Account Suspended Due To Server Overloading - Unknown Ip Causing This Issue
Dec 14, 2007
My host has suspended saying my server was overloaded and sent me a log to my mail and i don't have access to cpanel also. I just have a wordpress blog and when i had contacted host through chat they told some ip might be causing this issue so ban that ip when ur account is unsuspended.
But i am really unaware of how to find which ip is causing this issue as i have little knowledge on analysing logs. Any help regarding this is highly appreciated and please leave your suggestions for me.
I am pasting the logs that were sent by host to me in mail:
Srv PID Acc M CPU SS Req Conn Child Slot Host VHost Request
0-5 22363 32/49/49 K 5.76 2 1695 583.9 0.82 0.82 76.227.169.69
GET /index.php/181/ HTTP/1.1
1-5 22365 81/81/81 W 42.69 3 0 3060.8 2.99 2.99 76.183.97.67
GET /index.php/181/ HTTP/1.1
2-5 22367 87/87/87 K 45.81 2 991 3287.3 3.21 3.21 76.183.97.67
GET /index.php/181/ HTTP/1.1
3-5 22369 2/41/41 K 2.07 8 0 15.3 0.12 0.12 67.87.117.129
GET /wp-content/plugins/postratings/images/stars/rating_half.gi
6-5 22387 0/13/13 W 2.21 57 0 0.0 0.12 0.12 81.22.20.143
GET /index.php/181/ HTTP/1.1
7-5 22388 76/76/76 W 39.94 0 0 2871.9 2.80 2.80 141.153.137.168
GET /index.php/181/ HTTP/1.1
8-5 22396 0/26/26 W 2.46 38 0 0.0 0.34 0.34 127.0.0.1
care.com GET /whm-server-status HTTP/1.0
13-5 22413 0/18/18 W 1.46 44 0 0.0 0.33 0.33 81.22.20.143
GET /index.php/181/ HTTP/1.1
14-5 22414 0/25/25 _ 0.76 55 672 0.0 0.28 0.28 71.77.3.233
GET /wp-content/uploads/2007/12/cup.jpg HTTP/1.1
20-5 22464 2/14/14 K 0.66 8 0 52.5 0.14 0.14 67.87.117.129
GET /wp-content/plugins/postratings/images/loading.gif HTTP/1.1
21-5 22484 0/6/6 _ 1.31 40 329 0.0 0.03 0.03 74.77.10.155
-care.com GET /~realrina/nun.jpg HTTP/1.1
22-5 22510 27/37/37 K 18.07 0 1832 982.5 1.25 1.25 80.195.137.10
GET /index.php/181/ HTTP/1.1
23-5 22523 8/34/34 K 1.76 8 0 94.6 0.30 0.30 67.87.117.129
GET /wp-content/plugins/postratings/images/stars/rating_on.gif
27-5 22540 0/10/10 _ 3.36 39 167 0.0 0.19 0.19 90.192.174.63
GET /wp-content/uploads/2007/10/anand.jpg HTTP/1.1
28-5 22542 1/14/14 K 1.76 8 823 151.9 0.23 0.23 67.87.117.129
GET /wp-content/themes/ProSense%20Redux/images/picture.jpg
HTTP
29-5 23481 0/6/14 _ 0.37 11 2803 0.0 0.11 0.12 82.37.128.175
radio.audio-perfection.co.uk GET /img/player.png HTTP/1.1
30-5 22584 32/44/44 K 15.47 0 1284 989.6 1.06 1.06 80.195.137.10
GET /index.php/181/ HTTP/1.1
31-5 22588 22/25/25 K 5.77 0 751 468.0 0.46 0.46 76.227.169.69
GET /index.php/181/ HTTP/1.1
32-5 23520 0/5/8 _ 0.20 19 414 0.0 0.05 0.09 72.95.237.89 pown.us
GET /images/files/36.jpg HTTP/1.1
33-5 23627 1/6/22 K 0.06 3 967 28.0 0.06 0.35 66.249.65.196
GET /index.php/category/telugu-online-movies/page/4/
HTTP/1.1
36-5 23637 2/3/6 K 0.00 3 37 0.0 0.000 0.03 83.181.190.92 akirad.net
GET /files/color/garland-9bf1a50e/menu-expanded.gif HTTP/1.1
37-5 23673 8/9/16 K 0.49 8 0 126.9 0.20 0.21 67.87.117.129
GET /wp-content/uploads/2007/12/movie_dus_kahaniyaan.jpg HTTP/1
38-5 23674 1/3/10 K 0.00 11 1536 23.0 0.06 0.15 84.57.59.109
teeth-whitening-kit.com GET /affiliate/scripts/sb.php?a_aid=17&a_bid=7
HTTP/1.1
39-5 23690 10/10/22 K 0.99 3 0 35.6 0.03 0.29 83.181.190.92
akirad.net GET /files/color/garland-9bf1a50e/bg-tab.png HTTP/1.1
40-5 23693 0/5/10 _ 0.00 44 1106 0.0 0.04 0.07 67.11.157.83
teeth-whitening-kit.com GET /affiliate/scripts/sb
44-5 23721 1/3/6 K 0.00 8 0 0.4 0.000 0.00 67.87.117.129
GET /wp-content/plugins/share-this/share-icon-16x16.gif HTTP/1.
