Help - Search - Members - Calendar
Full Version: CPU usage? Where is this coming from?
The Planet Forums > Control Panels > cPanel/WHM
cphan
18:01:42 up 270 days, 22:46, 1 user, load average: 14.38, 6.41, 4.05
215 processes: 196 sleeping, 15 running, 4 zombie, 0 stopped
CPU states: cpu user nice system irq softirq iowait idle
total 85.0% 0.0% 11.8% 1.3% 1.7% 0.0% 0.0%
Mem: 1026748k av, 1021108k used, 5640k free, 0k shrd, 9112k buff
949260k active, 12676k inactive
Swap: 2097136k av, 421792k used, 1675344k free 198048k cached

PID USER PRI NI SIZE RSS SHARE STAT %CPU %MEM TIME CPU COMMAND
13494 root 16 0 11088 2852 9876 S 75.8 0.2 855:52 0 httpd
29780 mysql 15 0 149M 20M 3756 S 7.2 2.0 10:04 0 mysqld
7193 root 17 0 5320 1416 4892 R 2.4 0.1 0:58 0 top
8 root 15 0 0 0 0 SW 0.7 0.0 57:51 0 kswapd0
5 root 5 -10 0 0 0 SW< 0.1 0.0 35:58 0 kblockd/0

I need help in trying to figure out why I'm having problems with CPU usaga all of a sudden.
cphan
[Sat Nov 6 17:58:26 2004] [error] [client 134.154.89.157] File does not exist: /home/******/public_html/music/wa2/WA2-26.sub
[Sat Nov 6 17:58:26 2004] [error] [client 134.154.89.157] File does not exist: /home/******/public_html/music/wa2/WA2-26.ssa
[Sat Nov 6 17:58:26 2004] [error] [client 134.154.89.157] File does not exist: /home/******/public_html/music/wa2/WA2-26.srt
[Sat Nov 6 17:58:25 2004] [error] [client 134.154.89.157] File does not exist: /home/******/public_html/music/wa2/WA2-26.smi
[Sat Nov 6 17:58:25 2004] [error] [client 134.154.89.157] File does not exist: /home/******/public_html/music/wa2/WA2-26.psb
[Sat Nov 6 17:58:25 2004] [error] [client 134.154.89.157] File does not exist: /home/******/public_html/music/wa2/WA2-26.idx
[Sat Nov 6 17:58:25 2004] [error] [client 134.154.89.157] File does not exist: /home/******/public_html/music/wa2/WA2-26.idx
[Sat Nov 6 17:58:25 2004] [error] [client 134.154.89.157] File does not exist: /home/******/public_html/music/wa2/WA2-26.ass
[Sat Nov 6 17:58:25 2004] [error] [client 134.154.89.157] File does not exist: /home/******/public_html/music/wa2/subtitles/WA2-26.sub
[Sat Nov 6 17:58:25 2004] [error] [client 134.154.89.157] File does not exist: /home/******/public_html/music/wa2/subtitles/WA2-26.ssa
[Sat Nov 6 17:58:25 2004] [error] [client 134.154.89.157] File does not exist: /home/******/public_html/music/wa2/subtitles/WA2-26.srt
[Sat Nov 6 17:58:25 2004] [error] [client 134.154.89.157] File does not exist: /home/******/public_html/music/wa2/subtitles/WA2-26.smi
[Sat Nov 6 17:58:25 2004] [error] [client 134.154.89.157] File does not exist: /home/******/public_html/music/wa2/subtitles/WA2-26.psb
[Sat Nov 6 17:58:25 2004] [error] [client 134.154.89.157] File does not exist: /home/******/public_html/music/wa2/subtitles/WA2-26.idx
[Sat Nov 6 17:58:25 2004] [error] [client 134.154.89.157] File does not exist: /home/******/public_html/music/wa2/subtitles/WA2-26.idx
[Sat Nov 6 17:58:25 2004] [error] [client 134.154.89.157] File does not exist: /home/******/public_html/music/wa2/subtitles/WA2-26.ass
[Sat Nov 6 17:58:25 2004] [error] [client 134.154.89.157] File does not exist: /home/******/public_html/music/wa2/subtitles/WA2-26.idx
[Sat Nov 6 17:58:24 2004] [error] [client 134.154.89.157] File does not exist: /home/******/public_html/music/wa2/subtitles/WA2-26.ass
[Sat Nov 6 17:58:24 2004] [error] [client 134.154.89.157] File does not exist: /home/******/public_html/music/wa2/subtitles/WA2-26.ssa
