DevOps with Asthavi

Posts

Showing posts with the label Networking

How would you identify whether traffic spike is genuine load or a DDos attack?

Identifying whether a traffic spike is genuine or a DDoS attack requires analyzing traffic patterns, payload data, and infrastructure behavior. Here are the most effective ways to tell the difference: 1. Analyze Traffic Sources and Locations Genuine: Traffic typically originates from expected geographic regions, follows standard localized diurnal patterns (peaks during the day, drops at night), and uses standard ISPs. DDoS: Often originates from unexpected global regions, utilizes compromised IoT devices or data-center IP ranges (proxy networks), and lacks natural daily usage curves. 2. Check User-Agent and Request Headers Genuine: Requests will present common, recognizable User-Agents (e.g., standard browsers like Chrome, Safari) and valid HTTP headers (e.g., proper Accept-Language). DDoS: Attackers often use outdated, spoofed, or blank User-Agents. Requests may also have missing or irregular header combinations commonly found in automated botnets. 3...

A Production DB CPU suddenly hits 95% . What are the first 3 things you check?

When a Production database hits 95% CPU, your first priority is identifying whether it's a sudden spike in traffic, a runaway query, or a resource bottleneck. Check these three things immediately: Active Processes & Long-Running Queries: Check the database's process list to identify which queries are eating up resources. Look for unoptimized queries, full table scans, or operations stuck in "locked" states that might be causing a pileup. [ 1 ] Recent Traffic & Workload Spikes: Check your monitoring tools for a sudden surge in connection count or request rate . Determine whether the spike is due to legitimate user traffic, a batch job, or a potential external DDoS attack. Hardware & Resource Contention: Verify if the server is swapping memory to disk (indicating a memory shortage) or if there is heavy disk I/O wait time. CPU spikes are often secondary symptoms of insufficient memory or poorly performing disks. If you'd like, let me know: What typ...

I can help you pinpoint the exact commands or dashboard metrics to diagnose the root cause quickly.

When a production database CPU hits 95%, you need to act fast. Here are the exact terminal commands and infrastructure metrics to check immediately, categorized by the top database engines and monitoring tools: 1. Active Processes & Runaway Queries Identify and stop the specific query that is consuming all the CPU cycles. PostgreSQL : Run SELECT pid, age(clock_timestamp(), query_start), usename, query FROM pg_stat_activity WHERE state != 'idle' ORDER BY age DESC; to find long-running queries. If a query is stuck, kill it safely using SELECT pg_cancel_backend(pid); . MySQL : Run SHOW FULL PROCESSLIST; . Sort by the Time column. Look for queries stuck in "Sending data" or "Sorting" states. Terminate the rogue process using KILL [process_id]; . MongoDB : Run db.currentOp({"active": true, "secs_running": {$gt: 5}}) to list operations running for more than 5 seconds. Terminate them using db.killOp(opId) . 2. Traffic Spikes & Conn...