suspended account

[pushpullbar]

Hi all, sorry I am a total newbie in all of this, and usually I won't venture into this sort of territory, but this morning I got an email from my hosting company saying that my site has been suspended, and then a bunch of codes/log that MIGHT describe what happened.

Can someone PLEASE help me in understanding what happened and how to prevent that from happening again?

OK OK... I am STILL using vB 3.0.0RC4 because I never had the guts to go and upgrade everything in the already running database without screwing things up and lose the whole lot. I am also running vBadvanced as a front page portal.

Here is the email sent to me.

Your account has been suspended

Dear Valued Customer,

Your webhosting account:

pushpullbar.com

has been overloading our server to the point of crashing it. We have been forced to suspend your account until further investigation. Please note the possible reasons :

Script(s)
Improper Use of php ( bad php code ):

http://www.pushpullbar.com/forum/showthread.php
/var/www/html/forum/forumdisplay.php


PID USER PRI NI SIZE RSS SHARE STAT %CPU %MEM TIME CPU COMMAND
5541 admin33 19 0 5724 5716 4316 R 10.7 0.5 0:00 0 /usr/bin/php
5533 admin33 21 0 5724 5716 4316 R 9.7 0.5 0:00 0 /usr/bin/php
5548 admin33 19 0 5648 5640 4316 R 8.2 0.5 0:00 0 /usr/bin/php
5539 admin33 20 0 5628 5620 4316 R 7.3 0.5 0:00 0 /usr/bin/php
5543 admin33 21 0 5636 5628 4316 R 7.3 0.5 0:00 0 /usr/bin/php
5537 admin33 19 0 5264 5256 4028 R 5.8 0.5 0:00 0 /usr/bin/php
5535 admin33 20 0 5264 5256 4028 R 5.3 0.5 0:00 0 /usr/bin/php
5520 admin33 22 0 8168 8160 4784 R 4.8 0.8 0:00 0 /usr/bin/php
5522 admin33 21 0 5704 5696 4316 R 4.8 0.5 0:00 0 /usr/bin/php
5524 admin33 20 0 6744 6736 4684 R 4.8 0.6 0:00 0 /usr/bin/php
5526 admin33 20 0 5724 5716 4316 R 4.8 0.5 0:00 0 /usr/bin/php
5531 admin33 20 0 5792 5784 4316 R 4.8 0.5 0:00 0 /usr/bin/php
5518 admin33 15 0 9928 9920 4856 S 4.3 0.9 0:00 0 /usr/bin/php
5527 root 17 0 1200 1200 800 R 1.9 0.1 0:00 0 top
3802 root 16 0 20576 20M 20484 S 1.4 2.0 0:03 0 /usr/sbin/httpd -DSSL -DSSL.thamsinsurance.com -D
5529 admin33 21 0 5704 5696 4316 R 0.9 0.5 0:00 0 /usr/bin/php
5534 admin33 16 0 952 952 836 S 0.4 0.0 0:00 0 /bin/bash php-script
5536 admin33 16 0 948 948 836 S 0.4 0.0 0:00 0 /bin/bash php-script
5538 admin33 16 0 948 948 836 S 0.4 0.0 0:00 0 /bin/bash php-script
5542 admin33 17 0 952 952 836 S 0.4 0.0 0:00 0 /bin/bash php-script
5547 admin33 16 0 948 948 836 S 0.4 0.0 0:00 0 /bin/bash php-script

Here is some log file that may help you to find the problem:

