---
title: "Discussion on \"The Outage That Wasn't a DDoS\" | Hashnode"
description: "Discussion on \"The Outage That Wasn't a DDoS\". Site and webmail died, WHM stayed up, everyone said DDoS. It was one scraper, a URL that never ends and pm.max_children = 5. How I proved it."
url: "https://hashnode.com/posts/the-outage-that-wasn-t-a-ddos/6ad524490d857103f844acf4"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [The Outage That Wasn't a DDoS](https://quabin.hashnode.dev/the-outage-that-wasn-t-a-ddos?utm_source=hashnode&utm_medium=feed)

Site and webmail died, WHM stayed up, everyone said DDoS. It was one scraper, a URL that never ends and pm.max\_children = 5. How I proved it.

Oct 18 · 13 min read · quabin.hashnode.dev  
Read the article

-   [#apache](https://hashnode.com/tag/apache)
-   [#php](https://hashnode.com/tag/php)
-   [#cpanel](https://hashnode.com/tag/cpanel)
-   [#devops](https://hashnode.com/tag/devops)

## Written by

[Daanial Farrukh](https://hashnode.com/@daanial)

@daanial

  
[View profile](https://hashnode.com/@daanial)

Field notes from a presales solutions architect

Cloud presales architect — anonymized war stories and frameworks on cloud architecture, security, and the trade-offs that shape real systems.

## Responses 3

Markdown supported · ⌘↵ to post

[Abhinav Sharma](https://hashnode.com/@abhinavs1920)

[Oct 18](https://hashnode.com/posts/the-outage-that-wasn-t-a-ddos/6ad524490d857103f844acf4/comment/6ad54317fa076d04c3780f58)

"Saturation is not an error" should be printed on dashboards. Error-rate alerts are blind to a pool quietly running out of workers because nothing ever fails. After this one, what did you alert on - busy workers as a share of pm.max\_children, or the listen queue?

[Daanial Farrukh](https://hashnode.com/@daanial)

[Oct 18](https://hashnode.com/posts/the-outage-that-wasn-t-a-ddos/6ad524490d857103f844acf4/comment/6ad54317fa076d04c3780f58#reply-6ad545002637b037ccc6c167)

Thanks Abhinav. Listen queue first: any value above 0 for more than a few seconds means requests are already waiting. Busy workers above 70 percent of pm.max\_children is the early warning. Both come from the PHP-FPM status page. Error-rate alerts never see this, which is why the team spent two days looking for an attacker.

[Abhinav Sharma](https://hashnode.com/@abhinavs1920)

[Oct 19](https://hashnode.com/posts/the-outage-that-wasn-t-a-ddos/6ad524490d857103f844acf4/comment/6ad54317fa076d04c3780f58#reply-6ad56c83e83045f3e0b25d86)

That 70 percent early-warning line is the part most setups skip. By the time the queue shows anything above zero, users already feel it. Thanks for the numbers.