45-5 - 0/0/3 . 0.00 39 1 0.0 0.00 0.00 83.181.190.92 akirad.net GET
/files/color/garland-9bf1a50e/menu-expanded.gif HTTP/1.1
46-5 - 0/0/5 . 0.22 22 1332 0.0 0.00 0.04 81.22.20.143
GET /index.php/181/ HTTP/1.1
47-5 22780 51/52/52 K 26.66 0 940 1927.2 1.88 1.88 76.183.97.67
GET /index.php/181/ HTTP/1.1
48-5 - 0/0/3 . 0.00 37 6786 0.0 0.00 0.02 81.22.20.143
GET /index.php/181/ HTTP/1.1
51-5 - 0/0/13 . 0.26 35 34109 0.0 0.00 0.06 71.77.3.233
GET /favicon.ico HTTP/1.1
54-5 23746 2/3/3 K 0.51 3 0 0.0 0.02 0.02 83.181.190.92 akirad.net
GET /files/color/garland-9bf1a50e/menu-leaf.gif HTTP/1.1
55-5 23747 0/0/0 W 0.00 20 706795599 0.0 0.00 0.00 81.22.20.143
GET /index.php/181/ HTTP/1.1
56-5 - 0/0/3 . 0.00 16 4868 0.0 0.00 0.00 66.7.206.192
care.com GET /serverstats_inc.php HTTP/1.0
57-5 - 0/0/5 . 0.09 44 0 0.0 0.00 0.01 195.13.38.198 (unavailable)
POST /users_adm/start1.php HTTP/1.1
58-5 - 0/0/1 . 0.00 24 1640 0.0 0.00 0.02 81.22.20.143
GET /index.php/181/ HTTP/1.1
61-5 - 0/0/2 . 0.07 12 10194 0.0 0.00 0.01 172.188.47.93
radio.audio-perfection.co.uk GET /play_wmp.php HTTP/1.1
I have a VPS account with WHP which is unmetered monthly transfer and a caped speed at 3 mbps, they saying that you are allowed to use %100 of the cpu:
[url]
My question is what would be a case that they may suspend my account?
Dear Customer, Due to unlawful activities on your VPS your Services at VPS Empire have been suspended. Please contact our helpdesk at http://www.vpsempire.info for more information. ...
My shared hosting account was suspended for tos violation (adult content was found..absolutely legal, by the way)
Now all my websites are inaccessible, my control panel doesn't let me in, I cannot get access to my content..
I read your FAQ now, I understand what I did wrong.
"On our shared-hosting it is strictly forbidden to host adult content. This type of content usually generates a lot of traffic and could cause prejudice to our shared hosting clients due to server overusage coming from such websites."
I didn't think my 200 visitors daily put so much loading on your servers but now I see my mistake.
I found out why my website has been down for 8 days. I finally contacted someone at UWH and found that someone jacked my domain and spammed. So they suspended my account.
What really pisses me off is David Turner over at UWH has accused me of sending the spam. Even after I told him is was not me, he still accused me of sending the spam and threatened to bill my credit card for the spam fees.
I can tell you the $hit will hit the fan if he charges me anything and he had better stop accusing me of sending spam and appologize and it would be nice if THEY WOULD STOP THE SUSPENSION OF MY ACCOUNT!
Hi all. If you are a FSCKVPS member then be aware that you should NOT pay your invoices using their Paypal subscriptions.
Here's my story: My first monthly payment I made using a regular Paypal payment. Everything was ok. So I created a subscription the next month and was immediately billed by Paypal. Interestingly my invoice was still marked "UNPAYED" in the fsckvps system. So I opened a support ticket (10 days ago now). They forwarded it to their "Billing Level 2" departement and told me that they have problems processing Paypal payments that are subscriptions. Days went by and nothing happened. I received emails that my payment was overdue so I asked them again to please mark the invoice as "PAYED". Nothing happened.
