Yet Another Fun One

Product Support

AI-generated summary

In the discussion titled “Yet Another Fun One,” user fuse reports a sudden server overload on their small Discourse site, with high load averages and unresponsive services despite discourse running normally. They attempted troubleshooting with discourse doctor and rebooting, but only resolved the issue after a prolonged instance stop and restart. Suspecting a DDoS attack, they share a log snippet and ask if it indicates compromise. pfaffman suggests checking nginx access logs for traffic patterns and notes that the issue is unlikely to stem from a discourse security flaw, citing a past SSH DDoS incident. RGJ asks for more details about the setup, to which fuse replies it’s a standard, vanilla installation on AWS Lightsail.

1

Opening a fun can of worms. Thanks in advance.

I received a notification 8:47pm local time that my Discourse site was not reachable.

My server was getting hammered (load average was running anywhere from 8 on the low side to 15 on the high side), discourse was running, and there was nothing I could easily discern as an issue.

I ran discourse doctor, not problem.

I ended up having to reboot the compute instance, which did not solve the problem.
Ultimately I stopped the instance for over 30 minutes before restarting.
Problem gone.

Keep in mind my discourse site is really, really small - about 20 active users.
I can’t prove there was some sort of DDoS activity, the symptoms sure line up with that possibility.

Below is a log snippet.
I am sure folks want to keep known bugs that are security risks obfuscated.

Do the logs below match any known indicators of compromise?

Any and all thoughts appreciated. Thank you!

discourse 20220910
discourse 202209101878×165 64.1 KB

2

You can look at /var/discourse/shared/standalone/log/var-log/nginx/access.log (if I can remember and type). And look there to see if you have a lot of traffic.

It’s improbable that your issue is caused by a security error with discourse.

I once had an issue sort of like that which was caused by a ddos attack on ssh.

3

Thank you very much!

4

Tell us more about your setup. Is it a standard install? Are you running Postgres and Redis on another host, maybe on AWS managed instances?

5

As plain vanilla install as you get underpinned by AWS Lightsail.