High CPU Usage

[clivejo]

I got a warning this morning from one of my hosting accounts that I was over my 10% CPU limit. On investigation I'm using 54% CPU, from one domain name hosting a wiki !!!

The strange thing is its being hammered by one IP address - 66.40.30.169 which appears to be owned by LiquidNet Ltd. What on earth is going on?

[clivejo]

Day CPU Time Execution Time CPU Usage Memory Processes
1 453.07s 147950.42s 1.31% 2.66 MB 1811
2 463.06s 147462.12s 1.34% 2.58 MB 1727
3 353.01s 126810.09s 1.02% 2.60 MB 1497
4 362.39s 130857.29s 1.05% 2.62 MB 1537
5 548.81s 132093.68s 1.59% 2.58 MB 1488
6 437.56s 138156.65s 1.27% 2.67 MB 1581
7 412.79s 136039.48s 1.19% 2.67 MB 1568
8 697.55s 149008.52s 2.02% 2.43 MB 1869
9 330.72s 123781.86s 0.96% 2.64 MB 1429
10 379.25s 131758.90s 1.10% 2.58 MB 1492
11 7925.59s 157914.51s 22.93% 2.71 MB 1864

[yav0r]

You should open a support ticket from the account affected so our technicians can have a look.

[clivejo]

Morning yav0r,

I have done, first thing I did The advice has been that its a rogue script on my account. I copied the entire site into a new folder the idea was to break the loop in the rogue script by feeding it 404 errors. However, the IP address is still hammering the site and generating file not found errors in my error logs

The IP is trying numerous URL's at least once a second and has not slowed down or stopped since I moved the site. Its got me stumped

[yav0r]

The execution time you provided from the logs has nothing to do with any IPs at all. And such execution time is just WOW!
I can't possibly know what you are running in there but with such execution time its bound to overload even a semi-dedicated package.

As far as I understood you moved the script from one folder to another (or at least that is what I have been told so don't shoot the messenger) so probably the script can't connect to the database script and thus filling the log file.

In any case can I have the ticket number please I think I have an idea but i need to check it before speaking

[clivejo]

I've PM'ed you the support ticket number.

its a MediaWiki based install, all dynamically generated pages with pictures and diagrams thrown in for good luck! Normally CPU usage averages 1-2% and that's being trawled by Search Engines, so this IP is fairly whacking at the resources!

The CPU has fallen since I moved the site, 404 pages are a lot easier to serve than full dynamic so at least thats one of the problems solved. Just keen to find out why and how!

[clivejo]

According to my CPU logs it started between 0000 and 0600 on the 11th Oct, I only got the email this morning.

On another note, is it possible to keep backup access log copies? For example use a CRON job to take a copy or email it to myself?

[clivejo]

Well thanks to RSP tech support we got to the bottom of it. It wasn't a hacking attempt after all, but at least I got the installation all up to date (something I've been putting off)

When a domain or hosting account is about to expire we "cache" all content of it or simply put we back it up as we do on 24 hours basis. Apparently the IP was where the actual script was coming from. It was "hanging" instead of stopping after it had cached/backed up the content.
Thanks to your report we managed to get a hold of the rouge script which was causing the problem in general and for your account in particular.

The issue has been resolved and hopefully we will not hear from it ever again .

Thanks for reporting this!

I think because the site is all generated on the fly and there are a lot of pages (history, loops, pages hyper-linking back to themselves etc) the script got confused and was going around and around in circles trying to cache the site.

A big thank-you to the support guys for being so quick and responsive to all my queries.