0

So I am fairly new to pretty much anything server related. I recently pushed my project to production. It currently has very little website visitors. I am running it on a simple Digital Ocean Ubuntu 20.04 server. Now I've noticed that sometimes all of the sudden out of nowhere the site completely goes offline (the CPU usage goes from 0% to 100& in less than 10 minutes) as seen in the image below:

see image of cpu usage chart here

Now to be completely honest, I don't really know where to start looking. The first thing I checked were the server system logs.

I've noticed a tremendous amount of UFW BLOCK logs. This is an example of one of them:

kernel: [ 1355.970674] [UFW BLOCK] IN=eth0 OUT=
MAC=02:02:e9:7b:70:dd:fe:00:00:00:01:01:08:00 SRC=45.143.200.34
DST=128.199.58.144 LEN=40 TOS=0x00 PREC=0x00 TTL=247 ID=27065 PROTO=TCP
SPT=56880 DPT=7361 WINDOW=1024 RES=0x00 SYN URGP=0

Looking at the timestamps, I can see that these come in every few milliseconds or so...

I've learned from another post that these are logs about traffic being blocked. When looking at the SRC and searching that IP address, most of them come from Russia? Which is strange because my website is Dutch and has 100% Dutch visitors only.

Could these traffic blocks be the reason that the CPU usage goes to 100% in minutes sometimes? Should I be worried about these blocks? And lastly, what could be other reasons that the site goes offline in minutes out of nowhere with 0 users?

I've looked at the processes that are currently using memory and CPU.

Below is a screenshot of the htop output:

Here you can see an image of the htop output

matigo
  • 24,752
  • 7
  • 50
  • 79
I'm a Koala
  • 1

1 Answers1

2

Based on the comments stated and such, other than the UFW BLOCK issue which is explained elsewhere, it looks like your application stops responding because of some type of Denial of Service attack - some request is getting passed to Node that is causing it to eat all the CPU and freeze up. You'll need to start tracking your NodeJS logs and harden your application - it's going to be something related to your application or a NodeJS exploit that is being successfully used on your app.

Thomas Ward
  • 78,878