4

Short story, this is what happens :

  1. This guy gets on my site like 5-6 times a day, with a different IP each time.
  2. He starts browsing alot of pages,adding products to cart, adding to compare and so on, that he creates alot of processes on the server.

Here's a part of the log:

supergeneratoare.ro:80 GET /putere?dir=desc&limit=all&order=price HTTP/1.1
supergeneratoare.ro:80 GET /catalog/product_compare/remove/product/401/uenc/aHR0cDovL3
supergeneratoare.ro:80 GET /catalog/product_compare/remove/product/362/uenc/aHR0cDovL3
supergeneratoare.ro:80 GET /checkout/cart/add/uenc/aHR0cDovL3d3dy5zdXBlcmdlbmVyYXRvYXJ
supergeneratoare.ro:80 GET /catalog/product_compare/remove/product/406/uenc/aHR0cDovL3
supergeneratoare.ro:80 GET /checkout/cart/ajaxDelete/id/3833/uenc/aHR0cDovL3d3dy5zdXBl
supergeneratoare.ro:80 GET /catalog/product_compare/remove/product/375/uenc/aHR0cDovL3

86.121.192.249 supergeneratoare.ro:80 GET /checkout/cart/add/uenc/aHR0cDovL3d3dy5zdXBlcmdlbmVyYXRvYXJ
86.121.192.249 supergeneratoare.ro:80 GET /checkout/cart/add/uenc/aHR0cDovL3d3dy5zdXBlcmdlbmVyYXRvYXJ
86.121.192.249 supergeneratoare.ro:80 GET /review/product/list/id/330/category/7/ HTTP/1.1
86.121.192.249 supergeneratoare.ro:80 GET /checkout/cart/add/uenc/aHR0cDovL3d3dy5zdXBlcmdlbmVyYXRvYXJ 
86.121.192.249 supergeneratoare.ro:80 GET /catalogsearch/result/index/?mode=list&q=ect+7000 HTTP/1.1
86.121.192.249 supergeneratoare.ro:80 GET /sendfriend/product/send/id/319/cat_id/55/ HTTP/1.1
86.121.192.249 supergeneratoare.ro:80 GET /carcasa-insonorizata-24?dir=asc&limit=all&order=price HTTP
86.121.192.249 supergeneratoare.ro:80 GET /checkout/cart/add/uenc/aHR0cDovL3d3dy5zdXBlcmdlbmVyYXRvYXJ
86.121.192.249 supergeneratoare.ro:80 GET /catalogsearch/result/index/?limit=36&q=7+kva HTTP/1.1
86.121.192.249 supergeneratoare.ro:80 GET /catalogsearch/result/index/?dir=asc&limit=all&order=name&q
86.121.192.249 supergeneratoare.ro:80 GET /catalogsearch/result/index/?dir=asc&limit=36&order=name&q=
86.121.192.249 supergeneratoare.ro:80 GET /catalogsearch/result/index/?dir=desc&order=name&q=kde+100+
86.121.192.249 supergeneratoare.ro:80 GET /generatoare-curent-trifazate?limit=24&mode=grid&p=2 HTTP/1

92.114.94.101 supergeneratoare.ro:80 GET /endress?dir=asc&order=position&p=4 HTTP/1.1
92.114.94.101 supergeneratoare.ro:80 GET /checkout/cart/add/uenc/aHR0cDovL3d3dy5zdXBlcmdlbmVyYXRvYXJ
92.114.94.101 supergeneratoare.ro:80 GET /generatoare-electrice-cu-automatizare?dir=desc&limit=12&or
92.114.94.101 supergeneratoare.ro:80 GET /generatoare-sudura?dir=asc&order=price HTTP/1.1
92.114.94.101 supergeneratoare.ro:80 GET /pramac?limit=36&mode=grid HTTP/1.1
92.114.94.101 supergeneratoare.ro:80 GET /generatoare-sudura?dir=asc&limit=24&order=price HTTP/1.1
92.114.94.101 supergeneratoare.ro:80 GET /701-3000-kva?dir=asc&limit=36&order=position HTTP/1.1
92.114.94.101 supergeneratoare.ro:80 GET /tunuri-lumina?dir=desc&limit=24&order=price HTTP/1.1

What happens is the server load increases and then i get the MySQL has gone away error. Before you tell me to read similar situations i'm telling you I HAVE, i've been reading each and every single post with this error. I have put max_allowed_packet and wait_timeout correctly, every answer is for a situation when only one error occurs, but nobody has a lunatic on their website starting 20 processes at the same time and feeding them queries until the site goes dead.

I even upgraded my VPS to quad core and 6gb of ram, it should be enough to run a 230 products Magento Website.

Please help me with this, i am willing to hire somebody for the job as long as one can fix this ..

later edit : Please advise me where to start, or what logs to check to see the malicious activity. Probably it's a bot doing all the bad stuff.