5865 admin33 /usr/bin/php UNIQUE_ID=GDPx9EIxqwYAABURmvUAAAAG HTTP_USER_AGENT=Mozilla/5.0 (compatible; MSIE 5.0) SERVER_PORT=80 HTT
P_HOST=www.pushpullbar.com DOCUMENT_ROOT=/var/www/html SCRIPT_FILENAME=/var/www/html/forum/showthread.php REQUEST_URI=/forum/showthr
ead.php?t=52 SCRIPT_NAME=/forum/showthread.php SCRIPT_URI=http://www.pushpullbar.com/forum/showthread.php HTTP_CONNECTION=Keep-Alive
PATH_INFO=/forum/showthread.php REMOTE_PORT=4189 PATH=/usr/local/bin:/usr/bin:/bin SCRIPT_URL=/forum/showthread.php PWD=/var/www/in
terpreters SERVER_ADMIN=webmaster@pushpullbar.com REDIRECT_STATUS=200 REDIRECT_QUERY_STRING=t=52 SITE_CGIROOT=/var/www/cgi-bin PATH_
TRANSLATED=/var/www/html/forum/showthread.php HTTP_REFERER=http://www.pushpullbar.com/forum/forumdisplay.php?f=17 HTTP_ACCEPT=*/* SI
TE_HTMLROOT=/var/www/html REMOTE_ADDR=217.83.21.109 SHLVL=1 SERVER_NAME=www.pushpullbar.com SERVER_SOFTWARE=Apache/2.0.48 (Fedora) Q
UERY_STRING=t=52 SITE_ROOT=/ SERVER_ADDR=66.49.171.6 GATEWAY_INTERFACE=CGI/1.1 SERVER_PROTOCOL=HTTP/1.0 REDIRECT_URL=/forum/showthre
ad.php REQUEST_METHOD=GET HTTP_COOKIE=bblastvisit=1100627767; bblastactivity=1100628721; bbthread_lastview=ax16x-ix1004yix1100627548
yix1016yix1100627601yix1050yix1100628147yix803yix1 100627796yix994yix1100628157yix1246yix1100627807yi x504yix1100627819yix383yix110062
7838yix1104yix1100628009yix158yix1100627890yix453y ix1100628249yix270yix1100628656yix18yix1100628680y ix616yix1100628696yix349yix11006
28709yix162yix1100628721y_; bbforum_view=ax11x-ix53yix1100627807yix6yix1100627651yix9yix110062767 6yix11yix1100627689yix48yix11006277
14yix14yix1100627726yix13yix1100627734yix43yix1100 627750yix3yix1100627760yix4yix1100628231yix17yix11 00628673y_ _=/usr/bin/php
5857 admin33 /usr/bin/php UNIQUE_ID=GCgugUIxqwYAABCiUPoAAAAH HTTP_USER_AGENT=Mozilla/5.0 (compatible; MSIE 5.0) SERVER_PORT=80 HTT
P_HOST=www.pushpullbar.com DOCUMENT_ROOT=/var/www/html SCRIPT_FILENAME=/var/www/html/forum/forumdisplay.php REQUEST_URI=/forum/forum
display.php?f=6&daysprune=-1&order=desc&sort=voteavg SCRIPT_NAME=/forum/forumdisplay.php SCRIPT_U
RI=http://www.pushpullbar.com/forum/forumdisplay.php HTTP_CONNECTION=Keep-Alive PATH_INFO=/forum/forumdisplay.php REMOTE_PORT=4187 P
ATH=/usr/local/bin:/usr/bin:/bin SCRIPT_URL=/forum/forumdisplay.php PWD=/var/www/interpreters SERVER_ADMIN=webmaster@pushpullbar.com
REDIRECT_STATUS=200 REDIRECT_QUERY_STRING=f=6&daysprune=-1&order=desc&sort=voteavg SITE_CGIROOT=
/var/www/cgi-bin PATH_TRANSLATED=/var/www/html/forum/forumdisplay.php HTTP_REFERER=http://www.pushpullbar.com/forum/forumdisplay.php
?f=6&page=4&sort=lastpost&order=&pp=20&daysprune=-1 HTTP_ACCEPT=*/* SITE_HTMLROOT=/var/www/html R
EMOTE_ADDR=217.83.21.109 SHLVL=1 SERVER_NAME=www.pushpullbar.com SERVER_SOFTWARE=Apache/2.0.48 (Fedora) QUERY_STRING=s=688283ea3548d
caf35894f2c063bc56c&f=6&daysprune=-1&order=desc&sort=voteavg SITE_ROOT=/ SERVER_ADDR=66.49.171.6 GATEWAY_INTERFACE=CGI/1.1 SERVER_PR
OTOCOL=HTTP/1.0 REDIRECT_URL=/forum/forumdisplay.php REQUEST_METHOD=GET HTTP_COOKIE=bblastvisit=1100628050; bblastactivity=110062872
1; bbthread_lastview=ax29x-ix1215yix1100627743yix595yix1100627575yix1225yix11 00628654yix375yix1100628210yix477yix1100627648yix1 002yi
x1100627672yix1336yix1100627755yix761yix1100627790 yix493yix1100627799yix198yix1100628247yix1004yix11 00627829yix5yix1100627851yix501y
ix1100627863yix1040yix1100627875yix690yix110062789 0yix920yix1100627904yix33yix1100628074yix659yix110 0628090yix311yix1100628104yix73y
ix1100628115yix456yix1100628136yix91yix1100628149y ix181yix1100628163yix205yix1100628175yix281yix1100 628189yix455yix1100628200yix315y
ix1100628219yix1229yix1100628685yix789yix110062871 4y_; bbforum_view=ax9x-ix7yix1100627568yix6yi
5852 admin33 /usr/bin/php UNIQUE_ID=GCU7M0IxqwYAABFbgSYAAAAj HTTP_USER_AGENT=Mozilla/5.0 (compatible; MSIE 5.0) SERVER_PORT=80 HTT
P_HOST=www.pushpullbar.com DOCUMENT_ROOT=/var/www/html SCRIPT_FILENAME=/var/www/html/forum/showthread.php REQUEST_URI=/forum/showthr
ead.php?t=1334 SCRIPT_NAME=/forum/showthread.php SCRIPT_URI=http://www.pushpullbar.com/forum/showthread.php HTTP_CONNECTION=Keep-Ali
ve PATH_INFO=/forum/showthread.php REMOTE_PORT=4185 PATH=/usr/local/bin:/usr/bin:/bin SCRIPT_URL=/forum/showthread.php PWD=/var/www/
interpreters SERVER_ADMIN=webmaster@pushpullbar.com REDIRECT_STATUS=200 REDIRECT_QUERY_STRING=t=1334 SITE_CGIROOT=/var/www/cgi-bin P
ATH_TRANSLATED=/var/www/html/forum/showthread.php HTTP_REFERER=http://www.pushpullbar.com/forum/forumdisplay.php?f=13 HTTP_ACCEPT=*/
* SITE_HTMLROOT=/var/www/html REMOTE_ADDR=217.83.21.109 SHLVL=1 SERVER_NAME=www.pushpullbar.com SERVER_SOFTWARE=Apache/2.0.48 (Fedor
a) QUERY_STRING=t=1334 SITE_ROOT=/ SERVER_ADDR=66.49.171.6 GATEWAY_INTERFACE=CGI/1.1 SERVER_PROTOCOL=HTTP/1.0 REDIRECT_URL=/forum/sh
owthread.php REQUEST_METHOD=GET HTTP_COOKIE=; bblastvisit=1100627528; bblastactivity=110
0628713; bbthread_lastview=ax48x-ix1306yix1100627536yix59yix1100627544yix1029yix110 0627552yix1040yix1100627568yix690yix1100627584yix
631yix1100627607yix1104yix1100627632yix994yix11006 27640yix453yix1100627654yix1121yix1100627687yix111 2yix1100627701yix823yix110062771
4yix945yix1100627729yix894yix1100627739yix974yix11 00627751yix938yix1100627760yix872yix1100627770yix4 89yix1100627782yix1297yix1100627
798yix1198yix1100627809yix1034yix1100627821yix1167 yix1100627853yix1125yix1100627865yix904yix11006278 84yix136yix1100627898yix699yix11
00627908yix102yix1100627938yix1168yix1100627946yix 469yix1100627967yix308yix1100627984yix246yix110062 7994yix268yix1100628004yix836yix
1100628035yix762yix1100628051yix376yix1100628063yi x718yix1100628072yix717yix1100628088yix715yix11006 28096yix988yix1100628122yix574yi
x1100628141yix381yix1100628163yix107yix1100628177y ix123yix1100628199yix1081yix1100628210yix118y

