet lol. Good to know. Are you running this at like your home or local office

I rent the server from a data center - http://www.theplanet.com/

OK this is how I resolved the problem.

I pulled up a packet sniffer and took a sample of the traffic in and out of the server. I noticed the server was getting thousands of these requests:

E
zX]@oÄ%Ýê…+CGÒ$P¾Ådó±¥·ÅPÿÿè6
GET /movie/server1/kiy/1.rmvb HTTP/1.1
Accept: */*
Cache-Control: no-cache
Connection: Keep-Alive
Host: www.yy2.com
Pragma: no-cache
Range: bytes=458564504-458666903
Referer: http://www.Edited.com/Edited
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)

which is odd because that file has never existed and I don't recognise the referring site.

I did some research from the IPs and it appears they are all coming from china (remember the site mainly went down at certain times of the day)

So I enabled the server-status option with apache to see how apache was coping.

Current Time: Saturday, 24-Jul-2010 11:27:07 GMT Daylight Time
Restart Time: Saturday, 24-Jul-2010 11:24:20 GMT Daylight Time
Parent Server Generation: 0
Server uptime: 2 minutes 47 seconds
Total accesses: 1661 - Total Traffic: 4.0 MB
9.95 requests/sec - 24.2 kB/second - 2495 B/request
Edited requests currently being processed, 0 idle workers

RRRRRRRRKRRRRRRRRRKRRRRRRRRRRRCRKKWRRRRRRRRRRRRKRCKRRCRCRRRR etc..........



0-0 2648 1/104/104 K 0 0 0.4 0.16 0.16 221.227.11.215 yy2.com GET /movie/server1/kiy/1.rmvb HTTP/1.1
0-0 2648 0/37/37 R 69 0 0.0 0.07 0.07 ? ? ..reading..
0-0 2648 0/23/23 R 50 0 0.0 0.17 0.17 ? ? ..reading..
0-0 2648 0/78/78 R 113 0 0.0 0.05 0.05 ? ? ..reading..
0-0 2648 1/40/40 K 2 0 0.4 0.26 0.26 117.63.201.161 yy2.com GET /movie/server1/lquj/1.rmvb HTTP/1.1
0-0 2648 0/25/25 R 49 15 0.0 0.01 0.01 ? ?
etc..........

It soon became clear that the number of these requests were taking up apache processes and because each connection has a time out of a few seconds, it was inevitable that the connections would just keep building up.

To resolve it I setup apache to block requests based on certain metrics which has now done the trick.

 

[iPwn]

Nice, the site has been running smooth now for a few days so it must have done it.