Issue with a script taking up..

[Webdevkirk]

Hi,

I'm having an issue with a certain vBulletin script taking up too much CPU usage on my forums, the host had said to "contact the developers to help optimize this issue" so, I was wondering if anyone could possibly assist me in resolving this..

thank you.

[RichieBoy67]

What is the script? It is most likely a plug in.

Ask your host to be more specific and to send you the server logs.

[Webdevkirk]

Originally Posted by RichieBoy67

What is the script?

I honestly am not sure, the host said to I quote "contact the developer to help resolve this issue or figure out what the script is".. I'm not too sure what to do in this case, so I thought posting here would possibly help.

--update--

CPU Usage: 97% (warning)


Snapshot 1
habbtune 14222 18.0 0.0 323896 27432 ? RN 19:01 0:00 /opt/php53/bin/php-cgi /home4/habbtune/public_html/misc.php
habbtune 14243 27.0 0.0 322612 26196 ? RN 19:01 0:00 /opt/php53/bin/php-cgi /home4/habbtune/public_html/misc.php
habbtune 14269 22.0 0.0 314716 16904 ? RN 19:01 0:00 /opt/php53/bin/php-cgi /home4/habbtune/public_html/misc.php
habbtune 14279 21.0 0.0 313252 16192 ? RN 19:01 0:00 /opt/php53/bin/php-cgi /home4/habbtune/public_html/misc.php
habbtune 14291 18.0 0.0 197468 7860 ? RN 19:01 0:00 /opt/php53/bin/php-cgi /home4/habbtune/public_html/misc.php

Snapshot 2
habbtune 14222 18.5 0.0 323636 27540 ? RN 19:01 0:00 /opt/php53/bin/php-cgi /home4/habbtune/public_html/misc.php
habbtune 14243 33.0 0.0 323636 27548 ? RN 19:01 0:00 /opt/php53/bin/php-cgi /home4/habbtune/public_html/misc.php
habbtune 14269 24.0 0.0 316192 19072 ? RN 19:01 0:00 /opt/php53/bin/php-cgi /home4/habbtune/public_html/misc.php
habbtune 14279 24.0 0.0 317280 20464 ? RN 19:01 0:00 /opt/php53/bin/php-cgi /home4/habbtune/public_html/misc.php
habbtune 14291 20.0 0.0 311408 14092 ? RN 19:01 0:00 /opt/php53/bin/php-cgi /home4/habbtune/public_html/misc.php

Snapshot 3
habbtune 14222 12.6 0.0 323636 27540 ? RN 19:01 0:00 /opt/php53/bin/php-cgi /home4/habbtune/public_html/misc.php
habbtune 14243 17.0 0.0 323636 27548 ? RN 19:01 0:00 /opt/php53/bin/php-cgi /home4/habbtune/public_html/misc.php
habbtune 14269 12.0 0.0 316792 19780 ? RN 19:01 0:00 /opt/php53/bin/php-cgi /home4/habbtune/public_html/misc.php
habbtune 14279 13.0 0.0 321164 24696 ? RN 19:01 0:00 /opt/php53/bin/php-cgi /home4/habbtune/public_html/misc.php
habbtune 14291 10.5 0.0 312068 14872 ? RN 19:01 0:00 /opt/php53/bin/php-cgi /home4/habbtune/public_html/misc.php

Snapshot 4
habbtune 14222 13.0 0.0 323636 27540 ? RN 19:01 0:00 /opt/php53/bin/php-cgi /home4/habbtune/public_html/misc.php
habbtune 14243 17.5 0.0 323636 27548 ? RN 19:01 0:00 /opt/php53/bin/php-cgi /home4/habbtune/public_html/misc.php
habbtune 14269 12.0 0.0 316792 20196 ? RN 19:01 0:00 /opt/php53/bin/php-cgi /home4/habbtune/public_html/misc.php
habbtune 14279 14.5 0.0 322356 26196 ? RN 19:01 0:00 /opt/php53/bin/php-cgi /home4/habbtune/public_html/misc.php
habbtune 14291 11.0 0.0 312988 15928 ? RN 19:01 0:00 /opt/php53/bin/php-cgi /home4/habbtune/public_html/misc.php
habbtune 14319 8.5 0.0 173040 5856 ? RN 19:01 0:00 /opt/php53/bin/php-cgi /home4/habbtune/public_html/misc.php

