3

Recently, I ran in to a problem, where a document that is stored in a SharePoint site was published through social media, the document URL was something like this:

https://site/subsite/documents/somefile.pdf

After publishing the document, an error appeared when trying to access the site saying "Server is too busy, try again later" (site was down).

I've been administrating the farm that hosts this SharePoint site for more than 2 years, I was never given such an error as the topology contains 6 web front ends with very high specifications in terms of CPU, RAM, and Disk Space.

I investigated almost everything on the server and servers' resources seem to be healthy (Disk Space, RAM, CPU, Services up and running)...etc.

Operation team said that they noticed a heavy traffic coming from outside the country and they blocked the IP that was causing the traffic to the site, also after restarting the servers one by one, everything was back to normal.

I'm wondering what the issue is, is it because the document was announced on Social Media and huge number of people tried to download the document through the announced URL ?! or was the site exposed to some kind of a DDoS attack ?

Your advice is appreciated.

|improve this question
  • Emm, did you ask your "operation team" what were the endpoints of that heavy traffic? Shared files or another content? – AlexZh Jul 2 '18 at 5:59
  • @AlexZh, They mentioned something about uploading data about 2 TB – Mohammad Akilan Jul 2 '18 at 6:26
0

Did you have a look at IIS-Logs? If this error was generated by a WFE-Server, it should be an IIS-Related error.

You mentioned "6 WebFrontEnd-Servers". As you didn't find anything on your WFEs, i'd bet it was your LoadBalancer which is in front of them. Did you get in touch with those guys to dig into their logs?

Do you have a screenshot of the "Server is too busy, try again later" Error? Most error-messages do have a format which can be tracked down if it's generated by IIS, Apache, etc.

|improve this answer
  • Yes, everything seems normal, it is the traffic, so maybe the site was exposed to a DDoS attack, from only 1 source, not multiple sources, after blocking the attacking IP address, everything gets back to normal. – Mohammad Akilan Jul 4 '18 at 22:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.