rendered paste bodyprogma's mysql data for inprotect tuning
Jul 25 2007 17:15
Server data:
hardware - Dell PowerEdge 2550 2x1.13ghz Pentium III
Linux kernel - 2.6.9-55.ELsmp
OS - RHEL4U5
mysql - Ver 14.12 Distrib 5.0.45, for redhat-linux-gnu (i686) using readline 5.0
inprotect - 0.22.5
Have not tuned anything on this server, is all stock
Other things are running on it - cacti, zabbix server + agentd, caching dns server, snmp traps etc but load average never gets over 1
Before tuning:
Before scan of one host on same LAN:
mysqladmin status
Uptime: 4447 Threads: 29 Questions: 360438 Slow queries: 0 Opens: 614 Flush tables: 1 Open tables: 64 Queries per second avg: 81.052
mysqladmin processlist
+-----+-------+-----------+-----------+---------+------+-------+------------------+
| Id | User | Host | db | Command | Time | State | Info |
+-----+-------+-----------+-----------+---------+------+-------+------------------+
| 49 | root | localhost | inprotect | Sleep | 4 | | |
| 50 | root | localhost | zabbix | Sleep | 208 | | |
| 77 | root | localhost | zabbix | Sleep | 56 | | |
| 78 | root | localhost | zabbix | Sleep | 55 | | |
| 82 | cacti | localhost | cacti | Sleep | 324 | | |
| 83 | cacti | localhost | cacti | Sleep | 930 | | |
| 84 | cacti | localhost | cacti | Sleep | 1554 | | |
| 85 | cacti | localhost | cacti | Sleep | 21 | | |
| 86 | cacti | localhost | cacti | Sleep | 324 | | |
| 87 | cacti | localhost | cacti | Sleep | 628 | | |
| 88 | cacti | localhost | cacti | Sleep | 22 | | |
| 89 | cacti | localhost | cacti | Sleep | 22 | | |
| 91 | cacti | localhost | cacti | Sleep | 325 | | |
| 92 | root | localhost | zabbix | Sleep | 86 | | |
| 96 | root | localhost | zabbix | Sleep | 25 | | |
| 100 | root | localhost | zabbix | Sleep | 86 | | |
| 101 | root | localhost | zabbix | Sleep | 116 | | |
| 102 | root | localhost | zabbix | Sleep | 25 | | |
| 103 | root | localhost | zabbix | Sleep | 452 | | |
| 108 | root | localhost | zabbix | Sleep | 269 | | |
| 130 | root | localhost | zabbix | Sleep | 54 | | |
| 131 | root | localhost | zabbix | Sleep | 50 | | |
| 132 | root | localhost | zabbix | Sleep | 51 | | |
| 133 | root | localhost | zabbix | Sleep | 51 | | |
| 135 | root | localhost | zabbix | Sleep | 51 | | |
| 136 | root | localhost | zabbix | Sleep | 6 | | |
| 137 | root | localhost | zabbix | Sleep | 1 | | |
| 199 | cacti | localhost | cacti | Sleep | 22 | | |
| 919 | root | localhost | | Query | 0 | | show processlist |
+-----+-------+-----------+-----------+---------+------+-------+------------------+
During scan of one host on same LAN (about 1 minute after starting scan via web interface):
mysqladmin status
Uptime: 4619 Threads: 31 Questions: 376638 Slow queries: 0 Opens: 655 Flush tables: 1 Open tables: 64 Queries per second avg: 81.541
mysqladmin processlist
+-----+-------+-----------+-----------+---------+------+-------+------------------+
| Id | User | Host | db | Command | Time | State | Info |
+-----+-------+-----------+-----------+---------+------+-------+------------------+
| 49 | root | localhost | inprotect | Sleep | 5 | | |
| 50 | root | localhost | zabbix | Sleep | 176 | | |
| 77 | root | localhost | zabbix | Sleep | 54 | | |
| 78 | root | localhost | zabbix | Sleep | 23 | | |
| 82 | cacti | localhost | cacti | Sleep | 505 | | |
| 83 | cacti | localhost | cacti | Sleep | 1111 | | |
| 84 | cacti | localhost | cacti | Sleep | 1735 | | |
| 85 | cacti | localhost | cacti | Sleep | 202 | | |
| 86 | cacti | localhost | cacti | Sleep | 505 | | |
| 87 | cacti | localhost | cacti | Sleep | 809 | | |
| 88 | cacti | localhost | cacti | Sleep | 203 | | |
| 89 | cacti | localhost | cacti | Sleep | 203 | | |
| 91 | cacti | localhost | cacti | Sleep | 506 | | |
| 92 | root | localhost | zabbix | Sleep | 145 | | |
| 96 | root | localhost | zabbix | Sleep | 84 | | |
| 100 | root | localhost | zabbix | Sleep | 267 | | |
| 101 | root | localhost | zabbix | Sleep | 84 | | |
| 102 | root | localhost | zabbix | Sleep | 23 | | |
| 103 | root | localhost | zabbix | Sleep | 633 | | |
| 108 | root | localhost | zabbix | Sleep | 115 | | |
| 130 | root | localhost | zabbix | Sleep | 5 | | |
| 131 | root | localhost | zabbix | Sleep | 7 | | |
| 132 | root | localhost | zabbix | Sleep | 8 | | |
| 133 | root | localhost | zabbix | Sleep | 10 | | |
| 135 | root | localhost | zabbix | Sleep | 12 | | |
| 136 | root | localhost | zabbix | Sleep | 5 | | |
| 137 | root | localhost | zabbix | Sleep | 0 | | |
| 199 | cacti | localhost | cacti | Sleep | 203 | | |
| 961 | root | localhost | inprotect | Sleep | 53 | | |
