database connection errors

[rotezecke]

If have a problematic site with frequent errors in CMSMS error log:

user xxx has exceeded the max_user_connections ...

I spoke to host, and they by now successfully updated it. so there's no immediate drama. However, the errors were logged on random times, mostly over night. Initially, I did not pay much more attention as it did not affect any real users, probably just bots.

Now, it happens more regularly, also during daytime hours, and I wonder if my poor programming has anything to do with it. I have numerous custom plugins connecting to another database to query this and that. the connection looks like this (courtesy of calguy1000)

Code: Select all

  //CMSMS 2.2+
  $cs = new \CMSMS\Database\ConnectionSpec;
  $cs->type = 'mysqli';
  $cs->host = $db_host;
  $cs->dbname = $db_db;
  $cs->username = $db_user;
  $cs->password = $db_pw;
  $db =  \CMSMS\Database\Connection::initialize( $cs );
  

i don't think i close those connections usually. $db->Close() i guess it is. but could the fact that i don't close the connection contribute to the above problem? but why would overnight where there's next to no traffic (except for bots maybe) be more problematic?

[Rolf]

I have similar errors at a few sites, haven't found the cause yet either... :-/ Use all "regular" modules, no custom build ones.

[DIGI3]

Could matching up the access logs to the time of the errors help see if there's a pattern? Perhaps bots are hitting urls with random parameters etc so they're not getting cached pages, resulting in lots of db hits?

[rotezecke]

i have since seen the access logs. while i didn't see a pattern, there's one IP that just went nuts with requests. and many of these had not so random parameters, urlencoded queries like (decoded:)

Code: Select all

/**/AND/**/(SELECT/**/5983/**/FROM(SELECT/**/COUNT(*),CONCAT(0x7170706a71,(SELECT/**/(ELT(5983=5983,1))),0x7171717671,FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.PLUGINS/**/GROUP/**/BY/**/x)a)

Do you have any recommendations how to deal with attacks? i suspect just blocking the IP will probably only help for a day.
At least my plugins didnt cause this.