FLUSH HOSTS, aborted connections, and max_connect_errors

This happened to me 2 weeks ago on a site I run pro bono, and I forgot to blog about it. A comment in the “MySQL Automated Failover with Scripts” BOF reminded me about it, so here goes.

Basically, the web application stopped being able to talk to the database. I run the staging/test server AND the database, and the production site is run by someone else. So I checked out the logs, and indeed, there are many of the following:

050814 18:16:42 Aborted connection 241474 to db: ‘database’ user: ‘userhere’ host: `localhost’ (Got an error reading communication packets)
050814 23:58:43 Aborted connection 241487 to db: ‘database’ user: ‘userhere’ host: `localhost’ (Got timeout reading communication packets)

(and of course going up through the time it crashed, and even today). I believe –log-warnings is ON by default, because it’s not in my my.cnf and show variables shows that it’s on. But if it’s not on, you won’t see those errors.

The answer was to send a FLUSH HOSTS command, which I did, and it worked. Of course I have to figure out what is causing the errors, likely really bad PHP code without sessions and people hitting ESC when loading a page. (that site has a lot of downloaded code)

But I figured I’d blog about it, because it was rare enough to make me notice. This can be the result of a DOS attack, too — but in my case, it wasn’t.

I’m not sure how MySQL figures out how many errors have occurred — the default is 10, and there were more than that in the logs. I’m guessing it’s “10 failed in a row” from the same user@host, but I’m not sure. It’d be great to figure that out, although if your server has log-warnings set to ON, you can check the error logs.

This happened to me 2 weeks ago on a site I run pro bono, and I forgot to blog about it. A comment in the “MySQL Automated Failover with Scripts” BOF reminded me about it, so here goes.

Basically, the web application stopped being able to talk to the database. I run the staging/test server AND the database, and the production site is run by someone else. So I checked out the logs, and indeed, there are many of the following:

050814 18:16:42 Aborted connection 241474 to db: ‘database’ user: ‘userhere’ host: `localhost’ (Got an error reading communication packets)
050814 23:58:43 Aborted connection 241487 to db: ‘database’ user: ‘userhere’ host: `localhost’ (Got timeout reading communication packets)

(and of course going up through the time it crashed, and even today). I believe –log-warnings is ON by default, because it’s not in my my.cnf and show variables shows that it’s on. But if it’s not on, you won’t see those errors.

The answer was to send a FLUSH HOSTS command, which I did, and it worked. Of course I have to figure out what is causing the errors, likely really bad PHP code without sessions and people hitting ESC when loading a page. (that site has a lot of downloaded code)

But I figured I’d blog about it, because it was rare enough to make me notice. This can be the result of a DOS attack, too — but in my case, it wasn’t.

I’m not sure how MySQL figures out how many errors have occurred — the default is 10, and there were more than that in the logs. I’m guessing it’s “10 failed in a row” from the same user@host, but I’m not sure. It’d be great to figure that out, although if your server has log-warnings set to ON, you can check the error logs.

Comments are closed.