How a Bird Video Drained My Database Connection Pool
Twarini is a small personal corner of the internet where I scribble about dogs chasing rabbits, gacha banners, and any bizarre creature that wanders across my camera roll. It runs on a modest VPS sitting in a Sydney data centre, fronted by a tired old Nginx instance and a database I configured while half-watching a mobile game stream. The audience is a comfortable mix of regular readers from Melbourne, Brisbane, and the odd visitor from Singapore or Berlin, and the whole site usually hums along on fewer than fifty concurrent connections.
That changed on a sticky Wednesday afternoon when I was halfway through a flat white at a Brunswick cafe. My phone started vibrating against the timber bench top with the kind of rapid-fire buzz reserved for server alerts. The home page had begun throwing 503s, the admin panel refused to load, and my Slack channel was filling with complaints from subscribers who could not see the latest entry about magpies dive-bombing cyclists in Parramatta. Something had clearly gone sideways in the backend, and it had nothing to do with the unrelated commentary about NBN outages that had been trending earlier that week.
The culprit, as I would eventually discover, was an unassuming thirty-eight-second clip of a sulphur-crested cockatoo stealing a snag from a BBQ plate in someone's Brisbane backyard. I had uploaded it that morning as a quick distraction alongside a longer write-up about anime wolves, and somehow it travelled further than anything I had ever published. By the time I paid the bill and walked back to the tram, the bird was on the front page of an Australian meme subreddit, and my database was quietly drowning under the weight of its own success.
The afternoon the pool ran dry
Most home-grown blogs sit on tiny MariaDB instances with connection ceilings that nobody ever thinks to raise. Mine was set to a comfortable default of one hundred concurrent connections, which had felt generous when I provisioned the box two years ago. When a Reddit crosspost from r/AustralianBirds turned into a small avalanche, the requests started queuing faster than the kernel could retire old database handles. Within roughly fifteen minutes, every open connection was occupied, the pool refused to issue new ones, and PHP-FPM workers began timing out while they waited for a slot that would never come.
What surprised me most was how quickly the symptoms cascaded. The bird post itself was a static HTML file once cached, but every comment, every like counter, every related-posts widget that queried the database tipped another connection into the queue. A page that normally closed its handle in under fifty milliseconds was holding one open for several seconds while the worker waited for the page to finish rendering. The pool did not leak so much as it suffocated.
| Setting | Before the incident | After the rebuild |
|---|---|---|
| Max concurrent connections | 100 | 250 with queueing |
| Connection idle timeout | 600 s | 30 s |
| Read replica | none | one read-only follower |
| Static asset caching | browser only | browser plus Cloudflare APO |
Tracing the spike to a cockatoo
I pulled the slow query log and the access log side by side once I had SSH access back. The pattern was unmistakable: one slug, repeated thousands of times, hammering the comments table while a flood of bots refreshed the referrer URL on a loop. A surprising number of the bots resolved to residential Aussie IP ranges, which is why no rate limiter ever flagged them as suspicious. Genuine humans from Melbourne and Adelaide were mixed in with automated crawlers, which made filtering the bad traffic from the good feel like pulling invasive cane toads out of a billabong without disturbing the platypus.
The interesting part was that I had already trimmed my plugin footprint the previous month. I cut two heavy analytics scripts, removed a chat widget that was generating phantom sessions, and shifted related-posts generation to a precomputed file. None of it mattered once a fresh URL hit the trending page and started pulling live readers faster than the worker pool could recycle handles.
How the bird clip spread across the web
Aussie internet has a habit of latching onto animal content with almost tribal enthusiasm. A cockatoo doing something chaotic is catnip for local timelines, and the algorithm at one of the larger aggregators clearly agreed. The post landed in three separate newsletters within an hour, including one run out of a Collingwood co-working space that I had not heard of before that day. A couple of podcast hosts in Perth apparently read it on air, because my analytics showed a sudden jump in listenership referrals from a domain I had to look up.
Most of those readers were polite, left wholesome comments about their own pet birds, and moved on. The damage was done by the sheer volume rather than by any malicious behaviour, which is honestly the most flattering way to have a server die. If you are going to crash, at least crash because people loved what you wrote and not because a script kiddie decided to ruin your week.
Rebuilding the pool and adding limits
The fix the next morning was unglamorous but necessary. I raised the connection ceiling, dropped the idle timeout from ten minutes to half a minute, stood up a read replica for everything that did not need to hit the primary, and pushed the static assets behind a CDN with stale-while-revalidate. I also added a real queue for comment submissions rather than writing them synchronously inside the request thread, which was where most of the cascading waits had been hiding.
While I was elbow-deep in config files, I traded notes with another small-site operator who runs a travel journal and had recently survived a similar spike. They pointed me towards a tiny Go proxy that fails fast under load instead of holding connections open forever, which has since become a quiet workhorse in front of the database. The polite lesson was that indie blogs need the same defensive plumbing that bigger outfits take for granted, even when the audience is only ever a few thousand curious readers.
What indie bloggers can take from this
Bird clips, surprise viral posts, and sudden referrer floods will keep happening to anyone running a public site without a CDN. The cheapest insurance is a sensibly sized connection pool with aggressive idle timeouts, a small queue in front of any heavy write path, and a read replica for the parts of the site that genuinely do not need transactional guarantees. None of that requires anything fancier than a mid-range VPS and a free afternoon with a coffee, which is roughly what every Australian maker has available at least once a fortnight.