0

Today, early in the morning. My dedicated server was slowing because there was numerous requests coming.

One error I remember is some message from MYSQL, it said something similar to, max_number_of_connections exceeded.

It felt weird because the site I'm working on isn't launched yet, this huge traffic was just unreasonable.

When I went to see the numbers of users online, it was also huge. A same IP address was attempting to go to my links (like 1000 links / second). Most of them returned 404. I didn't save them nor I did remember the weird links were shown.

I went to cPanel my PHP server, to see that the error_log is huge (Last day it was 4.0 KB):

enter image description here

It keeps on getting bigger, I was able to extract this, it seems like it's the repeated pattern.

[20-Aug-2014 20:49:58 Europe/Vilnius] PHP Warning:  feof() expects parameter 1 to be resource, boolean given in /home/george/public_html/includes/functions.php on line 4252
[20-Aug-2014 20:49:58 Europe/Vilnius] PHP Warning:  fread() expects parameter 1 to be resource, boolean given in /home/george/public_html/includes/functions.php on line 4254
[20-Aug-2014 20:49:58 Europe/Vilnius] PHP Warning:  feof() expects parameter 1 to be resource, boolean given in /home/george/public_html/includes/functions.php on line 4252
[20-Aug-2014 20:49:58 Europe/Vilnius] PHP Warning:  fread() expects parameter 1 to be resource, boolean given in /home/george/public_html/includes/functions.php on line 4254
[20-Aug-2014 20:49:58 Europe/Vilnius] PHP Warning:  feof() expects parameter 1 to be resource, boolean given in /home/george/public_html/includes/functions.php on line 4252
[20-Aug-2014 20:49:58 Europe/Vilnius] PHP Warning:  fread() expects parameter 1 to be resource, boolean given in /home/george/public_html/includes/functions.php on line 4254
[20-Aug-2014 20:49:58 Europe/Vilnius] PHP Warning:  feof() expects parameter 1 to be resource, boolean given in /home/george/public_html/includes/functions.php on line 4252
[20-Aug-2014 20:49:58 Europe/Vilnius] PHP Warning:  fread() expects parameter 1 to be resource, boolean given in /home/george/public_html/includes/functions.php on line 4254
[20-Aug-2014 20:49:58 Europe/Vilnius] PHP Warning:  feof() expects parameter 1 to be resource, boolean given in /home/george/public_html/includes/functions.php on line 4252
[20-Aug-2014 20:49:58 Europe/Vilnius] PHP Warning:  fread() expects parameter 1 to be resource, boolean given in /home/george/public_html/includes/functions.php on line 4254
[20-Aug-2014 20:49:58 Europe/Vilnius] PHP Warning:  feof() expects parameter 1 to be resource, boolean given in /home/george/public_html/includes/functions.php on line 4252
[20-Aug-2014 20:49:58 Europe/Vilnius] PHP Warning:  fread() expects parameter 1 to be resource, boolean given in /home/george/public_html/includes/functions.php on line 4254
[20-Aug-2014 20:49:58 Europe/Vilnius] PHP Warning:  feof() expects parameter 1 to be resource, boolean given in /home/george/public_html/includes/functions.php on line 4252
[20-Aug-2014 20:49:58 Europe/Vilnius] PHP Warning:  fread() expects parameter 1 to be resource, boolean given in /home/george/public_html/includes/functions.php on line 4254
[20-Aug-2014 20:49:58 Europe/Vilnius] PHP Warning:  feof() expects parameter 1 to be resource, boolean given in /home/george/public_html/includes/functions.php on line 4252
[20-Aug-2014 20:49:58 Europe/Vilnius] PHP Warning:  fread() expects parameter 1 to be resource, boolean given in /home/george/public_html/includes/functions.php on line 4254
[20-Aug-2014 20:49:58 Europe/Vilnius] PHP Warning:  feof() expects parameter 1 to be resource, boolean given in /home/george/public_html/includes/functions.php on line 4252
[20-Aug-2014 20:49:58 Europe/Vilnius] PHP Warning:  fread() expects parameter 1 to be resource, boolean given in /home/george/public_html/includes/functions.php on line 4254
[20-Aug-2014 20:49:58 Europe/Vilnius] PHP Warning:  feof() expects parameter 1 to be resource, boolean given in /home/george/public_html/includes/functions.php on line 4252
[20-Aug-2014 20:49:58 Europe/Vilnius] PHP Warning:  fread() expects parameter 1 to be resource, boolean given in /home/george/public_html/includes/functions.php on line 4254
[20-Aug-2014 20:49:58 Europe/Vilnius] PHP Warning:  feof() expects parameter 1 to be resource, boolean given in /home/george/public_html/includes/functions.php on line 4252
[20-Aug-2014 20:49:58 Europe/Vilnius] PHP Warning:  fread() expects parameter 1 to be resource, boolean given in /home/george/public_html/includes/functions.php on line 4254
[20-Aug-2014 20:49:58 Europe/Vilnius] PHP Warning:  feof() expects parameter 1 to be resource, boolean given in /home/george/public_html/includes/functions.php on line 4252
[20-Aug-2014 20:49:58 Europe/Vilnius] PHP Warning:  fread() expects parameter 1 to be resource, boolean given in /home/george/public_html/includes/functions.php on line 4254
[20-Aug-2014 20:49:58 Europe/Vilnius] PHP Warning:  feof() expects parameter 1 to be resource, boolean given in /home/george/public_html/includes/functions.php on line 4252
[20-Aug-2014 20:49:58 Europe/Vilnius] PHP Warning:  fread() expects parameter 1 to be resource, boolean given in /home/george/public_html/includes/functions.php on line 4254
[20-Aug-2014 20:49:58 Europe/Vilnius] PHP Warning:  feof() expects parameter 1 to be resource, boolean given in /home/george/public_html/includes/functions.php on line 4252

