Just got off the phone with tech support and they noticed that someone was trying to gain brute force entry to our VPS. We want to view our logs but can only see the last 250 lines or so when using this command inside putty:
tail -9000 /var/log/messages
How do we see / copy the entire 9000 entries to view in a text editor? Any tips would be great. I am a newbie at this.
is it possiable to delete these files in the server access_logs and errors_logs
View 1 Replies View Relatedim using apf firewall and wonder if someone could provide me a list of turkish ips.
View 13 Replies View RelatedI figure while I am twiddling my thumbs here waiting for my host to tell me what the heck happened for the second time in two or three months why they have to do an entire VPS hard restart, which of course causes another hour of fck delays, that I'd ask some of the more skilled and experience folks here, how?
Just before it happened, as I was watching, the load shotup over 1, 2, 4, 20, 30 boom. (I opened a ticket at 4)
Shouldn't virtuozzo always guarantee a certain amount of cpu and bandwidth to the node root? Why do they have to hard reboot and not access it directly and stop the badly behaving vps? Better yet, why isn't the badly behaving vps stopped automatically by virtuozzo?
(oh and am I an idiot for putting up with over two hours of downtime?)
I always use Apache and it's easy to redidrect an entire domain in the htaccess.
Code:
RewriteCond %{HTTP_HOST} ^www.domain1.com$
RewriteRule ^(.*)$ [url]$1 [R=301,L]
For a site I'm working on I need to achieve the same thing with IIS but have no idea how to and the technician claims it can't be done. Surely, that's not the case. Any ideas?
By the way I want the exact same effect as the above not just a generic redirect that sends everthing to the home page of the new domain.
I have come across an issue where traffic from India is hurting my business. What I have is a number of job boards. Realistically, the only issue I am having is with IT and Engineering positions being applied for heavily by people in India. Since my customer base is all in the USA, I would like to just block India.
While I know this is easy with Apache using a .htaccess file, I am using IIS on server 2007. Does anyone have any idea on how to do this easily with the large number of IPs that India uses?
how to ban an entire top-level domain? For example ban everyone from Russia by coming from the .ru domain? Or everyone from Lithuania by somehow banning everyone coming from .It ip address.
I've had some people from those places try to hack my site and am fed up with it. So I want to ban those two entire countries for the time being using cPanel X's "IP Deny Manager".
By the way I am not a technical person. Just your every day person running a site.
we dont host our own website, but recenty our server crashed, and our hosting provider was supposed to be backing things up. They told us that the entire server crashed and the backups were on the same server so we lost everthing. we actually did end up getting evertying back but it took nearly a week to get back online. they said they are now backing up everthing in a remote location so this wont happen again, but we dont want to put this in their hands anymore, we didnt even get everything back .htaccess, hidden files, subdomains were not backup up and lost. So we want to do our own backing up.
Is there some thing I can set up as a cron task to weekly automatically backup every single file on the server, and the database?
We think this would be very beinificial to us as we lost alot of money from this ordeal and we do not want it to happen again.
rsync -avz -e ssh --delete --exclude=/home/server/logs/
I want to exclude the logs directory from being transferred, that doesn't work.
The backup program (cpbackup) that comes with WHM/Cpanel is not ideal for our current situation. We have lots of third party applications installed on our server along with many customized configuration files. We need a solution that will backup everything and allow for fairly simple restoration.
How viable is rsync for full server backups? Can it handle 100 GB of data?
More importantly, how would you restore the backup to a new server? If the new server already has an OS the restored files would break the system, right?
Yet another question for you all. As part of my remit I need to work out power usage across the DC. It's not huge. Approx 300 servers across 50 physical servers (BL7000c with BL46x series blades) as well as several sans/disk arrays (DotHill, HDC, HP MSA) and appliances, Ciscos, POE 8xxx series procurves etc)
All these are racked up and being fed from 32Amp APC PDUs (without monitoring). It's three phase in, single phase out. We can't really run 3 phase because I am not allowed to run it due to the 6 foot rule.
Our UPS is rated at 30KVA but we are running it at the max at around 24KVA.
