After running diagnostics on the server’s main drive, it was determined that a new drive was needed, which also meant doing an OS Reload on the box. This is always bad news, and no one enjoys dealing with this, but luckily, thanks to ThePlanet the whole process went very smoothly.

It took a total of 21 hours to transfer the accounts to another server in the cluster. We rerouted all traffic appropriately, and 24 hours we took the server down for the reload. Less than 2 hours later, the server was back online and reconfigured with the PurgeHosting network. 24 hours after that, we transferred all the accounts back to the ph03 server, which took another 21 hours.

In the end, we had successfully reloaded over 900 accounts in just under 4 days on a server with a failing drive, since replaced. A big thanks goes out to the staff at PurgeHosting, and of course, ThePlanet.

Peak Malicious Traffic Mitigated: 684 MBPS
Average Malicious Traffic: 400MBPS
Total Time for Attack: Over 300 Hours

I can’t even begin to imagine the total amount of traffic filtered, it’s easily in the Terabytes. The server was absolutely taking a pounding from this attack without the Cisco Guard online. Once we had the Guard mitigating the traffic, operation returned to almost normal, and for one reason. The traffic was not easy to filter, we have thousands of visitors daily who access the server, in other-words; lot’s of legitimate traffic we don’t want to filter.

Unfortunately, during the attack, many people experienced random outages and questionable connectivity to the server under the attack. This was not because the server was down, but because the Cisco Guard was filtering non-malicious traffic by mistake.

By the 10th day, we had figured out exactly what to block, and by what means to do it. Normally it wouldn’t take us nearly this long to properly mitigate an attack, but this was such a massive DDoS attack, that it took us this long to track down exactly where it was coming from. We ad to sift through thousands of spoofed IP’s.

Once we had this solved, there was no more questionable connectivity for random visitors, and a custom proxy template to better mitigate the malicious traffic. Less than 48 hours later, the attack had ended, presumable because the attacker gave up.

Big thanks goes out to PurgeHosting Staff and ThePlanet NOC Team.

• Game Server Hosting
• Ventrilo Hosting
• TeamSpeak Hosting
• Templates, Free Designs and Custom Web Designs

We’re always looking forward as we expand our services. As always you can expect these to come with great support and low competitive prices. So stay tuned to updates, and announcements.

1. Post a Tweet saying “I’m Powered by @ThePlanet. #showmemyserver”
2. Post a comment on this blog that includes “My website is _________, and I’m Powered by The Planet.”
3. Send an email to twitter @ theplanet.com with the name you want included in the picture (or we’ll default to your Twitter name), your The Planet account number* and the IP address** of the server you want pictured.

We had these tasks completed within 15 minutes and sure enough, a few days later we got that picture of our main server. And I thought we should share it with everyone else!

Click for High Res!

We’ll start off with server side monitoring services.

The Munin Service Monitor. (Visit Website)

Munin the monitoring tool surveys all your computers and remembers what it saw. It presents all the information in graphs through a web interface. Its emphasis is on plug and play capabilities. After completing a installation a high number of monitoring plugins will be playing with no more effort.

Using Munin you can easily monitor the performance of your computers, networks, SANs, applications, weather measurements and whatever comes to mind. It makes it easy to determine “what’s different today” when a performance problem crops up. It makes it easy to see how you’re doing capacity-wise on any resources.

Munin uses the excellent RRDTool (written by Tobi Oetiker) and the framework is written in Perl, while plugins may be written in any language. Munin has a master/node architecture in which the master connects to all the nodes at regular intervals and asks them for data. It then stores the data in RRD files, and (if needed) updates the graphs. One of the main goals has been ease of creating new plugins (graphs).

vnStat (Visit Website)

vnStat is a console-based network traffic monitor for Linux and BSD that keeps a log of network traffic for the selected interface(s). It uses the network interface statistics provided by the kernel as information source. This means that vnStat won’t actually be sniffing any traffic and also ensures light use of system resources. However, in Linux at least a 2.2 series kernel is required.

Now, here are our two favorite 3rd party monitoring services.

Pingdom (Visit Website)

With Pingdom it becomes easy to see how much downtime your site has (and when) and how responsive it is. Charts and tables show your uptime and performance over time, so it becomes easy to spot trends and potential problems.

