cpanel mail??

thiva7 · 2011-05-25 19:03:14

i get this mail...what is?

IMPORTANT: Do not ignore this email.
This is cPanel stats runner on server1.domain.com!
While processing the log files for user bettipsc, the cpu has been
maxed out for more than a 6 hour period. The current load/uptime line on the server at the time of
this email is
12:10:02 up 10 days, 4:13, 0 users, load average: 6.02, 6.02, 5.69
You should check the server to see why the load is so high and take
steps to lower the load. If you want stats to continue to run even with a high load; Edit
/var/cpanel/cpanel.config and change extracpus to a number larger then 0 (run
/usr/local/cpanel/startup afterwards to pickup the changes).

Coscast · 2011-05-25 21:01:21

That basically means, that your server has too much work
Your Servers CPU has/had 100% load for more than six hours.

Is that a dedicated or a VPS ?

thiva7 · 2011-05-25 21:36:36

dedicated

mfeat50 · 2011-05-25 23:26:36

what kind of traffic are you getting??

Pikeypete · 2011-05-26 00:22:54

You're not getting much traffic, you have a low end processor.
Still shouldn't be running at 100% though. Run the 'top' command from putty and see what's using the resources.

Last edited by Pikeypete (2011-05-26 00:23:19)

thiva7 · 2011-05-26 00:35:18

PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND

8130 root 16 0 4180 2860 788 R 9.6 0.1 0:01.61 top
2347 root 15 0 3676 832 488 S 1.2 0.0 0:21.19 sshd
8192 root 15 0 3856 1656 1152 S 1.2 0.1 0:00.04 sshd
8193 root 15 0 3856 1656 1152 S 1.2 0.1 0:00.04 sshd
8194 root 15 0 3856 1656 1152 S 1.2 0.1 0:00.04 sshd
8201 root 15 0 3856 1656 1152 S 1.2 0.1 0:00.04 sshd
8202 root 15 0 3856 1656 1152 S 1.2 0.1 0:00.04 sshd
8203 root 15 0 3856 1656 1152 S 1.2 0.1 0:00.04 sshd
8185 root 15 0 3856 1656 1152 S 1.2 0.1 0:00.04 sshd
8186 root 15 0 3856 1656 1152 S 1.2 0.1 0:00.04 sshd
8188 root 15 0 3856 1656 1152 S 1.2 0.1 0:00.04 sshd
8190 root 15 0 3856 1564 1060 S 1.2 0.1 0:00.04 sshd
8169 root 15 0 3856 1656 1152 S 0.9 0.1 0:00.03 sshd
8171 root 15 0 3856 1656 1152 S 0.9 0.1 0:00.03 sshd
8175 root 15 0 3856 1656 1152 S 0.9 0.1 0:00.03 sshd
8178 root 15 0 3856 1656 1152 S 0.9 0.1 0:00.03 sshd
8179 root 15 0 3856 1656 1152 S 0.9 0.1 0:00.03 sshd

Last edited by thiva7 (2011-05-26 00:35:55)

symtab · 2011-05-26 06:53:49

There is something wrong with your top output. You have sshd opened like XX times, maybe someone tries to brute force ssh or something.

thiva7 · 2011-05-26 10:57:59

from my whm i go

Main >> System Health >> Show Current Running Processes

2347 (sshd) /usr/sbin/sshd.gzmsls/2.6.18 (deleted) / /usr/sbin/sshd

that u mean???

MS_DA · 2011-05-26 12:19:40

I think he meant pid id 8130 root till 8179 root... There are 17 sshd root processes like if u connected 17 times at the same time...

Last edited by MS_DA (2011-05-26 12:20:24)