[Sat Nov 6 17:58:24 2004] [error] [client 134.154.89.157] File does not exist: /home/******/public_html/music/wa2/subtitles/WA2-26.psb
[Sat Nov 6 17:58:24 2004] [error] [client 134.154.89.157] File does not exist: /home/******/public_html/music/wa2/subtitles/WA2-26.smi
[Sat Nov 6 17:58:24 2004] [error] [client 134.154.89.157] File does not exist: /home/******/public_html/music/wa2/subtitles/WA2-26.sub
[Sat Nov 6 17:58:24 2004] [error] [client 134.154.89.157] File does not exist: /home/******/public_html/music/wa2/subtitles/WA2-26.srt
[Sat Nov 6 17:58:24 2004] [error] [client 134.154.89.157] File does not exist: /home/******/public_html/music/wa2/WA2-26.idx
[Sat Nov 6 17:58:24 2004] [error] [client 134.154.89.157] File does not exist: /home/******/public_html/music/wa2/WA2-26.ass
[Sat Nov 6 17:58:24 2004] [error] [client 134.154.89.157] File does not exist: /home/******/public_html/music/wa2/WA2-26.ssa
[Sat Nov 6 17:58:24 2004] [error] [client 134.154.89.157] File does not exist: /home/******/public_html/music/wa2/WA2-26.psb
[Sat Nov 6 17:58:24 2004] [error] [client 134.154.89.157] File does not exist: /home/******/public_html/music/wa2/WA2-26.smi
[Sat Nov 6 17:58:24 2004] [error] [client 134.154.89.157] File does not exist: /home/******/public_html/music/wa2/WA2-26.sub
[Sat Nov 6 17:58:24 2004] [error] [client 134.154.89.157] File does not exist: /home/******/public_html/music/wa2/WA2-26.srt
[Sat Nov 6 17:58:23 2004] [error] [client 134.154.89.157] File does not exist: /home/******/public_html/music/wa2/WA2-26.sub
[Sat Nov 6 17:58:23 2004] [error] [client 134.154.89.157] File does not exist: /home/******/public_html/music/wa2/WA2-26.ssa
[Sat Nov 6 17:58:23 2004] [error] [client 134.154.89.157] File does not exist: /home/******/public_html/music/wa2/WA2-26.srt
[Sat Nov 6 17:58:23 2004] [error] [client 134.154.89.157] File does not exist: /home/******/public_html/music/wa2/WA2-26.smi
[Sat Nov 6 17:58:23 2004] [error] [client 134.154.89.157] File does not exist: /home/******/public_html/music/wa2/WA2-26.psb
[Sat Nov 6 17:58:23 2004] [error] [client 134.154.89.157] File does not exist: /home/******/public_html/music/wa2/WA2-26.idx
[Sat Nov 6 17:58:23 2004] [error] [client 134.154.89.157] File does not exist: /home/******/public_html/music/wa2/WA2-26.idx
[Sat Nov 6 17:58:22 2004] [error] [client 134.154.89.157] File does not exist: /home/******/public_html/music/wa2/WA2-26.ass
[Sat Nov 6 17:58:22 2004] [error] [client 134.154.89.157] File does not exist: /home/******/public_html/music/wa2/subtitles/WA2-26.sub
[Sat Nov 6 17:58:22 2004] [error] [client 134.154.89.157] File does not exist: /home/******/public_html/music/wa2/subtitles/WA2-26.ssa
[Sat Nov 6 17:58:22 2004] [error] [client 134.154.89.157] File does not exist: /home/******/public_html/music/wa2/subtitles/WA2-26.srt
[Sat Nov 6 17:58:22 2004] [error] [client 134.154.89.157] File does not exist: /home/******/public_html/music/wa2/subtitles/WA2-26.smi
[Sat Nov 6 17:58:22 2004] [error] [client 134.154.89.157] File does not exist: /home/******/public_html/music/wa2/subtitles/WA2-26.psb
[Sat Nov 6 17:58:22 2004] [error] [client 134.154.89.157] File does not exist: /home/******/public_html/music/wa2/subtitles/WA2-26.idx
[Sat Nov 6 17:58:22 2004] [error] [client 134.154.89.157] File does not exist: /home/******/public_html/music/wa2/subtitles/WA2-26.idx
[Sat Nov 6 17:58:22 2004] [error] [client 134.154.89.157] File does not exist: /home/******/public_html/music/wa2/subtitles/WA2-26.ass