Until yesterday they suspended my account!!! Ever since I'm trying to get my account back online. I even payed the invoice again (!!!) using a regular Paypal payment but that didn't help anything except that I'm paying twice for no service now. Nobody seems to care. I opened another ticket with support, hoping that another departement might be more helpful but the ticket was just again forwarded to "Billing Level 2". There's no phone number or anything to contact them. It's a shame, because I like their service and the technical support personnel has always been a great help to me. But not their billing people.
My server has been running slow for a while now but I was out of twon so I was not able to check on it. I just got back and find that the server load is above 4.50 for a dual cpu server with 2GB ram. I have looked and all I can see is that there are a few sites using a good amount of resources. However, on my other server, I have sites that are even more busy then the ones on the server that is overloading. I cannot seem to find what is going on or what to do about it. Please help me. The sites are moving at a snails pace.
I currently have a web VPS hosted with FDCServers.net and after 5 days of switching to it i am getting massive HTTP requests. When i login to WHM and hit apache status i have many requests per second by multiple IP's that are going to pages that simple don't exist. Currently my hostname for the server is set at web-01.optical-hosting.com which is what the requests are being sent to. I am also having a DNS issue because when i put http://web-01.optical-hosting.com in the web browser it displays the first account's site under "list accounts" in cpanel. Can someone please help me fix both of these issue's? i will post an apache log in a second post as it is long. Also, these are from overseas. please someone help me with this i have Aim and Msn.
I have set up my Virtual Private Server and uploaded all my site's files to /var/www folder. Before that, there was an old simple 'index.html' file
Code: <html> <head> <title>INDEX</title> </head> <body> <h1>IT WORKS!!!!</h1> </body> </html> and when I typed the address www.mydomain.com it displayed correctly. Then I deleted this html and uploaded my files through FTP and now the browser says :
Code: Warning: Unknown: failed to open stream: Permission denied in Unknown on line 0
Fatal error: Unknown: Failed opening required '/var/www/index.php' (include_path='.:/usr/share/php:/usr/share/pear') in Unknown on line 0
i have wrong procedure doing to enable my SSL/HTTPS services in my vps.
First i noticed the HTTPS in my services is not running, now i'm looking to google, i found openssl website, then download the latest version and install it into my server and following the instructions, after that, i try to recompile the apache becuase i have a new updates, i found an error ssl and cannot continue to compile because of my last installation i suspect.
Soon I find out that my ping keeps dropping. The server was smoothly running, SSH is smooth, Website are loading fine, except I cannot ping my server. I disable SELINUX completely and it still doesn't help.
When I disable CSF, my server ping are responding back!
So I remove CSF installation and reinstall CSF, the same problem appear
How can I solve this issue?
My kernel is 2.6.18-92.1.6.el5PAE running on latest version of cPanel on CentOS 5.1
I'm having a very intermittent PHP error on my dual processor CPanel/CentOS 4x box. And it happens randomly across several domains, so I know it's not a single domain problem.
I can never figure out what causes it. 95% of the time the sites work fine (no error), but ever so often my php includes give me something like this:
PHP randomly fails to find the directory/file. And it requires an Apache restart to make it work smoothly again. It will be fine for a few days, but then it happens again. So I suppose it may not be directly related to PHP, but more of a server/apache issue? Any ideas at all?
Ever since Monday morning, my site has had problems because the server at my host is under attack.
Most of Monday my site was down. Then Monday late afternoon, it came back...I thought. The forum is up and running, but the rest of the site, built on WordPress, is screwy.
Most of the plugins aren't working because of inability to connect with the database.
I can't log in to my cPanel at all and haven't been able to since Sunday.
This is the first time I've experienced anything like this, lasting this long.
It has me wondering if I should start considering a new host. I have loved their service, especially their speedy support (native English speaking to boot) so I hate to leave but I'm not sure if their service is going a little downhill or not.
For the past few days, one of the server is causing a bandwidth utilization surge for the entire rack on almost daily basis. It happen for a few minutes and it went off then it will be the same thing again the next day. When the surge is happening, most of the servers on the same segment will be inaccessible for the few minutes.
The bandwidth utilization graph for my rack is recording an abnormal surge from (6mbps --> 90mbps) for the few minutes. My MRTG is showing 2 of the Plesk servers giving the problem but the NOC guys said it the Cpanel that causing the problem.