| 980 | root | localhost | inprotect | Sleep | 46 | | |
| 990 | root | localhost | | Query | 0 | | show processlist |
+-----+-------+-----------+-----------+---------+------+-------+------------------+
During portscan phase:
mysqladmin status
Uptime: 4826 Threads: 32 Questions: 391392 Slow queries: 0 Opens: 680 Flush tables: 1 Open tables: 64 Queries per second avg: 81.101
mysqladmin processlist
+------+-------+-----------+-----------+---------+------+-------+------------------+
| Id | User | Host | db | Command | Time | State | Info |
+------+-------+-----------+-----------+---------+------+-------+------------------+
| 49 | root | localhost | inprotect | Sleep | 1 | | |
| 50 | root | localhost | zabbix | Sleep | 104 | | |
| 77 | root | localhost | zabbix | Sleep | 231 | | |
| 78 | root | localhost | zabbix | Sleep | 169 | | |
| 82 | cacti | localhost | cacti | Sleep | 682 | | |
| 83 | cacti | localhost | cacti | Sleep | 76 | | |
| 84 | cacti | localhost | cacti | Sleep | 1912 | | |
| 85 | cacti | localhost | cacti | Sleep | 379 | | |
| 86 | cacti | localhost | cacti | Sleep | 682 | | |
| 87 | cacti | localhost | cacti | Sleep | 77 | | |
| 88 | cacti | localhost | cacti | Sleep | 75 | | |
| 89 | cacti | localhost | cacti | Sleep | 78 | | |
| 91 | cacti | localhost | cacti | Sleep | 76 | | |
| 92 | root | localhost | zabbix | Sleep | 78 | | |
| 96 | root | localhost | zabbix | Sleep | 108 | | |
| 100 | root | localhost | zabbix | Sleep | 45 | | |
| 101 | root | localhost | zabbix | Sleep | 261 | | |
| 102 | root | localhost | zabbix | Sleep | 15 | | |
| 103 | root | localhost | zabbix | Sleep | 46 | | |
| 108 | root | localhost | zabbix | Sleep | 15 | | |
| 130 | root | localhost | zabbix | Sleep | 49 | | |
| 131 | root | localhost | zabbix | Sleep | 52 | | |
| 132 | root | localhost | zabbix | Sleep | 48 | | |
| 133 | root | localhost | zabbix | Sleep | 49 | | |
| 135 | root | localhost | zabbix | Sleep | 49 | | |
| 136 | root | localhost | zabbix | Sleep | 4 | | |
| 137 | root | localhost | zabbix | Sleep | 1 | | |
| 199 | cacti | localhost | cacti | Sleep | 380 | | |
| 961 | root | localhost | inprotect | Sleep | 230 | | |
| 980 | root | localhost | inprotect | Sleep | 10 | | |
| 1007 | root | localhost | | Sleep | 99 | | |
| 1029 | root | localhost | | Query | 0 | | show processlist |
+------+-------+-----------+-----------+---------+------+-------+------------------+
During attack phase:
Uptime: 4948 Threads: 32 Questions: 402369 Slow queries: 0 Opens: 692 Flush tables: 1 Open tables: 63 Queries per second avg: 81.320
+------+-------+-----------+-----------+---------+------+-------+------------------+
| Id | User | Host | db | Command | Time | State | Info |
+------+-------+-----------+-----------+---------+------+-------+------------------+
| 49 | root | localhost | inprotect | Sleep | 2 | | |
| 50 | root | localhost | zabbix | Sleep | 220 | | |
| 77 | root | localhost | zabbix | Sleep | 97 | | |
| 78 | root | localhost | zabbix | Sleep | 9 | | |
| 82 | cacti | localhost | cacti | Sleep | 798 | | |
| 83 | cacti | localhost | cacti | Sleep | 192 | | |
| 84 | cacti | localhost | cacti | Sleep | 2028 | | |
| 85 | cacti | localhost | cacti | Sleep | 495 | | |
| 86 | cacti | localhost | cacti | Sleep | 798 | | |
| 87 | cacti | localhost | cacti | Sleep | 193 | | |
| 88 | cacti | localhost | cacti | Sleep | 191 | | |
| 89 | cacti | localhost | cacti | Sleep | 194 | | |
| 91 | cacti | localhost | cacti | Sleep | 192 | | |
| 92 | root | localhost | zabbix | Sleep | 194 | | |
| 96 | root | localhost | zabbix | Sleep | 39 | | |
| 100 | root | localhost | zabbix | Sleep | 161 | | |
| 101 | root | localhost | zabbix | Sleep | 9 | | |
| 102 | root | localhost | zabbix | Sleep | 39 | | |
| 103 | root | localhost | zabbix | Sleep | 100 | | |
| 108 | root | localhost | zabbix | Sleep | 131 | | |
| 130 | root | localhost | zabbix | Sleep | 45 | | |
| 131 | root | localhost | zabbix | Sleep | 45 | | |
| 132 | root | localhost | zabbix | Sleep | 45 | | |
| 133 | root | localhost | zabbix | Sleep | 47 | | |
| 135 | root | localhost | zabbix | Sleep | 44 | | |
| 136 | root | localhost | zabbix | Sleep | 2 | | |
| 137 | root | localhost | zabbix | Sleep | 0 | | |
| 199 | cacti | localhost | cacti | Sleep | 496 | | |
| 961 | root | localhost | inprotect | Sleep | 346 | | |
| 980 | root | localhost | inprotect | Sleep | 0 | | |
| 1007 | root | localhost | | Sleep | 215 | | |
| 1067 | root | localhost | | Query | 0 | | show processlist |
+------+-------+-----------+-----------+---------+------+-------+------------------+