Question Inquiry About Traffic Logs in Plesk Log Browser

[Thomas Oryon]

Server operating system version

Redhat linux

Plesk version and microupdate number

18.0.76

Hello Plesk Support Team,

We would like to check whether it is possible to identify a DDoS attack or unusually high traffic through the Log Browser in Plesk.

At the moment, the traffic logs are not showing in the Log Browser, so we would like to confirm the following:

1. Can the Plesk Log Browser show if a DDoS attack has happened on the server?
2. If there is a large volume of traffic hitting the server, will this be visible in the traffic logs within Plesk?
3. If not, could you please let us know which logs or method should be used in Plesk to verify such activity?

Awaiting your reply

 

[Yaroslav_T]

Hi!

DDoS attacks can usually be diagnosed/found when examining the web server domain logs. In the Log Browser, there are no methods to check for these logs - the System/Plesk/Action_log tabs do not provide the exact evidence for such attacks.

There are, however, KB articles that can help:

• https://support.plesk.com/hc/en-us/articles/12377538522519 - the list of available DDoS protection tools
• https://support.plesk.com/hc/en-us/articles/12377282594199 - how to diagnose a DDoS attack (real-time or finished). Note: you'll need SSH access for that.

For the 2nd question, since the DDoS attacks usually target a website of Apache/nginx you'll need to identify this website and check the logs via Domains > example.com > Logs, there will be an IP address that can be banned in the Plesk Firewall extension to reduce the load. This can be done automatically by the Fail2Ban extension.
A trickier situation is when there is not a single "attacking" IP address but a bunch of IP addresses, so you'll need to ban a few of them manually if Fail2Ban did not catch them.
You'll also have to find the "problematic" website first, and this is not easy to do via UI. One way I can think of is to check Tools & Settings > Process List menu and check if there is a particular website that consumes a lot of resources and spawns a lot of PHP processes. Note that the Process list is a part of the Repar Kit extension, so make sure to install it first.