my friends have a site i help on. he has a forum. we get less then 50 vistors a day at the forum. also he has a section where he displays his graphics. i make a back up of the board's database once every other day. out of fear of being hacked. i see the montly bandwidth stats every time i log into the control panel. because of my constant backups of the mysql. today my friend got a email saying his site had been shut down because we went over our bandwidth. it was a link in the email showing our bandwidth uses. it showed we used a little over 31 gigs of traffic. so i was thinking what in sam hell? the only high traffic area of the site is our forum. which doesn't recieve not even 50 visitors a day. we havent even had 1000 unique hits a day yet. i have never notice the bandwidth go over 800 megs before in the 2 months we have had the site up. we don't display downloads on the site. all it is a forum and his graphics displayed (wall papers). we used about 30-40 megs of space. is it possible we actually used 31 gigs?

Where are you hosted? You might have been hacked.

ecommercediscovery.com

hacked how?

Well, this really does seem wrong. Ask your host(if you already do not have access to them) about getting the raw access logs for apache, then run them through a program like awstats and see what it turns up. Then ask your host how the track bandwidth, do they monitor an IP, add in anonymous ftp etc. I dont think many people can go from 800 to 31 gigs. Finally, I am sure you have done this, but ask your host to see what exactly took so much bandwidth, sometimes the programs do make mistakes, and problems like these occur.

I had the same problem over the Christmas period.

Came back to work and found an invoice for about £400 for an extra 30 gig!

I downloaded all the logs from the server (apache, ftp and sendmail), worked out the bandwidth used (about 2 gig), sent it to the hosting company, who eventually credited me back since neither parties could prove the bandwidth usage.

My problems were on a dedicated server, so now I've set up a script which logs the throughput of the network card. So if it happens again I have proof!

Unfortunately this is no good if you're on a shared server.

Regards

Matt

Originally posted by MattMans
so now I've set up a script which logs the throughput of the network card.

Care to share it with us??? :)

I've been charged for 70gigs of transfer ( about $100 ) on two separate occasions from the same host before. They were both errors, but because it is automatically withdrawn, you need to let them know or else the computer will take the money from your account. (if you have it set up to do that) :)

i'm getting pissed now. I have no idea what is going on. So we sent numerous emails asking questions and they are not answering our emails??? Our site been down a whole day :(

Does the host have a phone # that you can call?

There should be no reason why they won't let you access their logs...

But it raises the point if you are being hosted on a computer that is hacked is it your liabilty or theirs?

Does it matter if it's a dedicated or a shared...

If it's shared do you share the liabilty w/ everyone you share it w/?

i am having my other cowebmaster call right now for me. i can't call out of the country and unable to get a phone card. So we are about to do a 3way call. I'll keep everyone posted. this is getting ridicules

I would say if it was your individual site that got hacked and it ate the bandwidth up then the site owner is responsible, but if the entire server got hacked, root compromise, etc then obviously the owner of the box is responsible.

Back on topic. I personally would never host with someone that doesn't provide easy access to raw log files, it has been quite trivial for quite some time to provide that type of access.

Is there any chance that the wall paper got really popular or "slashdotted?"

How big is the database you back up? I didn't see you mention that.

Hope you hear from them soon. Try calling that always helps.

the mysql database is about 3.1 megs the last time i seen it. and we just called. no answer. not even a answering machine which is wierd to me.

Here's the script to get out the throughput of the network card "eth0" and setting a variable to the last 5 mins of uptime.

I also added a part to email me the output of the script when run, and also insert it into a database (so we can get nice graphs :) ).

Make it executeable and you can run it from a shell (or cron job).

Matt
----------------------------------

#! /usr/bin/php -q

<?php

function network ()
{
$results = array();

if ($fd = fopen('/proc/net/dev', 'r')) {
while ($buf = fgets($fd, 4096)) {
if (preg_match('/:/', $buf)) {
list($dev_name, $stats_list) = preg_split('/:/', $buf, 2);
if($devname="eth0"){
$stats = preg_split('/\s+/', trim($stats_list));

$results = array();

$results['devname']=$devname;

$results['rx_bytes']=$stats[0];
$results['rx_packets']=$stats[1];
$results['rx_errs']=$stats[2];
$results['rx_drop']=$stats[3];

$results['tx_bytes']=$stats[8];
$results['tx_packets']=$stats[9];
$results['tx_errs']=$stats[10];
$results['tx_drop']=$stats[11];

$results['errs']=$stats[2]+$stats[10];
$results['drop']=$stats[3]+$stats[11];
}
}
}
}
return $results;
}

$stats = network();

$today = date("F j Y g:ia");

$rx=round(($stats['rx_bytes']/1024)/1024, 2);
$tx=round(($stats['tx_bytes']/1024)/1024, 2);

$_text="$today - ";
$_text.=" In: ".round(($stats['rx_bytes']/1024)/1024/1024, 2)."GB - ";
$_text.=" Out: ".round(($stats['tx_bytes']/1024)/1024/1024, 2)."GB";

$uptime=exec('uptime');
echo "$_text\n $uptime\n";

$avload=substr($uptime, -16, 4);

?>

well we called twice still got no answer. the site is back up now. i was told it might be a error in their software. the "tech" is looking it up now. from 700 megs to 31 gigs is way more then a error. i'm changing hosts soon

Originally posted by Keta
well we called twice still got no answer. the site is back up now. i was told it might be a error in their software. the "tech" is looking it up now. from 700 megs to 31 gigs is way more then a error. i'm changing hosts soon

I too think my being overcharged was more than just a mistake and left the company immediatly :(

Leave them as soon as possible.

Matt I too got a bill after xmas for £350 for bandwidth my host said it had been hacked with trojans, and if i pay they will clean my sever not having the money at the time i left it as i had not been using the server little did i know that then a month later they said i should have paid for server time as i now owe them £6000 I explained when i first got the server a few months back that i had no clue but all they seem interested in once i signed up was admin time, it seems to me they should haev saiddisconnected it once tehy relised teh bandwidth is still going mental now they are threating pay by tuesday or face debt agency, i dont want to say who it is as i think i will need to fight this.

Its now too late to realise that the bandwidth is not capped as i used 350 meg or so last month, howthey expect me to find that sort of money is amazing its a licenecse to print money for them.


C