Server problems and not sure if it is an attack
My server has been going down a lot lately, its been down about 10 days in a total of 2 weeks. This has been a new thing. There are times it will run happliy for 2 weeks, or like last year from July to December without a hitch.
I have been looking through my apache logs and even installed Munin in hopes of catching some chart data that might point me toward the problem.
This is what my apache logs look like shortly after a reboot:
* i cannot post links until i have 5 posts and posting here gives error *
Notice the 30mins missing time at the end of the log.
It looks like its a script because the refer url is different, the ip is the same and the OS/browser crap is different yet its hitting the server so frequently.
Is this a dos attack? could this be a cause for my server going down? Or is he trying to make my website stats to show his sites as top referals?
Sometimes i can ping my server, but my browser times out. Or sometimes the server just times out on both http and ping. But i can never ssh when these problems occur just seems to time out and needs a manual reboot by the data center.
Also, (please note i am guessing here) but the load on my server rises so much sometimes and because my site uses postnuke and gallery, mysql tends to crash, which again, im guessing is because for each false hit, postnuke is trying desperately to get data from mysql to "build" the page. Sometimes mysql crashes the server hard needing manual reboot, sometimes my server just responds to ping. However i always seem to see this guys ip and his beloved shemale bull..
Also, the times that mysql crashes, its because i ran out of ram and the swap fills. I havent had this problem for awhile though, as i took the site down just a few days ago-- only to find that the server isnt responding to me now.
Thank you guys for anyone that can help me out. This is the first time ive been in a situation like this and its becoming a real problem lately and something i can no longer afford to brush off or forget about.
If i havent been clear enough id be happy to answer all questions and post log files if it will help.
