PHP Load

[Mr_Parham]

Hi

There has been an attack on my server for the past week, the botnet network open pages that used mysql and php and it used to cause a lot of load on my mysql so the server would get really slow, I added a security measure so whenever I turn on the option it would redirect the users to login before they can load any content that would use mysql, now my problem is that PHP use to much load to just check if the user is logged in or not and then redirecting the user to another page (the login page is cached so the problem is not there), Here is some detail about my server

2 * Intel(R) Xeon(R) CPU E5-2630 v3
128GB Ram
SSD Disks
cPanel

I'm currently using two core license and when the attack hits the server I see hundreds of lsphp on my server which each one of them are using a small amount of CPU and in total it's using all of my resources, is there anyway that I can tweak stuff to make PHP faster and more responsive? and also would upgrading to four core help with my issue?

Note - I have PHP suEXEC Max Conn on 100 and I can see during the attack that WaitQ for that specific host reach about 3-4k
Note - I already did setup Per Client Throttling , here is my current setting

Static Requests/second 15
Dynamic Requests/second 15
Connection Soft Limit 10
Connection Hard Limit 25
Grace Period (sec) 10
Banned Period (sec) 600

Any help would be greatly appreciated.

Parham

 

[Pong]

I believe you will need to change your PHP code to reduce the load.

By the way, "Per Client Throttling" settings should stop botnet connections over the limit if they are coming from the same IP. Do you still need extra PHP security measurement (which might lead to high load)?

 

[Mr_Parham]

I believe you will need to change your PHP code to reduce the load.

By the way, "Per Client Throttling" settings should stop botnet connections over the limit if they are coming from the same IP. Do you still need extra PHP security measurement (which might lead to high load)?

The code is as optimize as it can possibly get, the problem is that I'm getting connections from about 200-250k different IP addresses and some just connect once or twice per second so if I decrease the limit it would actually stop my normal users from accessing the website as well

PS - I know which IP addresses are attacking because they always have the same pattern, for example they are going for my search which could be

test.com/search?cat=2&postid=XXXX

Where XXXX is a randomly generated number which refer to my post ID, when I block let's say this url they start attacking another part of the website

 

[NiteWave]

Dynamic Requests/second 15

you can set it much lower, like 1 during attack, to see if any good effects.

to measure its effects:
1)CPU load lower
2)normal user may feel the website slower, but acceptable, not too slow.
3)watch WaitQ, see if it keeps increasing or not

 

[Mr_Parham]

you can set it much lower, like 1 during attack, to see if any good effects.

to measure its effects:
1)CPU load lower
2)normal user may feel the website slower, but acceptable, not too slow.
3)watch WaitQ, see if it keeps increasing or not

WaitQ is lower now (from 5-15k it came down to about 2.5k) but the server is still unresponsive

 

[NiteWave]

unresponsive may due to
https://www.litespeedtech.com/support/wiki/doku.php/litespeed_wiki:config:nf-conntrack-table-full

check if your server has this problem.

 

[Mr_Parham]

unresponsive may due to
https://www.litespeedtech.com/support/wiki/doku.php/litespeed_wiki:config:nf-conntrack-table-full

check if your server has this problem.

That's not the issue, I already increased that and I'm no longer getting errors, the php is causing way too much load and that's the reason that the server is becoming unresponsive

 

[Pong]

You can try one of our caching solutions and avoid php processes as much as you can. What application do you use? WordPress?