What I need to do, is work out on an individual basis how much power each one draws, ideally without a power down. The reason, as well as identifying the power hogs (such as several SUN V series servers), is to reduce the overall carbon footprint and energy costs.
am hosting with servage most such hosts dont provide backup for ur files in case ur moving to other host so i was wondering if i can manually through FTP download my enitre directory including all files (html, jpg, PHP SCRIPTS) and manually reupload them onto the other host i will move to soon will that actually work
and for MySql databases i have created a PROPER backups via their auto backup system
they only lack backup for the files itself only, MySql is fine
will restoring the MySql databases but via a different control panel (CPanel) will it possible?
Also does anyone have a good resource site with ssh commands and stuff?
View 3 Replies View Relatedto get a copy of their entire site onto our servers.
The problem is that they have no backups, and their current host has denied them access to their account. (It's a long story.)
Rather then try and fight with their old host, I wonder if it's easier to just run some kind of "website copy" program and grab a copy of all pages and images, linked files, etc..
Their current website pages are served using an ASP database application, but the copy they need only has to work. It doesn't need to be dynamic, etc... as long as all the pages are there it's good.
I'm contemplating creating a website that could store extremely sensitivity information. It's more than likely that a MySQL database would house this information.
My question is. Does anybody have any experience when it comes to encrypting an entire server disk?
I've searched online with disappointing results.
I renamed a folder. How I can write a 301 redirect in .htaccess to redirect every file in that folder to the new folder?
View 14 Replies View RelatedI have a system that need to be formated, before i do that i want to backup everything (etc,bin,tmp...) to new hard drive (external hard drive) which connected to system by firewire. Is there any command that i can copy entire the hdd to new hdd ? I used to use this "cp -R folder folder " but it takes too long. Any suggestion?
View 4 Replies View Relatedproduction looking to use latest version of apache from apache lounge:
Apache 2.4.7 Win64
Which version of PHP is recommend?
Which version of WinCache is recommended?
Which version of mysql is recommended?
I've looked into WinCache how to install it and hook it up to php, but i'm guessing you add the extensions in the php.ini?
A single website is returning 503 to every request - it's a wordpress site - and we have a lot of those, none of the others are returning the same errors, so this is quite odd to me:
141.101.70.247 - - [03/Sep/2014:08:29:36 -0600] "GET /apple-touch-icon.png HTTP/1.1" 503 1330 "-"
"MobileSafari/9537.53 CFNetwork/672.1.15 Darwin/14.0.0"
173.245.50.138 - - [03/Sep/2014:08:36:18 -0600] "GET /tag/rohloff/ HTTP/1.1" 503 1330 "-"
"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
108.162.216.158 - - [03/Sep/2014:08:50:05 -0600] "GET / HTTP/1.1" 503 1330 "-"
"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Firefox/31.0"
I do see some ModSecurity warnings from last night:
[Tue Sep 02 23:07:58 2014] [error] [client 141.101.98.8] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "WEBSITE.co.uk"] [uri "/xmlrpc.php"] [unique_id "VAaiLrhfKCIAAAvNboMAAAAP"]
[Tue Sep 02 23:07:58 2014] [error] [client 141.101.98.8] ModSecurity: Access denied with code 400 (phase 2).
[Code] .....
but no errors in the site error_log since that last one - all I see now is 503 errors.
How to proceed with debugging the cause of this?
We are resellers from ResellerZoom / ModVPS, at this moment we have about 10 accounts (8 reseller accounts and 2 VPS).
The problem starts some days ago, when they do a servers cage movement having us offline for about 8 hours at various servers.
Well, we have experienced various connectivity problems with them, and this was a major problem but we waited fine.
Yesterday. we receive an e-mail from a VPS client telling us what their sites are all showing codification problems. We opened a ticket with ModVPS and just wait their reply.
They told us that we should contact the script developer about the errors, but the problem appears at a lot of different scripts hosted on the same cPanel account. Because that, all appears to be a hacker attack.
Then, we consider that the better solution is to restore a full VPS backup, and we communicate this to ModVPS staff. And... Surprise! ModVPS don't have ANY backup for our VPS. Anything! That was one of my pre-sales question, and at that time they warrantied us a weekly backup.
We are still trying to get contact with them, but at this moment has passed 17 hours from their last answer and we are still waiting for it.