What the heck is this?
Altec
looks like someone or something is flooding the http server looking for a file, but as you can see, it isent there. Suspend the account and see if the cpu goes down, that or talk to the owner of that account. See what he got going on there.
Blue|Fusion
or temporarily add the IP to the deny rules in your firewall.
cphan
QUOTE (Altec)
looks like someone or something is flooding the http server looking for a file, but as you can see, it isent there. Suspend the account and see if the cpu goes down, that or talk to the owner of that account. See what he got going on there.


That's what I'm thinking that the http server is being flooded. However as you suggested, I can't suspend an account as I'm the only one on the account since it's my dedicated server for my site. I can't suspend myself. LOL

I have another account of the server and I also see other different IPs flooding and getting requests for files that aren't there.

What to do since I don't have clients and am the only one on the server?

QUOTE
Sat Nov  6 20:31:35 2004] [error] [client 66.217.176.35] File does not exist: /home/*****/public_html/ff7/<SCRIPT LANGUAGE=VBScript> on error resume next MM_FlashCanPlay = ( IsObject(CreateObject("ShockwaveFlash.ShockwaveFlash." & MM_contentVersion)))</SCRIPT> <a href="http://www.hypemakers.net/druaga-adv/go.php
[Sat Nov  6 20:31:29 2004] [error] [client 66.94.233.84] File does not exist: /home/*****/public_html/rpgworld/pe2-22.jpg
[Sat Nov  6 20:31:06 2004] [error] [client 210.245.68.171] File does not exist: /home/*****/public_html/wall/ffx/fantasymaiden-1-1.asp
[Sat Nov  6 20:30:38 2004] [error] [client 66.249.65.114] File does not exist: /home/*****/public_html/ff7/ff7music.html#
[Sat Nov  6 20:30:34 2004] [error] [client 209.234.154.197] File does not exist: /home/*****/public_html/ffx/<SCRIPT LANGUAGE=VBScript> on error resume next MM_FlashCanPlay = ( IsObject(CreateObject("ShockwaveFlash.ShockwaveFlash." & MM_contentVersion)))</SCRIPT> <a href="http://www.hypemakers.net/druaga-adv/go.php
[Sat Nov  6 20:29:33 2004] [error] [client 66.94.233.84] File does not exist: /home/*****/public_html/rpgworld/saiyuki-62.jpg
[Sat Nov  6 20:28:55 2004] [error] [client 66.196.91.35] File does not exist: /home/*****/public_html/robots.txt
[Sat Nov  6 20:28:30 2004] [error] [client 206.172.191.54] File does not exist: /home/*****/public_html/music/ffx/ff1039.smi
[Sat Nov  6 20:28:06 2004] [error] [client 206.172.191.54] File does not exist: /home/*****/public_html/music/ffx/ff1021.smi
[Sat Nov  6 20:25:35 2004] [error] [client 68.161.72.49] File does not exist: /home/*****/public_html/music/saga/sagabiolab.smi
[Sat Nov  6 20:25:06 2004] [error] [client 206.172.191.54] File does not exist: /home/*****/public_html/music/ff7/ff730.smi
[Sat Nov  6 20:25:04 2004] [error] [client 63.241.61.21] File does not exist: /home/*****/public_html/robots.txt
[Sat Nov  6 20:24:53 2004] [error] [client 68.108.200.201] File does not exist: /home/*****/public_html/movie/kh.wmv"
[Sat Nov  6 20:24:50 2004] [error] [client 68.108.200.201] File does not exist: /home/*****/public_html/movie/kh.wmv"
[Sat Nov  6 20:24:41 2004] [error] [client 68.108.200.201] File does not exist: /home/*****/public_html/movie/kh.wmv"
[Sat Nov  6 20:24:35 2004] [error] [client 206.172.191.54] File does not exist: /home/*****/public_html/music/ff7/ff736.smi
