<HTML>
<HEAD>
<META content="text/html; charset=iso-8859-1" http-equiv=Content-Type>
<META content="OPENWEBMAIL" name=GENERATOR>
</HEAD>
<BODY bgColor=#ffffff>
<font size="2"><b></b>> Hi all,
<br />>
<br />>
It never rains, then it pours!
<br />>
<br />>
Had a situation today where sites on one BX box suddenly reported their MySQL as
being down. A quick look into BX admin showed me that MySQL was indeed up -
however on going to PHPMyAdmin - I get a red 'Too Many Connections' error.
<br />>
<br />>
First time this has happened. I checked inbound traffic, nothing special - and
not really much load on the server.
<br />>
<br />>
My first initial theory is that perhaps someone / something ran a a DB script
externally, perhaps a DOS or something.
<br />>
<br />>
So I'm after any clues on how best to figure out exactly what is using MySQL
connections if it happens again.
<br />>
<br />>
The MySQL log doesn't tell me much, and the Netstat shows me the connections,
but not what is actually using them.
<br />>
<br />>
Any ideas?
<br />>
<br />>
Cheers,
<br />>
<br />>
Jeff
<br />
<br />Use "netstat -nap". The "n" is for numeric, "a" is for all, but the "p" shows the process owner. It will show you the process/program that is using each network connection. And the "a" means it will show you both listening and non-listening sockets. It is a wide output, so use a big screen or it wraps and is hard to read.
<br />
<br />If you see something suspicious - use "fuser -vn (proto) (port)" filling in the protocol tcp/udp and the port number. That command will show you WHO opened a particular port. This is extremely helpful if someone has root'ed your system and opened a back door. You can find out what user opened the back door, kill everything from that user, and delete that user.
<br />
<br />But if you just want to kill that particular suspicious process - use "fuser -kn (proto) (port)".
<br />
<br />
<br />
<br />Chuck
<br />
<br />
</font>
</BODY>
</HTML>