If the problem happens again then you will need to move to a dedicated server where you would have all the resources you need for your site and if you overload something it will only affect your account not 150 others which are present on a virtual machine.


Thanks in advance.

[the Sandman]

If the problem happens again then you will need to move to a dedicated server where you would have all the resources you need for your site and if you overload something it will only affect your account not 150 others which are present on a virtual machine.Hmm, that seems excessive.

It is possible that your server was not optimized, or was configured incorrectly, that you've added modifications which have too many queries or are otherwise inefficient, or that your files or database are corrupted in some way causing you to overtax the server's resources. Maybe you're just grown to the point where you do need a semi-dedicated or dedicated box. This should be looked into, but in the meantime you should consider changing to a different hosting service whatever the cause.

[pushpullbar]

hmm... i haven't touched anything in terms of settings for a while now so definitely no modifications.

i am also using only about 8GB of the 40GB allowance with this hosting company so i really don't understand why they think overloaded the server.

could it have been some sort of attack?

[Natch]

You think 150 users are overtaxing a virtual server environment? From my experience, most shared server environments go around the 2000 user mark before opening a new box...

[the Sandman]

You think 150 users are overtaxing a virtual server environment? From my experience, most shared server environments go around the 2000 user mark before opening a new box...I guess I'm out of touch...

