CUNY Academic Commons

Just created a ticket with IT

IT is aware of the issue and is looking into it.

Boone, IT reports that they have been seeing numerous spikes in traffic that have caused the issue Scott reported. They tracked it down to demo.commonsinabox.org, which has a ton of comment spam. Looks like they may have disabled the site, as it is now offline. Can you please flush all comments and user accounts and delete all groups?

I'm a bit unclear on all of this.

- The site does not appear to be offline
- I do not see any spam comments
- I do see a lot of spam activity, but I'm not sure that deleting it, or user accounts or user groups, would have any effect at all in decreasing server load. The issue is traffic, not the amount of content

I read over the email thread that you sent from IT and they don't seem to be recommending any of the above courses of action.

We need to discuss whether there is a way to restrict registrations or whether we still can/should have a demo site. Maybe we should put the whole thing behind a password so that it is not public?

It's not clear to me that a demo site would be much use if registrations were not open and/or it was behind a password.

Ideally we would get some more concrete guidance from IT as to what they think we should do to mitigate the issue. It's hard for me to make recommendations in the absence of details about the kind of traffic coming in (an access log would be a good starting point). The only action I can really take at the moment that would have an effect on the traffic spikes is to fully disable the site at the Apache level - perhaps an overly broad solution.

So, in brief: I don't think that your recommendations will help with the immediate problem (though cleaning up spam is good for other reasons), and aside from taking the site down altogether I don't have any better recommendations. Please advise.

Thanks, Boone. I will ask IT for additional info so that we can make a decision. In the meantime, if you can quickly clean out the spam, that would be useful.

Re the site being down, that was my mistake. It turns out that it is/was showing a db connection error at times but at others would load, though it would run slowly when doing so. So, the db connection error was only temporary.

I wonder if one solution might be to move the demo site to a different server, maybe a virtualized one?

In the meantime, if you can quickly clean out the spam, that would be useful.

I started to do this, but (a) there is no fast way to do it without writing a script due to the nature of the spam, and (b) I kept getting "database connection" errors while looking at it.

Because the error is so prevalent, and affecting the Commons, I took the liberty of taking down the demo site and replacing it with a static maintenance page. This has had the immediate effect of reducing load on our server to a reasonable amount. I'm going to leave it like this for the time being.

I wonder if one solution might be to move the demo site to a different server, maybe a virtualized one?

This will at least allow any damage to be contained to the demo site, so yes, we should definitely do it. There is the further question of preventing spam on the demo site. Next week I will try to look into this in more detail.