thiva7 · 2011-05-26 12:40:12

now i run "top" again i have this result

19487 root 16 0 3088 1824 788 R 4.1 0.1 0:00.68 top
19511 root 15 0 3856 1656 1152 S 1.3 0.1 0:00.04 sshd
19509 root 15 0 3856 1656 1152 S 1.0 0.1 0:00.03 sshd
19510 root 15 0 3856 1656 1152 S 1.0 0.1 0:00.03 sshd
19512 root 15 0 3856 1656 1152 S 1.0 0.1 0:00.03 sshd
19513 root 15 0 3856 1548 1044 S 1.0 0.1 0:00.03 sshd
2347 root 15 0 3676 832 488 S 0.6 0.0 1:34.21 sshd
461 root 10 -5 0 0 0 S 0.3 0.0 7:39.33 kjournald
19506 root 15 0 3856 1656 1152 S 0.3 0.1 0:00.04 sshd
19508 root 15 0 3856 1656 1152 S 0.3 0.1 0:00.04 sshd
1 root 15 0 2160 648 556 S 0.0 0.0 0:04.90 init
2 root RT -5 0 0 0 S 0.0 0.0 0:00.91 migration/0
3 root 34 19 0 0 0 S 0.0 0.0 0:00.09 ksoftirqd/0
4 root RT -5 0 0 0 S 0.0 0.0 0:00.00 watchdog/0
5 root RT -5 0 0 0 S 0.0 0.0 0:01.74 migration/1
6 root 34 19 0 0 0 S 0.0 0.0 0:00.07 ksoftirqd/1
7 root RT -5 0 0 0 S 0.0 0.0 0:00.00 watchdog/1

thiva7 · 2011-05-26 12:41:44

ok i do not understund so may thing about server managment so what i should do now?

Pikeypete · 2011-05-26 13:10:17

If it persists make a note of the time it's happening and check it against your IP logs, you shouldn't have that many sshd processes running. Like Adrian stated, it's possibly a flood/brute force, you're getting too many requests.

Last edited by Pikeypete (2011-05-26 13:13:56)

Coscast · 2011-05-26 13:14:56

/var/log/auth.log
/var/log/login.log
/var/log/secure

Depends on your system, but this would be good places to look in.

thiva7 · 2011-05-26 13:24:28

Coscast wrote:

/var/log/auth.log
/var/log/login.log
/var/log/secure
Depends on your system, but this would be good places to look in.

i dont have this files

/var/log/auth.log
/var/log/login.log

but on this
/var/log/secure i have this lines

May 22 09:16:42 server1 sshd[26717]: Accepted password for root from 46.102.58.112 port 1980 ssh2
May 22 09:16:42 server1 sshd[26717]: pam_unix(sshd:session): session opened for user root by (uid=0)
May 22 09:19:34 server1 sshd[26864]: Bad protocol version identification '' from UNKNOWN
May 22 10:48:59 server1 sshd[26717]: pam_unix(sshd:session): session closed for user root
May 22 15:12:21 server1 Cp-Wrap[17575]: Pushing "511 UPDATEPRIVS" to '/usr/local/cpanel/bin/cpmysqladmin' for UID: 511
May 22 15:12:21 server1 Cp-Wrap[17581]: Pushing "511 UPDATEPRIVS" to '/usr/local/cpanel/bin/cpmysqladmin' for UID: 511
May 22 15:12:22 server1 Cp-Wrap[17575]: CP-Wrapper terminated without error
May 22 15:12:22 server1 Cp-Wrap[17581]: CP-Wrapper terminated without error
May 22 15:45:45 server1 Cp-Wrap[19300]: Pushing "511 UPDATEPRIVS" to '/usr/local/cpanel/bin/cpmysqladmin' for UID: 511
May 22 15:45:46 server1 Cp-Wrap[19300]: CP-Wrapper terminated without error

symtab · 2011-05-26 16:54:33

i recommend you contact your hosting company and ask them to clean your server. Your ssh is on porn 22 (from what i remember), you should not have another ssh daemn on porn 1980. Also this should not appear: 2347 (sshd) /usr/sbin/sshd.gzmsls/2.6.18 (deleted) / /usr/sbin/sshd

thiva7 · 2011-05-27 00:30:37

host answer :

It looks like your system is overloaded. If a reboot does not fix the issue and you can not resolve the issue then we can reinstall the OS, would you like that?

thiva7 · 2011-05-27 00:39:14

after reboot i get this result

PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
3786 root 15 0 2428 1028 788 R 0.3 0.0 0:00.03 top
1 root 15 0 2160 640 556 S 0.0 0.0 0:00.94 init
2 root RT -5 0 0 0 S 0.0 0.0 0:00.00 migration/0
3 root 34 19 0 0 0 S 0.0 0.0 0:00.00 ksoftirqd/0
4 root RT -5 0 0 0 S 0.0 0.0 0:00.00 watchdog/0
5 root RT -5 0 0 0 S 0.0 0.0 0:00.00 migration/1
6 root 39 19 0 0 0 S 0.0 0.0 0:00.00 ksoftirqd/1
7 root RT -5 0 0 0 S 0.0 0.0 0:00.00 watchdog/1
8 root RT -5 0 0 0 S 0.0 0.0 0:00.00 migration/2
9 root 34 19 0 0 0 S 0.0 0.0 0:00.00 ksoftirqd/2
10 root RT -5 0 0 0 S 0.0 0.0 0:00.00 watchdog/2
11 root RT -5 0 0 0 S 0.0 0.0 0:00.00 migration/3
12 root 34 19 0 0 0 S 0.0 0.0 0:00.00 ksoftirqd/3
13 root RT -5 0 0 0 S 0.0 0.0 0:00.00 watchdog/3
14 root 10 -5 0 0 0 S 0.0 0.0 0:00.00 events/0
15 root 10 -5 0 0 0 S 0.0 0.0 0:00.00 events/1
16 root 10 -5 0 0 0 S 0.0 0.0 0:00.00 events/2

ok now??

