VPS 8 is an OpenVZ VPS Node. This form of virtualization allows equal share of the CPU between all hosted containers. This has the advantage that an individual container (server) can burst into all CPU cores if needed but also can mean in extreme situations one container (server) can cause the main node to become overloaded.
Unfortunately last evening around 9pm the node became overloaded and unresponsive. We had to reboot the node. This was identical to what happened on Friday. Two containers (servers) were receiving a lot of hits causing the entire node to become overloaded. One such container has 100 Wordpress websites and the other has 60 Wordpress websites hosted. Both servers were receiving an abnormal number of hits from the widest range of IP addresses to the wp-login.php file. We disabled access to all wp-login.php files on the server and this has calmed the load. This is a temporary solution but it solved the problem last evening.
In case you are not aware there is a worldwide attack against Wordpress and here are some links from other web hosts to show this fact:
http://www.hostdime.com/blog/2013/04/brute-force-attack-affecting-global-wordpress-installations/
http://forums.site5.com/showthread.php?p=191613
http://blog.hostgator.com/2013/04/11/global-wordpress-brute-force-flood/
https://www.facebook.com/permalink.php?story_fbid=494405660626327&id=246634765403419
Alternatively do a google search on : ‘Wordpress Brute Force Attack’ for more information
Moving Forward
We are continuing to take steps to mitigate this attack against these two VPS servers. We have added new mod_security rules as well as work to block the most prolific Ips.
If this happens again and we are forced to reboot this VPS8 Node again what we will do is move these servers off this OpenVZ Node and place them on one of our Xen Nodes as that will allow us to allocate CPU Cores. This will mean if one server becomes overloaded it will not affect the other servers on the same node. On Xen based virtualisation VPS servers one server becoming overloaded will have minimal (if any) affect on the other VPS servers on the same physical node.
