Recommended tools/techniques for monitoring for spam attacks on multi-site and shared servers

Question

I'm managing a number of servers with dozens of Drupal sites, some with a single multi-site Drupal installation and others with dozens of separate Drupal installations. We're constantly running into the issue of one site having a lax registration or comment policy and getting overrun with node spam to the detriment of the entire server.

Addressing the spam isn't a problem once we can detect the issue (CAPTCHAs and user registration approval usually knock out most of the attacks) but most of these sites have inexperienced administrators who aren't savvy enough to notice these attacks underway and we only detect them several months in when the damage to performance and SEO has already been done. Better security policies would also obviously help and we usually try and address any potential security issues during the site build but we don't usually try and prevent the client from enabling comments or adding new features, etc.

Any recommendations for how to monitor multiple Drupal sites to detect an attack like this before it gets too far? I've seen a number of 'drupal watch' modules and services like Drupalmonitor.com or NewRelic but they seem more focused on module updates, etc. Possible signatures for a spam attack would probably be an excessive amount of comments or nodes over a given period, coming from the same server, excessive load on a specific table, etc.

Answer 1

ether try the free mollom service or you can blacklist words before they get submitted. Another solution that does well is just use the disqus module to regulate your commenting. i have switched over to disqus completely. but its not seo friendly as its a js script call from what i remember. if you want seo capability best you blacklist words and links. say if someone posts a link it would throw an error. this would deter any link spammers as most bots posts links.