We've been having problems with high server load on one of our sites. After much trial and error we determined that K2 seemed to be the culprit. Turning off the component dropped the loads to the server immediately. This site has been running great until recently. The site is running:

Joomla 2.5.8
K2 - 2.6.3

Any idea where to start to trouble shoot the problem. The entire site is built around K2 so we don't have an option to turn it off.

Thanks for any help in advance.

So it looks like the website is being attacked hard. But it is targeting just k2 pages on the site. Is there something in the setup of k2 to stop this from happening?

Have you tried turning the comments completely off within the k2 component?
Can you tell exactly what they are throwing at the server?

check logfile, look into what exactly part of k2 is under attack, try to ban attacking ip-sectors, turn off comments and frontend editing.
btw: what do you mean with server load? ddos or cpu overload or scripts out of memory?

William: Comments were turned off. They are now turned to registered. They edit the site from the front end so that would be hard to do.

Here is what they are hitting on the site:


5.135.179.227 - - [06/Feb/2013:22:54:57 -0500] "GET /departments/code-enforcement HTTP/1.1" 200 34249 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
5.135.179.227 - - [06/Feb/2013:22:54:56 -0500] "GET /latest-news/press-releases/item/238-community-development/238-community-development?start=3130 HTTP/1.1" 200 35066 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
5.135.179.227 - - [06/Feb/2013:22:54:58 -0500] "GET /departments/planning-and-zoning/news/item/450-parks-rec-plan HTTP/1.1" 200 42833 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
5.135.180.216 - - [06/Feb/2013:22:54:59 -0500] "GET /departments/water-and-sewer-systems/item/238-community-development/238-community-development?start=9600 HTTP/1.1" 403 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
5.135.189.203 - - [06/Feb/2013:22:55:00 -0500] "GET /departments/water-and-sewer-systems/item/233-electric-department/233-electric-department?start=2700 HTTP/1.1" 403 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
5.135.179.227 - - [06/Feb/2013:22:54:59 -0500] "GET /departments/mayor-commission HTTP/1.1" 200 35159 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
5.135.179.227 - - [06/Feb/2013:22:54:58 -0500] "GET /?view=featured HTTP/1.1" 200 92213 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
5.135.179.227 - - [06/Feb/2013:22:55:00 -0500] "GET /departments/human-resources/hr-forms/item/457-town-hall-meeting HTTP/1.1" 200 29292 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
5.135.179.227 - - [06/Feb/2013:22:55:01 -0500] "GET / HTTP/1.1" 200 92213 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
5.135.180.216 - - [06/Feb/2013:22:55:02 -0500] "GET /departments/water-and-sewer-systems/item/238-community-development/238-community-development?start=130 HTTP/1.1" 403 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
5.135.179.227 - - [06/Feb/2013:22:55:02 -0500] "GET /departments/electric-department/item/449-video-scholarship-contest-2013 HTTP/1.1" 200 48154 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
5.135.179.227 - - [06/Feb/2013:22:55:03 -0500] "GET /departments/human-resources/hr-forms/item/233-electric-department HTTP/1.1" 200 33471 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"

We banned the IPs. We created a script to parse the log file and pull out the IPs that are hitting the site excessively. So the load averages today are back down to less than .5 compared to 7 after we put the abusers on a deny list.

If you can please post the script file