Results 1 to 23 of 23
  1. #1
    Join Date
    Aug 2011
    Location
    In Spain
    Posts
    50

    QuickWeb account suspension

    Dear xxxxxxxxxx,

    This is a notification that your service has now been suspended. The details of this suspension are below:

    Product/Service: Supa VZ2 (DE)
    Domain: xxxxxxxxxxxx
    Amount: $17.95USD
    Due Date: 25/09/2011
    Suspension Reason: CPU spikes please contact us ASAP by opening a ticket.

    Please contact us as soon as possible to get your service reactivated or simply pay the outstanding invoice to get your service automatically reactivated. Your service along with your data will be removed from our server within 24-48 hours if payment is still not received with no possibility of recovery.

    Cheers,

    Your Friends At QuickWeb
    The Faster Way to the Web!
    www.quickweb.co.nz
    Of course I can't access via ssh, so I can't backup the data and move to other server.

    The CPU load was over 20 as I can see thanks to kloxo emails. I've had problems with CPU load 2 days ago, but not at 8AM!! it's not possible.

    I will post more info when they answer my ticket.

  2. #2
    Join Date
    Jul 2009
    Location
    New Zealand
    Posts
    2,331
    please tell me your ticket and i will look into it, if you are causing massive CPU load then it may get temporarily suspended to avoid server crash saving us all headache if we corrupt RAID array.

    Normally you may get restored back online upon contacting us and promise to look into it immediately.
    QuickWeb™ -We Host Servers Like a Boss!
    New Zealand - USA - UK - Germany Virtual Servers
    Worldwide hosting provider with proven 24x7 and 25-Minute Support!
    www.quickweb.co.nz

  3. #3
    Join Date
    Aug 2011
    Location
    In Spain
    Posts
    50
    Ticket #747360

    It seems that they want me to pay 17.95$. And I have to pay it soon, cause my data will be deleted.

    In the TOS thats what they say about account suspension:
    Suspension of Service

    QuickWeb shall suspend all provided services before or after 48 hours of accounts overdue and will be automatically subject to service termination within further 24 Hours unless otherwise prior arrangement has been mutually agreed. Repeated suspension due to overdue invoices may result in $10 late fee and or $15 reconnection fee. If a service is suspended due to non-payment the service in question will only be reactivated once payment for the outstanding balance has been received in full. If all services on an active account are deactivated all outstanding invoices must be paid in full before any one service will be reactivated. All VPS or hosting services suspended due to violation of terms of service (ToS) on second offence will be liable to pay $5 reactivation fee.

  4. #4
    Join Date
    Jul 2009
    Location
    New Zealand
    Posts
    2,331
    No that was the same template for over due payment as you can see it say's

    Please contact us as soon as possible to get your service reactivated and followed by "or" if reason of suspension was because of past overdue invoice then simply paying invoice will reactivate the VPS, we will make this clear and edit that template to avoid confusion. You do not need to pay anything simply contacting us with intention to look and fix the issue will suffice to get your service reactivated

    violation of AUP also will cause suspension not just what's stipulated in TOS.
    Last edited by QuickWeb-Roel; 08-29-2011 at 04:21 AM.
    QuickWeb™ -We Host Servers Like a Boss!
    New Zealand - USA - UK - Germany Virtual Servers
    Worldwide hosting provider with proven 24x7 and 25-Minute Support!
    www.quickweb.co.nz

  5. #5
    Join Date
    Aug 2011
    Location
    In Spain
    Posts
    50
    They have unsuspended the account, to let me fix the problem.
    Looking at the access_log, I see this: http://pastebin.com/LJPrLXSu
    I cant paste all, there are 6000 lines with that IP.

    Is that normal? is it an attack?

  6. #6
    Quote Originally Posted by TheBronx View Post
    They have unsuspended the account, to let me fix the problem.
    Looking at the access_log, I see this: http://pastebin.com/LJPrLXSu
    I cant paste all, there are 6000 lines with that IP.

    Is that normal? is it an attack?
    Seems like an large amount of undesired requests.

    Block the IP using APF or iptables "apf -d < IP>"

    Install apache modules like mod_dosevasive and mod_security in your server.

    You could maybe also consider report the IP to abuse@fdcservers.net
    Fast & Reliable Unmanaged VPS w/SolusVM ★★ Sandy Bridge E3-1270 @ 3.40Ghz pr Core
    OpenVZ | XEN | KVM | VPS Reseller Hosting Program | Semi-managed VPS
    Manchester, UK | Fremont, US | Falkenstein, DE | Native IPv6 | OpenVZ w/VSwap | TUN/PPTP Enabled
    www.nordicvps.com/wht

  7. #7
    Join Date
    Aug 2011
    Location
    In Spain
    Posts
    50
    if you open that IP, you will see a HideMyAss page. So, blocking the IP is not going to help (hidemyass has thousands of IPs).
    I will install those mods asap.