thiva7 · 2011-05-27 01:43:40

up again

PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND

5423 root 25 0 3860 1716 1188 R 99.9 0.1 10:15.47 sshd

Last edited by thiva7 (2011-05-27 01:44:18)

Pikeypete · 2011-05-27 11:40:36

thiva7 wrote:

up again
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
5423 root 25 0 3860 1716 1188 R 99.9 0.1 10:15.47 sshd

If you're running to that limit after the reboot just get your host to clean up the server as you don't have much knowledge in it.
You won't lose anything, just make a backup prior to the cleanup.
You can't operate any site running at 99% CPU usage. Not only that, chances are your host will suspend the server.

Last edited by Pikeypete (2011-05-27 11:46:02)

thiva7 · 2011-05-27 12:03:38

i will change host

this server have all time problems.....i have get for 5 month now 3 times disk error...they lost my files 2 times . i just stay on this host becuse i dont have the money to have better server .

so i find on VPS server and i thing i will move there my site

thiva7 · 2011-05-27 13:50:05

what u thing about that?? can work for me? VZ2 PLAN

Last edited by thiva7 (2011-05-27 13:50:42)

symtab · 2011-05-27 14:53:44

The RAM is kinda low but it could work as long as you dont do video conversions.

Pikeypete · 2011-05-27 15:02:45

Even without the video conversions, you'd need at least 4GB on the server in my opinion.
Most of the 2GB they are offering will be eaten just by the operating system.

Last edited by Pikeypete (2011-05-27 15:05:49)

symtab · 2011-05-27 15:04:27

This site http://www.sexoverdose.com runs on a server with 2GB (and it runs 2 other sites + Flash Media Server). The script can work with 2GB perfectly (even with 1 conversion, 2 concurent conversions also works, but with 3 its a problem).

Pikeypete · 2011-05-27 15:06:41

symtab wrote:

This site http://www.sexoverdose.com runs on a server with 2GB (and it runs 2 other sites + Flash Media Server). The script can work with 2GB perfectly (even with 1 conversion, 2 concurent conversions also works, but with 3 its a problem).

God damn

Adult Script Pro Community Forums

#1 2011-05-25 19:03:14

cpanel mail??

#2 2011-05-25 21:01:21

Re: cpanel mail??

#3 2011-05-25 21:36:36

Re: cpanel mail??

#4 2011-05-25 23:26:36

Re: cpanel mail??

#5 2011-05-26 00:22:54

Re: cpanel mail??

#6 2011-05-26 00:35:18

Re: cpanel mail??

#7 2011-05-26 06:53:49

Re: cpanel mail??

#8 2011-05-26 10:57:59

Re: cpanel mail??

#9 2011-05-26 12:19:40

Re: cpanel mail??

#10 2011-05-26 12:40:12

Re: cpanel mail??

#11 2011-05-26 12:41:44

Re: cpanel mail??

#12 2011-05-26 13:10:17

Re: cpanel mail??

#13 2011-05-26 13:14:56

Re: cpanel mail??

#14 2011-05-26 13:24:28

Re: cpanel mail??

#15 2011-05-26 16:54:33

Re: cpanel mail??

#16 2011-05-27 00:30:37

Re: cpanel mail??

#17 2011-05-27 00:39:14

Re: cpanel mail??

#18 2011-05-27 01:43:40

Re: cpanel mail??

#19 2011-05-27 11:40:36

Re: cpanel mail??

#20 2011-05-27 12:03:38

Re: cpanel mail??

#21 2011-05-27 13:50:05

Re: cpanel mail??

#22 2011-05-27 14:53:44

Re: cpanel mail??

#23 2011-05-27 15:02:45

Re: cpanel mail??

#24 2011-05-27 15:04:27

Re: cpanel mail??

#25 2011-05-27 15:06:41

Re: cpanel mail??

Board footer