[Natch]

Nah, not out of touch, just I reckon that the shared server vendors try and squeeze too much performance out of their boxes...

What I'm saying is that 150 users would be a nice way of balancing it out :D

[Michael Morris]

The very first thing I would do is TURN OFF the "New posts since last visit" option on the vbadvanced homepage. That query can take a LONG time to run on a large enough database.

[Brad]

You think 150 users are overtaxing a virtual server environment? From my experience, most shared server environments go around the 2000 user mark before opening a new box...
Most of these hosts do this to turn a quick profit. Hosting is a slow bussiness, it takes along time to see a good return when you figure what you have to put in to hardware, software, bandwidth, power, + extra unforseen spending.

To cut some costs they will overload the box if they have to, then if a site starts to eat up resources to the point it hurts everyone else you might get asked to 'upgrade' your hosting acount.

Lets not even get into most re-sellers....

@ thread starter:

Can you provide us with some info please? How many posts/threads/users dose your forum have? How many users do you have online at the same time most of the day?

What hacks have you installed?

[pushpullbar]

Thanks everyone.

Brad...

My forum has around 1000+ users, 1000+ threads and about 10,000+ posts.
The MAXIMUM no. of users at a time was 80, of which most of them were google spiders. Usually you'd find about 2-3 people members on at any one time... usual maximum would be around 7 or 8 members.

the only thing i have installed is vBadvanced portal front page.

[pushpullbar]

i just got this as a reply as to WHY my account was suspended from the hosting...

The php scripts you are running on your forum are overloading the server; if your site is very busy you should think about getting a dedicated server

[Michael Morris]

It smells like the rat is trying to milk you for more cash.

[Brad]

It smells like the rat is trying to milk you for more cash.
Yea I agree, switch hosts, a forum of that size should be able to work in a shared hosting enviroment fine.

[manguish]

My last host did this to me. Same sort of thing.

So i told em where to go and switched to www.f5hosting.com and never looked back.

ACE ;)

[pushpullbar]

so you think there is nothing wrong with the scripts?

[Colin F]

so you think there is nothing wrong with the scripts?
Allthough it wouldn't hurt to upgrade to vB3.0.3, it shouldn't generally be a problem.

Going along with all the above, I suggest you switch your host and while you're at it, you might want to upgrade as well.

[TheMusicMan]

Thanks everyone.

Brad...

My forum has around 1000+ users, 1000+ threads and about 10,000+ posts.
The MAXIMUM no. of users at a time was 80, of which most of them were google spiders. Usually you'd find about 2-3 people members on at any one time... usual maximum would be around 7 or 8 members.

the only thing i have installed is vBadvanced portal front page.
:ninja: What....

I have >3,300 members, 175,000 posts, between 35-90 members on all the time - and I am on a shared server. My host gives me no trouble at all.

Gert away from your current host ASAP as they are 100% looking to milk you for everythign. There is no way your forum needs a dedicated server.

PM me if you want to know more about my host...

[AlexanderT]

Even if you are on a shared host, it shouldn't be possible for a PHP script to "has overload our server to the point of crashing it" - unless you have 100s of users visiting your site simulateously, which is not the case as you stated. So I assume the server has not been optimized correctly.

My suggestion: switch the host. If you need a good recommendation, PM me (I don't want to advertise in public) :)

[Harry Bo]

They're running PHP as CGI - /usr/bin/php. From the current PHP INSTALL file:
If you are running a web server PHP has
module support for, you should generally go for that solution for
performance reasons. However, the CGI version enables users to run
different PHP-enabled pages under different user-ids.

Warning

By using the CGI setup, your server is open to several possible
attacks. Please read our CGI security section to learn how to defend
yourself from those attacks.
If you're running a webserver with a module for PHP (Apache, for instance - which your host is using) then it is significantly more efficient and safe than using CGI. I'm currently using two hosts - Rackspace and a UK one called 34sp.com. Both use PHP compiled as a module. Pretty much any decent host should, in all honesty :)

I'd say switch hosts too...

HB

[mattyk72]

I had this same thing happen to me a while back, I lost my entire forum and had to start over from scratch!

Stupid me didn't do frequent backups at that time either, I do now though.

[Mark.B]

This is my host, and they don't behave in this way.

http://www.imagelinkusa.net
Tell them what you require, they will give you an honest answer as to what you need AND if you go on shared they will NOT overload it!

Also, I have not used them, but keep reading lots of good things from vBulletin owners who use this firm:
http://www.asmallorange.net.
Cannot vouch for them myself but I know many who can.