# Yet Another Fun One

**URL:** https://meta.discourse.org/t/yet-another-fun-one/238664
**Category:** Support
**Created:** [September 11, 2022, 3:21am UTC](https://meta.discourse.org/t/yet-another-fun-one/238664 "2022-09-11T03:21:06Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![fuse](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/fuse/32/221005_2.png) [@fuse](https://meta.discourse.org/u/fuse)
#### Post date: [September 11, 2022, 3:21am UTC](https://meta.discourse.org/t/yet-another-fun-one/238664/1 "2022-09-11T03:21:06Z")

</div>

Opening a fun can of worms. Thanks in advance.

I received a notification 8:47pm local time that my Discourse site was not reachable.

My server was getting hammered (load average was running anywhere from 8 on the low side to 15 on the high side), discourse was running, and there was nothing I could easily discern as an issue.

I ran discourse doctor, not problem.

I ended up having to reboot the compute instance, which did not solve the problem.  
Ultimately I stopped the instance for over 30 minutes before restarting.  
Problem gone.

Keep in mind my discourse site is really, really small - about 20 active users.  
I can’t prove there was some sort of DDoS activity, the symptoms sure line up with that possibility.

Below is a log snippet.  
I am sure folks want to keep known bugs that are security risks obfuscated.

Do the logs below match any known indicators of compromise?

Any and all thoughts appreciated. Thank you!

 ![discourse 20220910](https://global.discourse-cdn.com/meta/original/4X/f/2/1/f21fa67a059ead5774904fd2de75016a95b49d48.jpeg)

---

<div class="post-metadata">

### Author: ![pfaffman](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/pfaffman/32/120154_2.png) [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [September 11, 2022, 3:40am UTC](https://meta.discourse.org/t/yet-another-fun-one/238664/2 "2022-09-11T03:40:43Z")

</div>

You can look at /var/discourse/shared/standalone/log/var-log/nginx/access.log (if I can remember and type). And look there to see if you have a lot of traffic.

It’s improbable that your issue is caused by a security error with discourse.

I once had an issue sort of like that which was caused by a ddos attack on ssh.

---

<div class="post-metadata">

### Author: ![fuse](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/fuse/32/221005_2.png) [@fuse](https://meta.discourse.org/u/fuse)
#### Post date: [September 11, 2022, 11:34am UTC](https://meta.discourse.org/t/yet-another-fun-one/238664/3 "2022-09-11T11:34:43Z")

</div>

Thank you very much!

---

<div class="post-metadata">

### Author: ![RGJ](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/rgj/32/523185_2.png) [@RGJ](https://meta.discourse.org/u/RGJ)
#### Post date: [September 11, 2022, 12:25pm UTC](https://meta.discourse.org/t/yet-another-fun-one/238664/4 "2022-09-11T12:25:58Z")

</div>

Tell us more about your setup. Is it a [standard install](https://meta.discourse.org/t/142537?silent=true)? Are you running Postgres and Redis on another host, maybe on AWS managed instances?

---

<div class="post-metadata">

### Author: ![fuse](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/fuse/32/221005_2.png) [@fuse](https://meta.discourse.org/u/fuse)
#### Post date: [September 11, 2022, 1:15pm UTC](https://meta.discourse.org/t/yet-another-fun-one/238664/5 "2022-09-11T13:15:57Z")

</div>

As plain vanilla install as you get underpinned by AWS Lightsail.