We needed to delete a domain which has been terminated by a customer. This customer has about 40 domains linked to them.
When we deleted the domain, it deleted the entire customer!
I'm trying to find the support option on your site but I can't find it, there's just no support option for Plesk anymore.
Upgrading was started not half an hour ago from the time this post goes out, all went well until the MySQL was started up. At this point it is screaming at me because it cannot access it due to a missing password. This shouldn't be to much of an issue, as you just follow this post here, [URL] .... However.. when I did that this happened.
Code:
/usr/local/psa/bin/admin --show-password
PHP Notice: Undefined index: PARAMETERS; File: /usr/local/psa/admin/plib/CommonPanel/Exception.php, Line: 266
SQLSTATE[HY000] [1045] Access denied for user 'admin'@'localhost' (using password: YES)
I rent through OVH, so we don't get support access or anything. We just get a 15 site license and that's it so I don't know who to turn to for this.. I haven't ever touched anything in regards to SQL and the likes, all I did was click the upgrade button and this failed me. And now I've pretty much lost everything until this is resolved.
I want to move the entire contents of a directory tree to another directory.
So for example we may have a directory with 15 directories inside, each directory contains files itself. I want to copy all the files from the directory tree into another directory located somewhere else one the file system. I want only the "files" to end up in the other directory and not the file structure too.
Im running CENTOS latest version.
The vps has
256MB(512 burstable) of memory
10GB of HardDisk space
Using Lighttpd, PHP and MySQL
ControlPanel is LXAdmin
top - 05:59:24 up 36 min, 1 user, load average: 0.42, 0.60, 0.62
Tasks: 31 total, 1 running, 29 sleeping, 0 stopped, 1 zombie
Cpu(s): 0.0%us, 0.0%sy, 0.0%ni,100.0%id, 0.0%wa, 0.0%hi, 0.0%si, 0.0%st
Mem: 1048576k total, 55216k used, 993360k free, 0k buffers
Swap: 0k total, 0k used, 0k free, 0k cached
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
1 root 15 0 1964 660 568 S 0 0.1 0:00.46 init
3922 root 15 0 7824 2104 1720 S 0 0.2 0:00.01 sshd
9868 root 15 0 2352 1272 1064 S 0 0.1 0:00.00 bash
11693 root 18 0 2104 1020 820 R 0 0.1 0:00.10 top
17861 root 16 0 1632 620 520 S 0 0.1 0:00.00 syslogd
17918 dbus 25 0 2636 468 328 S 0 0.0 0:00.00 dbus-daemon
17955 root 18 0 5116 956 644 S 0 0.1 0:00.00 sshd
18093 tinydns 18 0 1544 304 252 S 0 0.0 0:00.00 tinydns
18106 root 23 0 1596 372 308 S 0 0.0 0:00.00 tcpserver
18131 apache 18 0 8452 4276 812 S 0 0.4 0:02.27 lighttpd
18132 admin 15 0 38704 24m 6652 S 0 2.4 2:58.37 php-cgi
18224 addons 20 0 22024 8456 4572 S 0 0.8 0:00.01 php-cgi
18278 root 15 0 2348 1112 968 S 0 0.1 0:00.00 sh
19519 root 15 0 4032 1432 1172 S 0 0.1 0:00.00 lxadmin.exe
19557 root 17 0 2608 884 712 S 0 0.1 0:00.00 xinetd
19594 lxlabs 18 0 5364 2220 1160 S 0 0.2 0:00.13 lxadmin.httpd
19879 root 18 0 2344 1124 964 S 0 0.1 0:00.00 mysqld_safe
19921 mysql 15 0 13688 5240 3904 S 0 0.5 0:17.51 mysqld
20250 qmails 15 0 1804 476 372 S 0 0.0 0:00.00 qmail-send
20256 qmaill 18 0 1564 472 404 S 0 0.0 0:00.00 splogger
20260 root 22 0 1576 344 268 S 0 0.0 0:00.00 qmail-lspawn
20261 qmailr 15 0 1572 372 296 S 0 0.0 0:00.00 qmail-rspawn
20275 qmailq 18 0 1560 352 284 S 0 0.0 0:00.00 qmail-clean
21824 root 18 0 6200 1296 960 S 0 0.1 0:00.00 authdaemond
21828 root 15 0 1596 376 312 S 0 0.0 0:00.00 tcpserver
21834 root 25 0 1592 368 308 S 0 0.0 0:00.00 tcpserver
21838 root 18 0 6200 460 124 S 0 0.0 0:00.00 authdaemond