  8. #8
    Join Date
    Nov 2009
    Location
    /etc/my.cnf
    Posts
    10,657
    Quote Originally Posted by TheBronx View Post
    if you open that IP, you will see a HideMyAss page. So, blocking the IP is not going to help (hidemyass has thousands of IPs).
    I will install those mods asap.
    Just go ahead and block ranges instead...
    UK Based Proactive Server Management.
    Zabbix Enterprise 24/7 Monitoring.

  9. #9
    Join Date
    Aug 2011
    Location
    In Spain
    Posts
    50
    ranges? http://hidemyass.com/vpn/servers/
    HideMyAss has IPs from germany, usa, estonia...

    what I am doing is installing DDoS-Deflate

  10. #10
    Join Date
    Jun 2005
    Posts
    2,752
    Barely 1-3 HTTP requests per second ... It seems the page uses a lot of CPU. Maybe it should be cached or simplified.
    You will only find out how good a provider is when the going gets tough

  11. #11
    Join Date
    Aug 2011
    Location
    In Spain
    Posts
    50
    3.34 per second. all from 1 IP. It's not a problem of cache. It's a DOS. And if you have doubts, the IP is behind a proxy, so in my opinion it's absolutely clear.

  12. #12
    Join Date
    Jun 2005
    Posts
    2,752
    Quote Originally Posted by TheBronx View Post
    3.34 per second. all from 1 IP. It's not a problem of cache. It's a DOS. And if you have doubts, the IP is behind a proxy, so in my opinion it's absolutely clear.
    I'm not saying it is not an attack. My point is the HTTP request rate is very low to take a lot of CPU. In other words, the page sucks. Simple like that.
    Last edited by dotHostel; 08-29-2011 at 09:41 AM.
    You will only find out how good a provider is when the going gets tough

  13. #13
    Join Date
    Aug 2011
    Location
    In Spain
    Posts
    50
    both wordpress and phpbb3 have their own cache system (W3 cache plugin on WP).
    also I was going to install Xcache, but since visits per day are not too high, I didn't need it.
    I finally have found that CSF has its own anti-dos system. So there is no need to install apf, DDoS-Deflate or mod_evasive

  14. #14
    Join Date
    Jun 2005
    Posts
    367
    I'd go with KVM or XEN VPS if I were you. I used to run my websites on a dedicated server 8GB RAM, running nginx, PHP-FPM, and MySQL. I transferred them all to a KVM VPS with only 1.5GB RAM and is still running ok. I saved money in the process.

  15. #15
    Join Date
    Jun 2005
    Posts
    2,752
    Quote Originally Posted by TheBronx View Post
    both wordpress and phpbb3 have their own cache system (W3 cache plugin on WP).
    also I was going to install Xcache, but since visits per day are not too high, I didn't need it.
    I finally have found that CSF has its own anti-dos system. So there is no need to install apf, DDoS-Deflate or mod_evasive
    When you get lemons, make lemonade. This "attack" showed your site has problems and anti-dos systems will not avoid the site be suspended again in case the number of legit visitors increases. IMO some WP plugins use a lot of resources and your site may be the real offender, not the victim.
    You will only find out how good a provider is when the going gets tough

  16. #16
    Join Date
    Apr 2011
    Location
    Las Vegas, NV
    Posts
    1,643
    Quote Originally Posted by dotHostel View Post
    I'm not saying it is not an attack. My point is the HTTP request rate is very low to take a lot of CPU. In other words, the page sucks. Simple like that.
    At only 3 requests per second, there's either a problem with the page or the CPU usage spikes are caused by something else. 3 requests per second isn't enough to trigger mod_evasive.

  17. #17
    Join Date
    Dec 2007
    Posts
    471
    I agree. 3 requests / second is hardly the definition of a DDOS. Even the simplest of web servers on late 1990's hardware could serve 3 requests per second of static content with a very low load.

    The problem, in your case, is that your web server / php / wp is eating up lots of CPU cycles building the dynamic content on the server side. So the request rate isn't your issue, it's the amount of processing power needed to build your dynamic content.