I get the feeling that there are 2 guys monitoring the website, both of them using Iphone : - One guy has Platform iOS 8.1.2 with user agent "Mozilla/5.0 (iPhone; CPU iPhone OS 8_1_2 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12B440 Safari/600.1.4" - Second guy has Platform iOS 8.3 with user agent "Mozilla/5.0 (iPhone; CPU iPhone OS 8_3 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12F70 Safari/600.1.4"

Whenever one or the other shows up on the site, another ip comes along and site goes down. Each user has more than 30 pages viewed, i have this from opentracker installed.

At the IPs mentioned above in the log , when i find them in opentracker, i see alot of pages visited, products added to compare, and so on.

Running 1.9.0

  • I just had some of these hit our site as well. I ended up blocking them on our firewall. – ddavidn May 19 '15 at 17:26
  • 1
    please check the link magento.stackexchange.com/questions/tagged/security – Amit Bera May 19 '15 at 17:28
  • @ddavidn I block them but they change IP every time ! – Chris May 19 '15 at 17:52
  • @AmitBera the link doesn't work – Chris May 19 '15 at 17:53
  • 1
    There's no way to tell from these logs if this is malicious or a problem in your site. We'd need at least timestamps for these entry to check if it's humanly possible to click that fast and full request URI with whatever parameters are set. Your Magento version helps as well and why you think it's the same person. I don't see any evidence of that, looking at the perceived attack pattern. – Melvyn May 19 '15 at 18:15
4

Lets see, there are multiple places you need to improve to endure such a "attack".

MySql gone away probably means, your webserver is able to handle a lot more requests then your MySql, or if you have both on the same Server, the number of requests affects to much the MySql, like stealing all the CPU or IO time.

Reducing the number of accepted php connections can help a bit, even if this means, users get earlier rejected.

You need to improve your generel performance on the website. There are more complete lists what to do for this, but a few points:

disable visitor logging

Thats one of the most costly parts of a normal website request, as it writes into the databse even on a simple product view. You can disable this by disabling specific observers. I collected once some, so look what each observer I disable here ( https://github.com/Cotya/magento_performance_fixes/blob/master/src/app/code/community/Cotya/PerformanceFixes/etc/config.xml ) does and disable them in your project, if you think you dont need this feature.

An own observer I added there, is for the following

remove category/product ID specific Layout Handles

This Increases the cache sharing a lot, which helps if you get requests on a lot of different URLs. And most people dont write ID specific rules into their layout.xml files. If you did, products and categories allow specifi own layout xml via fields in the admin area.

Increase Product List caching

One of my favorite optimizations, you cache every element(/product) on the list as own entry. Thats a lot of additional cache entries, but means, if the same product gets shown on another category, or people change sort/filter, the single product is still cached and you need less additional querys per product. An example for this is here: https://gist.github.com/Flyingmana/510cee6c7c2668e279ae/revisions

deactivate some functionality

You may have to think if you really need the compare functionality, it can be very performance heavy, and if not much people make use of it at your site, maybe just deactivate it. You absolutely should deactivate the sendfriend functionality, as it allows to send emails to others.

Its not easy to block them, if you cant define a clear pattern how they do requests on your site. But when you can, there is the fail2ban tool, which can automatically block their IPs (even for limited time) if a defined behaviour is detected.

  • Thank you for a detailed response. It turns out actually that it is a hosting issue. The hosting company CEO is taking care of the matter himself, they didn't give alot of answers but basically they said one of the normal MySQL updates went wrong in a way they don't even know yet how to solve. – Chris May 20 '15 at 19:02
3

After almost 6 days with problems and site down, it turned out there were 2 things :

  1. During a normal MySQL update, something went wrong but this took the hosting company almost 5 days to figure it out. It was too complicated to explain to me (the CEO said), but nevertheless, hosting issue.
  2. I had some malicious visits that haven't been understood completly not even to this time, but anyway the hosting changed Apache to Litespeed which is about more secure than Apache, and it seems like bad traffic is gone.
2

You could be getting hit by a hack attempt or it could simply be a crawler by a bot. Bots will crawl for various reasons and having a bot + heavy traffic can be a problem with Magento servers.

How much does the traffic go up when your SQL server goes away? Having your SQL server go away is a symptom of a poorly or under performing environment. Having this happen before you get really busy and fixing it now will help your site perform better in the future.

  • Brent, i don't understand, what do you mean by "How much does the traffic go up when you SQL server goes away" . When that happens, site is down. – Chris May 19 '15 at 17:54
  • still no solution for this... – Chris May 19 '15 at 20:37
  • What is your normal traffic and what is your traffic when your SQL server fails? Have you tried to tune you server? – brentwpeterson May 20 '15 at 0:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.