Pingdom works because it checks the server’s availability from multiple places simultaneously. Whenever Pingdom detects an error, additional tests are automatically performed to help you with your troubleshooting and an alert is dispatched immediately. With Pingdom you can monitor websites, mail servers, DNS servers, FTP servers, networks, and much more.

Server Density (Visit Website)

Monitor CPU load, memory usage, processes, disk usage, network traffic and Apache status. Keep an eye on your servers and get e-mail/SMS alerts when things go wrong. Reported data is displayed on an interactive graph. Select date ranges or zoom in for a more granular view. Set up alerts for all checks to be notified by e-mail and/or SMS within minutes of things going wrong. View the state of your server at any point in time with a resource usage breakdown by process.

Thanks to these services, PurgeHosting is able to monitor every aspect of our servers. With all of these services combine, then we can keep track of every moment at any moment. And we’re the first to know, within seconds if any problem is to arise so that we can respond as quickly as possible. And in doing so, we’re able to preserve the quality of service you, as a PurgeHosting Client, receive every day.

MySQL 5 has been available for over a year and is now the standard, recommended version, according to the company that makes MySQL. Any modern script that uses databases should work properly with MySQL 5, but we should mention that we’ve heard reports of MySQL 5 database incompatibilities with a very small number of older scripts. That’s why you may want to check with the authors of any scripts on your site to verify that they are compatible with MySQL 5, as we’ve previously suggested. If you do have any errors, we ask that you open a ticket immediately. Free Hosting or shared hosting we’ll work with you to get your website back up and running.

If you’re a technically advanced customer and you want to know exactly what changes need to be considered for this upgrade, the MySQL 4.1 to 5.0 upgrade page has plenty of details. Where possible, we’ve taken care of the obvious things (for example, we’ve already converted any ISAM tables to MyISAM), but there’s a long list of rarer, subtler issues that are impossible for us to check without examining each SQL query that a script makes on every website we’re hosting.

In the very worst case of a customer using a script that simply will not work with MySQL 5, we are keeping a separate MySQL 4.1 server available that we can temporarily use for that customer’s databases to for up to 30 days, giving such customers a chance to resolve the issue.

We apologize for any inconvenience this upgrade may have caused. We tend to be very conservative about major upgrades, and we don’t undertake them lightly, but this one is definitely necessary.

Read More in the News.

MPlayer, Essential Codecs, Flvtool, Lame, Libogg, Libgsm, Libvorbis, Vorbis-tools, Libtheora, FFMPEG, ffmpeg-php, wmf Lib, faad2, facc, a52dec-0.7.4, xvid/div decoder, x264, AMR 3gp, Encoder and decoder

So, it’s official! As of today, paid clients can stream, upload and convert flash content on their website! This is very exciting. We’ve tested it on a few of our own websites with complete success.

I will keep everyone updated as things progress. We’re also under the GUARD thanks to ThePlanet which is able to mitigate a large portion of the attack.

UPDATE (1pm): 9 More IP ranges blocked.

UPDATE (2pm): 247 More IP Addresses blocked.

UPDATE (3pm): 632 More IP Addresses blocked.

UPDATE (6pm): 292 More IP Addresses blocked.

UPDATE (1am): The Attack Appears to have ended.

Update (05/04/09)

The attack is still continuing, we’re making large efforts to block the attack.

Update (05/05/09)

The attack is still continuing, we’re making large efforts to block the attack.

The Attack has ended, 05/06/09 – Services returning to normal.

These updates include, but are not limited to:
PDO drivers, GD, iconv, phpsuhosin, and mod_security..

There are several other minor background updates regarding the mail servers and DNS changes. We also updated cPanel and a few monitoring services to help reduce the server load. Last but not least, something worth mentioning is that we’ve been re-arranging some of our accounts between servers to help with load balancing.

As of this update, when or if you cancel your free hosting package, you can then re-register a new free hosting package using the same iPanel account. Some of you may remember that we had to recreate the entire billing account in order to sign up for a new free website, this has sicne been corrected.

And there are dozzens of minor bug fixes regarding invoices, subscriptions and some UI updates.