Snapshot 5
habbtune 14222 13.3 0.0 323636 27596 ? RN 19:01 0:00 /opt/php53/bin/php-cgi /home4/habbtune/public_html/misc.php
habbtune 14243 18.0 0.0 323636 27600 ? RN 19:01 0:00 /opt/php53/bin/php-cgi /home4/habbtune/public_html/misc.php
habbtune 14269 12.5 0.0 319280 22852 ? RN 19:01 0:00 /opt/php53/bin/php-cgi /home4/habbtune/public_html/misc.php
habbtune 14279 16.5 0.0 323124 26656 ? RN 19:01 0:00 /opt/php53/bin/php-cgi /home4/habbtune/public_html/misc.php
habbtune 14291 11.0 0.0 314184 16280 ? RN 19:01 0:00 /opt/php53/bin/php-cgi /home4/habbtune/public_html/misc.php
habbtune 14319 9.0 0.0 218528 9764 ? RN 19:01 0:00 /opt/php53/bin/php-cgi /home4/habbtune/public_html/misc.php

Current load: 19:01:16 up 13 days, 17:57, 0 users, load average: 0.12, 0.03, 0.01

--------------- Added [DATE]1395078414[/DATE] at [TIME]1395078414[/TIME] ---------------

Still need help, if anyones there

[ozzy47]

What mods do you have installed? I see it is all the misc.php, but that could be almost anything.

What host is this, and what package do you have?
How many users are you averaging on your site, members & guests?

[Zachery]

misc.php doesn't do much by default. Are you runninr 4.2.2?

[TheLastSuperman]

Originally Posted by Zachery

misc.php doesn't do much by default. Are you runninr 4.2.2?

He posted in 3.x forums... but possibly a "posted in wrong area" however remember that a default misc.php does not do much however a hacked misc.php will . Your site could have *possibly* been hacked.

I would do this:

• Download the same version of 3.x you are running from the members area.
• Rename your misc.php to misc1.php.
• Upload the 100% fresh misc.php file, now check is the load issue resolved now?

If the issue is resolved after uploading the new file then have someone review the misc1.php file, if they find malicious code you'll then need to take further action.

[Max Taxable]

Is this the site in question?

http://habbtunesforum.net/

[Max Taxable]

You have a really strange file being called that produces a 404 error, here.

URL: http://habbtunesforum.net/clientscript/moosmyth1.js
Host: habbtunesforum.net
IP: 108.162.196.62
Location: Cloudflare
Error/Status Code: 404
Client Port: 64667
Start Offset: 0.801 s
Time to First Byte: 126 ms
Content Download: 0 ms
Bytes In (downloaded): 1.0 KB
Bytes Out (uploaded): 0.5 KB

Webpagetest shows no calls at all to 'misc.php' and also shows no abusive CPU usage.

You do have some minor optimization work to do though.

[TheLastSuperman]

^ I checked the url you posted and viewed the source code, granted not the same as having access to the templates directly but I didn't notice anything odd until I reached the bottom:

<script type="text/javascript"> 
specialmyth();
</script>

What does that do I wonder?

Edit: The function name is similar to moosmyth1.js i.e. the myth part of each.

[Max Taxable]

Originally Posted by TheLastSuperman

^ I checked the url you posted and viewed the source code, granted not the same as having access to the templates directly but I didn't notice anything odd until I reached the bottom:

<script type="text/javascript"> 
specialmyth();
</script>

What does that do I wonder?

Edit: The function name is similar to moosmyth1.js i.e. the myth part of each.

Yeah I dunno what the hell these are but I do know they don't belong there.

His server load he reports in post #3, from his admin CP is quite curious as well... Possible the host server is having issues related to other site(s) on the machine? I don't think his lone vB installation is loading the server that much by itself.