[Sat Nov  6 20:24:09 2004] [error] [client 68.8.32.86] File does not exist: /home/*****/public_html/music/ffx/ff108.smi
[Sat Nov  6 20:23:29 2004] [error] [client 66.94.233.84] File does not exist: /home/*****/public_html/rpgworld/saiyuki-6.jpg
[Sat Nov  6 20:22:14 2004] [error] [client 206.172.191.54] File does not exist: /home/*****/public_html/music/ff7/ff71.smi
[Sat Nov  6 20:21:38 2004] [error] [client 208.191.227.16] File does not exist: /home/*****/public_html/kh/kh.html
[Sat Nov  6 20:21:10 2004] [error] [client 24.69.255.237] File does not exist: /home/*****/public_html/music/ffx/ff108.mid<BR>
[Sat Nov  6 20:21:09 2004] [error] [client 24.69.255.245] File does not exist: /home/*****/public_html/music/ffx/ff108.mid<BR>
[Sat Nov  6 20:21:07 2004] [error] [client 65.33.112.111] File does not exist: /home/*****/public_html/newsimages/kh2/1/kh3-3.jpg
[Sat Nov  6 20:20:59 2004] [error] [client 24.69.255.237] File does not exist: /home/*****/public_html/music/ffx/ff108.mid<BR>
[Sat Nov  6 20:20:38 2004] [error] [client 206.172.191.54] File does not exist: /home/*****/public_html/music/ff7/ff77.smi
[Sat Nov  6 20:20:15 2004] [error] [client 67.35.67.33] File does not exist: /home/*****/public_html/kh/<SCRIPT LANGUAGE=VBScript> on error resume next MM_FlashCanPlay = ( IsObject(CreateObject("ShockwaveFlash.ShockwaveFlash." & MM_contentVersion)))</SCRIPT> <a href="http://www.hypemakers.net/druaga-adv/go.php
[Sat Nov  6 20:20:12 2004] [error] [client 206.172.191.54] File does not exist: /home/*****/public_html/music/ff7/ff717.smi
[Sat Nov  6 20:20:00 2004] [error] [client 24.84.224.89] File does not exist: /home/*****/public_html/ffx/ffxwall/ojouctan-1-2.jpg
[Sat Nov  6 20:19:49 2004] [error] [client 206.172.191.54] File does not exist: /home/*****/public_html/music/ff7/ff737.smi
[Sat Nov  6 20:19:48 2004] [error] [client 24.84.224.89] File does not exist: /home/*****/public_html/ffx/ffxwall/ojouctan-1-2.jpg
[Sat Nov  6 20:18:49 2004] [error] [client 66.94.233.84] File does not exist: /home/*****/public_html/Image1.gif
[Sat Nov  6 20:17:03 2004] [error] [client 66.249.65.114] File does not exist: /home/*****/public_html/robots.txt
[Sat Nov  6 20:16:41 2004] [error] [client 218.102.73.205] File does not exist: /home/*****/public_html/music/ffx/ff1010.smi
[Sat Nov  6 20:15:32 2004] [error] [client 64.12.117.5] File does not exist: /home/*****/public_html/misfanart/misfanarts5.html
[Sat Nov  6 20:15:00 2004] [error] [client 66.249.65.114] File does not exist: /home/*****/public_html/robots.txt
[Sat Nov  6 20:14:28 2004] [error] [client 66.94.233.84] File does not exist: /home/*****/public_html/equation6.jpg
[Sat Nov  6 20:12:27 2004] [error] [client 66.94.233.84] File does not exist: /home/*****/public_html/rpgworld/matrix2reviewlogo.jpg
[Sat Nov  6 20:11:07 2004] [error] [client 66.94.233.84] File does not exist: /home/*****/public_html/rpgworld/saiyuki-83.jpg
[Sat Nov  6 20:10:47 2004] [error] [client 66.94.233.84] File does not exist: /home/*****/public_html/rpgworld/vb1.jpg
[Sat Nov  6 20:09:47 2004] [error] [client 66.94.233.84] File does not exist: /home/*****/public_html/rpgworld/tod2-29.jpg
[Sat Nov  6 20:09:34 2004] [error] [client 24.44.244.42] File does not exist: /home/*****/public_html/movie/kh.wmv"
[Sat Nov  6 20:07:18 2004] [error] [client 4.226.27.201] File does not exist: /home/*****/public_html/ fanarts/ff8/hellmay-6.jpg