21842 root 18 0 1592 372 312 S 0 0.0 0:00.00 tcpserver
21861 root 25 0 1592 368 308 S 0 0.0 0:00.00 tcpserver
21890 root 18 0 3184 1108 576 S 0 0.1 0:00.00 crond
I just got an email from my vps saying that a BFD attack was stopped and the ip was banned after 40 failed attempts of logging into ftpdpro. I logged in and started looking around and I noticed that in my apf log file there was:
Code:
Jan 15 00:54:07 s1 apf(22290): {glob} firewall initalized
Jan 15 00:54:07 s1 apf(22290): {glob} fast load snapshot saved
Jan 15 00:58:06 s1 apf(32425): {glob} uptime less than 5 minutes, going full load
Jan 15 00:58:06 s1 apf(32425): {glob} activating firewall
Jan 15 00:58:06 s1 apf(32500): {glob} unable to load iptables module (ip_tables), aborting.
Jan 15 00:58:06 s1 apf(32425): {glob} firewall initalized
Jan 15 00:58:06 s1 apf(32425): {glob} fast load snapshot saved
Jan 15 01:00:04 s1 apf(3950): {glob} uptime less than 5 minutes, going full load
My concern is that it says "unable to load iptables module (ip_tables), aborting.
is there anything that logs server load and what processes have caused any spikes?
one of my servers keeps going down under high load, well it seems to lock up and the noc has to reboot, but ofcourse the techs can't diagnose a problem after as it runs fine and when i send them a ticket it's because the server can't be reached at all and then they can't diagnose it either
I moved a domain of mine from one of my CentOS servers on my SoHo LAN, to one of my CentOS cPanel/WHM servers. Since the SoHo machine had been handling this domain's mail for almost 2 years (300+ mb of mail), I decided to continue running it from home.
The Apache daemon was stopped on said SoHo box following DNS propagation to the cPanel machine, but Apache was automatically started again after having to reboot the SoHo server. Before I got a chance to kill Apache, I got some weird entries showin' up in the access_logs.
www.####.com ip54520165.adsl-surfen.hetnet.nl - - [15/Apr/2009:23:30:20 -0700] "CONNECT 205.188.179.233:443 HTTP/1.0" 302 286 "-" "-"
www.####.com ip54520165.adsl-surfen.hetnet.nl - - [15/Apr/2009:23:37:05 -0700] "CONNECT 205.188.176.230:443 HTTP/1.0" 302 286 "-" "-"
www.####.com ip54520165.adsl-surfen.hetnet.nl - - [15/Apr/2009:23:43:30 -0700] "CONNECT 205.188.153.99:443 HTTP/1.0" 302 285 "-" "-"
www.####.com ip54520165.adsl-surfen.hetnet.nl - - [16/Apr/2009:00:10:01 -0700] "CONNECT 205.188.153.100:443 HTTP/1.0" 302 286 "-" "-"
I ask simply because I don't recall seeing a "CONNECT" entry in my logs before, and I've been at this for awhile. That or I've just not paid any attention. And what's with the SSL port?
I guess I'm just a little confused as to what was trying to be accomplished here...it hasn't returned since.
Can we delete sql logs ? as it occupies 2.97gb
All the log is under a single file, occupying huge amount of space on our server
use lxadmin for the vps
we are unable to even open up the file, as we have almost run out of space, we would atleast like to delete around old logs older than a month, this logs are from 3 months, so please help us in solving this problem
if we delete the sql log, will a new log be created automatically or it gives an error?
if redhat keeps a log of ip addresses which have logged into the server.
Ive got a machine that one of my staff logged into today with the root account, and im wondering if I can find out the ip address of the user who logged in as root?
How can I check the logs to see if there are any errors? Can I check this via WHM?
View 6 Replies View Related