After mon­it­or­ing the com­ments that Akismet blocked very care­fully, I can report that I’ve had no false pos­it­ives for nearly a week. I’m not quite sure what changed to fix things.
With a dynamic sys­tem like Akismet, things will change over time. That is the nature of the beast. I don’t know whether Matt and the crew tweaked some­thing, or whether a con­cer­ted pois­on­ing attempt stopped being effect­ive, but I’m glad I can start trust­ing it again.
I sus­pect it was the former because the change back was very dra­matic, though I’m sure Auto­mat­tic would not want to admit to it.

Server Trouble

In the mean­time, at around one this morn­ing, my server went down, or rather my blog stopped work­ing. After a quick invest­ig­a­tion, I determ­ined that the data­base server was com­plain­ing of too many con­nec­tions. I checked and there were a large num­ber of httpd pro­cesses run­ning. Pre­sum­ably each, or most had a data­base con­nec­tion open. Static files were being served ok, but any­thing involving the data­base was failing.

I restar­ted the Apache and that seemed to cure it. I star­ted check­ing through log files to see if I could determ­ine the cul­prit, but found noth­ing sus­pi­cious. Fif­teen minutes later the site was down again. I then spent the next two hours mon­it­or­ing the situ­ation. A quick script allowed me to watch the pro­cess count:

ps -ef | grep httpd | wc -l

It was grow­ing quite rap­idly from an ini­tial 16 to over 100, though the site would start fail­ing at about 80. In the end I gave up when the pro­cess count stayed stable for 20 minutes. Though when I checked after a few hours sleep, it had gone down again and was down for over 5 hours. I’m pre­sum­ing it was an attack of some kind.
It has since gone down again, but the growth in num­ber of pro­cesses seems to take a much longer time. I didn’t find any­thing obvi­ous in the logs that I checked, but maybe it is one of the lesser sites which is being attacked. I will con­tinue to investigate…