[Sat Nov  6 20:03:46 2004] [error] [client 66.94.233.84] File does not exist: /home/*****/public_html/rpgworld/tof37.jpg
[Sat Nov  6 20:02:46 2004] [error] [client 66.94.233.84] File does not exist: /home/*****/public_html/rpgworld/tof4.jpg
[Sat Nov  6 20:02:07 2004] [error] [client 66.94.233.84] File does not exist: /home/*****/public_html/rpgworld/ct11.jpg
[Sat Nov  6 19:59:25 2004] [error] [client 66.94.233.84] File does not exist: /home/*****/public_html/rpgworld/ct112.jpg
[Sat Nov  6 19:58:45 2004] [error] [client 12.218.25.14] File does not exist: /home/*****/public_html/kh/<SCRIPT LANGUAGE=VBScript> on error resume next MM_FlashCanPlay = ( IsObject(CreateObject("ShockwaveFlash.ShockwaveFlash." & MM_contentVersion)))</SCRIPT> <a href="http://www.hypemakers.net/druaga-adv/go.php
[Sat Nov  6 19:58:25 2004] [error] [client 66.94.233.84] File does not exist: /home/*****/public_html/rpgworld/tof2.jpg
[Sat Nov  6 19:58:24 2004] [error] [client 68.33.234.45] File does not exist: /home/*****/public_html/music/kh/kh-20.smi
[Sat Nov  6 19:57:26 2004] [error] [client 70.17.68.158] File does not exist: /home/*****/public_html/movie/ffx.wmv"
[Sat Nov  6 19:57:23 2004] [error] [client 70.17.68.158] File does not exist: /home/*****/public_html/movie/ffx.wmv"
[Sat Nov  6 19:56:37 2004] [error] [client 62.64.171.231] File does not exist: /home/*****/public_html/wall/ff6/xiaolan-1-2.jpg
[Sat Nov  6 19:56:10 2004] [error] [client 70.17.68.158] File does not exist: /home/*****/public_html/movie/ffx.wmv"
[Sat Nov  6 19:56:10 2004] [error] [client 62.64.171.231] File does not exist: /home/*****/public_html/wall/ff6/xiaolan-1-2.jpg
[Sat Nov  6 19:55:39 2004] [error] [client 70.17.68.158] File does not exist: /home/*****/public_html/movie/ffx.wmv"
[Sat Nov  6 19:54:24 2004] [error] [client 66.94.233.84] File does not exist: /home/*****/public_html/rpgworld/arc4-77.jpg
[Sat Nov  6 19:53:44 2004] [error] [client 70.17.68.158] File does not exist: /home/*****/public_html/movie/ffx.wmv"
[Sat Nov  6 19:53:12 2004] [error] [client 70.17.68.158] File does not exist: /home/*****/public_html/movie/ffx.wmv"
[Sat Nov  6 19:53:09 2004] [error] [client 70.17.68.158] File does not exist: /home/*****/public_html/movie/ffx.wmv"


There are too many IPs to be banning. I could try but not effective in the long run.
bigpy2003
A wrote a php script that stopped these types of attacks. What they do is fill up the maximum amount of connections apache allows, causing apache to use all the resources. Atleast, that's what happened in my case. The script then uses a cron and runs every 5 minutes or so to check and see how many times ip's are connected. If ip's are connected more than x amount of times, it adds their ip address to my iptables firewall rules and I don't bother with it anymore. If anyone is interested in it, let me know, I'll consider putting it up for download. It will only work on machines that have iptables.
klaude
Start logging HTTP referrers and see where these users are coming from. You may be linked to from somewhere else.
djmerlyn
Can't you just copy those IP's and ban them in Cpanel?
Altec
QUOTE (djmerlyn)
Can't you just copy those IP's and ban them in Cpanel?


If im not mistaken, that will only ban that IP from the site itself, not the whole server.
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.
Invision Power Board © 2001-2009 Invision Power Services, Inc.