3

Recently, I ran in to a problem, where a document that is stored in a SharePoint site was published through social media, the document URL was something like this:

https://site/subsite/documents/somefile.pdf

After publishing the document, an error appeared when trying to access the site saying "Server is too busy, try again later" (site was down).

I've been administrating the farm that hosts this SharePoint site for more than 2 years, I was never given such an error as the topology contains 6 web front ends with very high specifications in terms of CPU, RAM, and Disk Space.

I investigated almost everything on the server and servers' resources seem to be healthy (Disk Space, RAM, CPU, Services up and running)...etc.

Operation team said that they noticed a heavy traffic coming from outside the country and they blocked the IP that was causing the traffic to the site, also after restarting the servers one by one, everything was back to normal.

I'm wondering what the issue is, is it because the document was announced on Social Media and huge number of people tried to download the document through the announced URL ?! or was the site exposed to some kind of a DDoS attack ?

Your advice is appreciated.

Improve this question
  • Emm, did you ask your "operation team" what were the endpoints of that heavy traffic? Shared files or another content? – AlexZh Jul 2 '18 at 5:59
  • @AlexZh, They mentioned something about uploading data about 2 TB – Mohammad Akilan Jul 2 '18 at 6:26
0

Did you have a look at IIS-Logs? If this error was generated by a WFE-Server, it should be an IIS-Related error.

You mentioned "6 WebFrontEnd-Servers". As you didn't find anything on your WFEs, i'd bet it was your LoadBalancer which is in front of them. Did you get in touch with those guys to dig into their logs?

Do you have a screenshot of the "Server is too busy, try again later" Error? Most error-messages do have a format which can be tracked down if it's generated by IIS, Apache, etc.

Improve this answer
  • Yes, everything seems normal, it is the traffic, so maybe the site was exposed to a DDoS attack, from only 1 source, not multiple sources, after blocking the attacking IP address, everything gets back to normal. – Mohammad Akilan Jul 4 '18 at 22:24
0

You may check the following:

  1. Check the memory utilization in the WFE server - try to close unwanted processor.
  2. Try to restart timer service, SharePoint search service, IIS
  3. If still does not solve the issue - try restarting the server WFE and Application server.
  4. If still does not resolve - login to SQL server, check the particular web application's content database auto growth setting - it should be "unlimited"
  5. If still does not resolve - try clearing the SharePoint config cache

Hope this will definitely will fix this issue.

For database autogrowth setting please click here

Database autogrowth settings image

If nothing solves - we may check the below as well:

Need to run the SharePoint Configuration wizard in Application with search server successfully.

Notes:

  1. To be on safer side, before running the SharePoint Configuration wizard we must take following backups in the server:
  2. Take server snapshot or image backup of all servers(including the SQL server) in the farm. Take all service application database backup.
  3. Take all content database backup.
  4. Take SharePoint_Config database backup.
  5. Need to remove the “WSS_UsageApplication” database from availability group: If you have an availability group in place in the SQL, we need to remove the “WSS_UsageApplication” database (logging database) from availability group otherwise while running the SharePoint configuration wizard will get an error and will not be able to complete the wizard running successfully. And after successfully running the wizard we need to add back the “WSS_UsageApplication” database back to the availability group.

Please click here for the detailed steps to run the configuration wizard.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.