It seems like error has been printed millions of time, it made the error_log 1.7 GB so far.

What can I do? Is there a an easy way I could block an IP address using some software to disrupt my server?

  • 1
    Crashing or slowing? What do you mean 'users available'? "Inserting links" into your server? What does that mean? You can block a single IP address using your server's firewall, assuming your hosting provider allows you access to that functionality (you'd have to ask them, that'd be their policy, not a tech issue). – Kitsune Aug 23 '14 at 23:23
  • 7
    Can you post some examples from the error log of the kinds of requests you're getting? Also this could indicate an issue with your application, if users can easily exhaust some particular resource from a relatively small number of requests then your application is vulnerable to a DoS attack. You might need to look for bottlenecks in your application, use resources more efficiently or restrict who can access certain functionality (eg. via a CAPTCHA). – thexacre Aug 24 '14 at 1:25
  • I'm assuming your server is hosted with an ISP. Check with the ISP regarding how to block IPs. – Jeff-Inventor ChromeOS Aug 24 '14 at 3:37
  • 1
    Log rotation is your good friend. – Question Overflow Aug 24 '14 at 7:38
  • 1
    @georgechalhoub Regarding auto-banning IP addresses or ranges which are the source of an unreasonable amount of requests, check fail2ban. – Philipp Aug 24 '14 at 12:44
2

I think there are bigger issues at play, for one your logs seems to suggest there is an issue with your application caused by a file which can't be opened. The fact that there were dozens of logs all within the same second implies that this error is also occurring multiple times in the same request. This may or may not be contributing to your site being slow, sorting these out is probably a question for a different SE site.

As I mentioned in my comment above, the issue might also be more to do with your application than (probably) bots making requests to your site. If a certain resource can be exhausted by a relatively small volume of requests then your application is vulnerable to a DOS attack. You might need to look for bottlenecks in your application, use resources more efficiently or restrict who can access certain functionality (eg. via a CAPTCHA).

In terms of mitigation, here are some options:

  • Block the IP, preferably via an external firewall but failing that then you should be able to use a .htaccess rule. If this is a targeted attack and not an isolated bot malfunctioning then this will probably be a waste of time because the attacker will just change their IP.

  • Add a web application firewall (WAF). CloudFlare is a relatively popular product which includes a WAF and can be used for free.

  • Contact your web host. Seeing as you're running cPanel I'm assuming you're just a customer on shared hosting. Your host should be responsible for ensuring log rotation is working and may also be able to assist in blocking bad traffic.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.