  18. #18
    Join Date
    Aug 2011
    Location
    In Spain
    Posts
    50
    I've installed xcache. And I've been disabling some plugins in WP.
    No results, when I execute 2 test.pl (mod_evasive script) the CPU goes to 20% idle. When I stop the scripts, 95% idle.

    any idea?

  19. #19
    Join Date
    Dec 2007
    Posts
    471
    How's the disk I/O when you run the test?

  20. #20
    Join Date
    Jun 2005
    Posts
    2,752
    Quote Originally Posted by TheBronx View Post
    I've installed xcache. And I've been disabling some plugins in WP.
    No results, when I execute 2 test.pl (mod_evasive script) the CPU goes to 20% idle. When I stop the scripts, 95% idle.

    any idea?
    I think you should create a new topic regarding the conjecture WP is taking lots of CPU as this thread is very specific and probably will not get attention from many people who experienced the same sort of issue.
    You will only find out how good a provider is when the going gets tough

  21. #21
    Join Date
    Aug 2011
    Location
    In Spain
    Posts
    50
    I've opened another thread: http://www.webhostingtalk.com/showthread.php?p=7656400

    oh and 3.34 was the average petitions per second. There are sometimes 12 per second, or more.

  22. #22
    Join Date
    Apr 2011
    Location
    Las Vegas, NV
    Posts
    1,643
    Quote Originally Posted by TheBronx View Post
    There are sometimes 12 per second, or more.
    Apache should be able to handle hundreds of simultaneous requests at a time.

  23. #23
    Join Date
    Aug 2011
    Location
    In Spain
    Posts
    50
    Then something is really really bad with my Apache... cause WP was not installed some days ago, so WP is not the problem. And phpbb3 is not a home-made script...
    What is the problem then?
    Code:
    [root@vps httpd]# cat /proc/cpuinfo
    processor       : 0
    vendor_id       : GenuineIntel
    cpu family      : 6
    model           : 30
    model name      : Intel(R) Xeon(R) CPU           X3440  @ 2.53GHz
    stepping        : 5
    cpu MHz         : 1687.288
    cache size      : 8192 KB
    physical id     : 0
    siblings        : 8
    core id         : 0
    cpu cores       : 4
    apicid          : 0
    fpu             : yes
    fpu_exception   : yes
    cpuid level     : 11
    wp              : yes
    flags           : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm syscall nx rdtscp lm constant_tsc ida nonstop_tsc pni monitor ds_cpl vmx smx est tm2 ssse3 cx16 xtpr sse4_1 sse4_2 popcnt lahf_lm
    bogomips        : 5066.81
    clflush size    : 64
    cache_alignment : 64
    address sizes   : 36 bits physical, 48 bits virtual
    power management: [8]
    
    processor       : 1
    vendor_id       : GenuineIntel
    cpu family      : 6
    model           : 30
    model name      : Intel(R) Xeon(R) CPU           X3440  @ 2.53GHz
    stepping        : 5
    cpu MHz         : 1687.288
    cache size      : 8192 KB
    physical id     : 0
    siblings        : 8
    core id         : 1
    cpu cores       : 4
    apicid          : 2
    fpu             : yes
    fpu_exception   : yes
    cpuid level     : 11
    wp              : yes
    flags           : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm syscall nx rdtscp lm constant_tsc ida nonstop_tsc pni monitor ds_cpl vmx smx est tm2 ssse3 cx16 xtpr sse4_1 sse4_2 popcnt lahf_lm
    bogomips        : 5066.66
    clflush size    : 64
    cache_alignment : 64
    address sizes   : 36 bits physical, 48 bits virtual
    power management: [8]
    
    processor       : 2
    vendor_id       : GenuineIntel
    cpu family      : 6
    model           : 30
    model name      : Intel(R) Xeon(R) CPU           X3440  @ 2.53GHz
    stepping        : 5
    cpu MHz         : 1687.288
    cache size      : 8192 KB
    physical id     : 0
    siblings        : 8
    core id         : 2
    cpu cores       : 4
    apicid          : 4
    fpu             : yes
    fpu_exception   : yes
    cpuid level     : 11
    wp              : yes
    flags           : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm syscall nx rdtscp lm constant_tsc ida nonstop_tsc pni monitor ds_cpl vmx smx est tm2 ssse3 cx16 xtpr sse4_1 sse4_2 popcnt lahf_lm
    bogomips        : 5066.51
    clflush size    : 64
    cache_alignment : 64
    address sizes   : 36 bits physical, 48 bits virtual
    power management: [8]

Similar Threads

  1. Account suspension
    By kenchix1 in forum Reseller Hosting
    Replies: 8
    Last Post: 02-17-2007, 03:43 AM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •