2

I have a problem with mysql. MYSQL High CPU Usage (300%-400%). But I cannot find solution to handle it. I optimized config mysql. I think maybe my server has a problem, but What do I need to do to find the problem and how to fix it.

Infomation:

  • Server not have slow queries
  • SHOW FULL PROCESSLIST; => Only 7 connection (not lock).
  • show engine innodb status => ROW OPERATIONS
0 queries inside InnoDB, 0 queries in queue
5 read views open inside InnoDB
Process ID=25898, Main thread ID=140213805094656, state: sleeping
Number of rows inserted 16646, updated 89843, deleted 48, read 45381116563
0.50 inserts/s, 0.00 updates/s, 0.00 deletes/s, 2140759.81 reads/s
  • mysqld.log have so many line as (it happens continuously once every second):
Access denied for user 'test'@'139.198.168.221' (using password: YES)
Access denied for user 'root'@'139.198.168.221' (using password: YES)
Access denied for user 'ODBC'@'218.59.174.83' (using password: YES)
Access denied for user 'mysqld'@'218.59.174.83' (using password: NO)
Access denied for user 'root'@'180.215.129.37' (using password: NO)
Access denied for user 'server'@'112.121.189.218' (using password: NO)
[Warning] Host name 'zg-0416b-112.stretchoid.com' could not be resolved: Name or service not known
[Warning] Host name 'zg-0416a-245.stretchoid.com' could not be resolved: Name or service not known

8
  • scan of open orts are very common, that is why databases usually allow only access from localhost, bedides firewall and itrusin detection solutions, which willnot prevent any attempt, but stilla re better than an open mysql server. Can you not switch to only allowing access via vpn or ssh?
    – nbk
    Apr 22, 2021 at 11:23
  • What is the value of long_query_time? (Lower it) Is the slowlog file being written to at all?
    – Rick James
    Apr 22, 2021 at 20:06
  • Do you know where those IP addresses are located? Is there a monitoring service? What about hackers?
    – Rick James
    Apr 22, 2021 at 20:07
  • Let's see the PROCESSLIST. No locks is mostly irrelevant when chasing CPU issues.
    – Rick James
    Apr 22, 2021 at 20:09
  • stretchoid.com is godaddy -- does that ring any bells?
    – Rick James
    Apr 22, 2021 at 20:10

1 Answer 1

0

Somebody is trying to hack your server using bots (all these log entries are login attempts). To be honest I see the same atempts in my logs all the time. To check if this is the source of your server overload (I am not sure...) try to restrict network connections to mySQL: uncomment this line in your mysqld.cnf

bind-address    = 127.0.0.1

Then restart your mySQL and check the load.

3
  • that is a normal log, so no hacking attempt was tried. but there are scans all the time. i think it is a goof idea to let only localhost acces to the database, but as you have mysql force to allow access from everywhere, it was made intentionally.
    – nbk
    Apr 22, 2021 at 11:13
  • I agree scans are not "hacking" but usually looking for a way to do so... Access from everywhere in most cases is not a must. It is just an easiest way to manage your server. So it can be a good starting point to check 'bind-address'.
    – Igor Pigin
    Apr 22, 2021 at 12:34
  • Thank @IgorPigin, I closed port 3306, and CPU is reduced
    – kojca
    Apr 23, 2021 at 1:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.