I tried logging in to both servers but could not find what's the cause for this.
It's been a while since I've posted in this area of the forum, but was just wondering if by now someone or some company has developed a script/software that you can install on your server that will tell you the exact area where the high CPU load is coming from, such as from someone sending email, a certain users account, and etc?
Most times, you have to be mointoring your server at the time of the high load to be exactly sure of what is causing the high load, so, I'm talking about something that will email you right on the spot of the high load in case you are away and will know what caused it.
Most I've seen only tell you that you have a high load, but don't tell you what exactly caused it.
Today i found out my server was suspended by VAserv without any notice beforehand. They sent me a email stating that i violated some policy as per email here: ----------------------------------------------------------------- The server was suspended for AUP violations. Your server has IRC chat software installed as the message clearly states that
=================== > I found these suspicious looking connections on the Undernet IRC Chat > Network connecting from a netblock you control. The originating ip(s) > and undernet server(s) each one was connected to is listed below. The > destination port they were using is most likely port 6667. Other > possible ==================
The Chat software that you are using may be using IRC as an internal interface for operation.
Regarding the supension, We suspend all the domains, vps, servers who violate our terms and conditions and comes under scanner for AUP violations without any warnings given. ------------------------------------------------------------------
i am not running any IRC clients/servers. The only thing remotely close is a Userplane webchat app that i'm currently installing, and that is a private chat script. So even after all this emailing back and forth, my server is still suspended. Very lack of respect for their customers. I'm preparing to move my business elsewhere, i've actually been waiting for this... just needed a reason, and now i have one. Since they took over EpicVPS.. my original 80gb allocated storage have been taken away... somedays i see 50gb , other days i see 30gb.. i suppose they are overselling which is causing the fluctuation, even though they claimed its backup storage lol. Anyhow... has anyone encountered this, do they have the right to lock me out of my own server without notice?
I noticed that since their acquisition of EpicVPS, there has been alot of attitude from staff and a lot less user friendly. Network lags alot more now as well. All downhill.
There are two vbulletin forums hosted on my colocated, Q6600 Quad Core, 4GB RAM server and this process [php] <defunct> keeps spawning constantly and hogging the CPU resources.
Each process lasts a matter of seconds and dies but it keeps spawning itself constantly. Heres a screenshot:
[url]
Ive tried restarting Apache but it doesn't solve it.
I know there's been discussion regarding Foundry BigIron's and their capabilities of running L3 and L2 at the same time.
I have a friend who is running a BigIron 8000 and only pushing just over 100Megabits on it, however once every few hours he experiences a BGP flap and one of the CPU's maxes out. He is running both Layer 3 and Layer 2 on it.
When the issue occur's, new connections do not open, but currently opened connections continue to operate.
Is there a specific packet type that is causing this to happen? Does anyone have any insight? It is running the latest firmware.
Usually everything has been working fine with this .htaccess-file until today. There hasn't been any change on the system.
If you click on the hyperlink to the restricted area the login window appears where you need to type in your username and a password. After typing in these data the following message appears in the browser:
500 Internal Server Error
The server encountered an internal error or misconfigruation and was unable to complete your request. (…)
The apache error log file contains the following message:
Request exceeded the limit of 10 sub request nesting levels due to probable configuration error.
Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
The increase of the LimitInternalRecursion does not solve the problem. So I switched the LogLevel in the httpd.conf file from warn to debug and looked again on the entries of the error log.
The following appeared (I have replaced ip addresses, usernames and URL by xyz or <URL>) :
Code:
[error] [client xyz] mod_digest_apple: Client is using a nonce not issued by this server for this context:/rb/Vorlesung/WS12/Downloads/, referer: http:<URL>
Now I'm looking at our last cpu_exceeded_logs file and there is long list point to "/ramdisk/bin/php5" which I don't know much about it or don't know how to deal with that. would you please tell what exactly it means and what should I do to avoid it?
Example of my last cpu_exceeded_logs file:
Quote:
Mon Jul 6 00:34:50 2009: used 0.77 seconds of cpu time for /ramdisk/bin/php5 Mon Jul 6 00:34:50 2009: used 0.50 seconds of cpu time for /ramdisk/bin/php5 Mon Jul 6 00:34:50 2009: used 0.80 seconds of cpu time for /ramdisk/bin/php5 Mon Jul 6 00:34:50 2009: used 0.55 seconds of cpu time for /ramdisk/bin/php5
I can't find the cause of problem when look at /ramdisk/bin/php5.
