Plesk Port 80 crash

[DavidBrogli]

Good morning

I had a Plesk 12 Server with more than five sites. The Site was since 10 days very slowly and crashes every hours. My Problem is, i can't fix than.

I had 2x reinstall plesk. I changed the IP-Adress (DDoS Attack?).. But the Server is still crashed.

The errorlog from apache:
[Sun Apr 24 11:58:27.522459 2016] [mpm_event:error] [pid 1506:tid 139816467167104] AH00485: scoreboard is full, not at MaxRequestWorkers
[Sun Apr 24 11:58:28.524234 2016] [mpm_event:error] [pid 1506:tid 139816467167104] AH00485: scoreboard is full, not at MaxRequestWorkers
[Sun Apr 24 11:58:29.525572 2016] [mpm_event:error] [pid 1506:tid 139816467167104] AH00485: scoreboard is full, not at MaxRequestWorkers
[Sun Apr 24 11:58:30.526838 2016] [mpm_event:error] [pid 1506:tid 139816467167104] AH00485: scoreboard is full, not at MaxRequestWorkers
[Sun Apr 24 11:58:31.528157 2016] [mpm_event:error] [pid 1506:tid 139816467167104] AH00485: scoreboard is full, not at MaxRequestWorkers
[Sun Apr 24 11:58:32.529455 2016] [mpm_event:error] [pid 1506:tid 139816467167104] AH00485: scoreboard is full, not at MaxRequestWorkers
[Sun Apr 24 11:58:33.565707 2016] [mpm_event:error] [pid 1506:tid 139816467167104] AH00485: scoreboard is full, not at MaxRequestWorkers
[Sun Apr 24 11:58:34.567002 2016] [mpm_event:error] [pid 1506:tid 139816467167104] AH00485: scoreboard is full, not at MaxRequestWorkers

The Plesk has no features and are with the ISO from Plesk.com installed. We had a Productlicense.

I changed my Server. The new Server is now very slowly. My suspicion: It's the Traffic of my Domain. The Domain has the Nameserver from Cloudflare. Cloudflare protect still my websites. I had activate the option "i'm under attack", but my Website ist still crashed.

Please help me.

Sorry for my bad englisch, i'm german.

David

 

[IgorG]

Have you tried to use fail2ban or Web Application Firewall Plesk features for preventing attacks?

 

[DavidBrogli]

Yes i have of my second (current) Server the Web Application Firewall installed but I have no idea, would like this tool to work properly ..(Screen: http://puu.sh/ouVJl.png)

 

[IgorG]

Yes i have of my second (current) Server the Web Application Firewall installed but I have no idea, would like this tool to work properly ..(Screen: http://puu.sh/ouVJl.png)

Reading official documentation didn't help?
http://docs.plesk.com/en-US/12.5/ad...n/web-application-firewall-modsecurity.73383/

 

[DavidBrogli]

The problem of Web-Application Firewall is, Cloudflare send us the Question from the Client. We can filter the Cloudflare-IP Address but not the x-header IP-Address from the user. (Cloudflare send me the IPs in a X-Header)

Netstat:
http://puu.sh/ouXjm.png

I don't have many inquire at this time. But the Server are overloaded. In the evenings are 150 user at the same time and the Server are exact overloaded as now..

 

[DavidBrogli]

I blocked now all ports except Port 80, 443 on my Proxmox firewall. Because, the site going still down.