Osclass forums

Support forums => Installation / Update help => Topic started by: mrtsoftware on November 28, 2016, 04:52:15 pm

Title: Strange SPAM CPU Usage
Post by: mrtsoftware on November 28, 2016, 04:52:15 pm
Hi,
I noticed that it is occured very high CPU usage as you see at the attachment and below,

IP                             Date / Time              Size / Bytes                 URL
160.153.161.238    28.11.2016 06:31     97104 bytes               Osclass (v.361) -
160.153.161.238    28.11.2016 06:31     97104 bytes               Osclass (v.361) -
160.153.161.238    28.11.2016 06:31     97104 bytes               Osclass (v.361) -
160.153.161.238    28.11.2016 06:31     97104 bytes               Osclass (v.361) -
160.153.161.238    28.11.2016 06:31     97104 bytes               Osclass (v.361) -
160.153.161.238    28.11.2016 06:31     97104 bytes               Osclass (v.361) -
160.153.161.238    28.11.2016 06:31     97104 bytes               Osclass (v.361) -
.....İt goes like this and endless records...

I suppose that this is created by a spam bot,
I do not know how to prevent this....
Can someone give me some suggestions how to solve it

Thank you all

Title: Re: Strange SPAM CPU Usage
Post by: _CONEJO on November 28, 2016, 05:07:21 pm
Block that IP, if you are using a VPS , just ssh into your machine and

Code: [Select]
iptables -A INPUT 160.153.161.238 -j DROP

If you use cpanel or some other control panel, there should be options available to block it, or just tell your hosting provider
Title: Re: Strange SPAM CPU Usage
Post by: dev101 on November 28, 2016, 05:29:06 pm
That IP is GoDaddy Hosting, are you sure it's not your own IP and that you messed something up?

(if you host your site there, or use their domain)
Title: Re: Strange SPAM CPU Usage
Post by: Aficionado on November 28, 2016, 06:39:28 pm
That is Osclass doing something, not spam or hack or whatever.

The Signature is there and DONT DROP THAT IP or BLOCK.

Check first. As dev101 said probably this is YOUR ip.

Title: Re: Strange SPAM CPU Usage
Post by: _CONEJO on November 29, 2016, 12:08:19 am
That is Osclass doing something, not spam or hack or whatever.

The Signature is there and DONT DROP THAT IP or BLOCK.

Check first. As dev101 said probably this is YOUR ip.


Right, I was too fast to suggest the iptables solution.


Access your admin panel, go to settings > general > and disable AUTOCRON   Let's see if that could be the cause
Title: Re: Strange SPAM CPU Usage
Post by: Aficionado on November 29, 2016, 03:54:21 am

Access your admin panel, go to settings > general > and disable AUTOCRON   Let's see if that could be the cause

At some point this internal cron problem should be examined and maybe fixed. While my Wordpress internal cron works like a charm, the same doesn't with Osclass. Same hosting plan, 100%. I had to switch to external Cron.

There are a lot of posts for this here.
Title: Re: Strange SPAM CPU Usage
Post by: mrtsoftware on December 01, 2016, 01:27:39 am
I just read your messages, thanks all!
It is IP of GODADDY and it is not my IP.
I did not block IP and disable AUTOCRON,

I have reinstalled new OSCLASS and restored database + oc-content / files
At this moment site is good, I am observing site and traffic.
If it happens again, I will follow your recommends ( _CONEJO, Aficionado )


Title: Re: Strange SPAM CPU Usage
Post by: Aficionado on December 01, 2016, 01:31:18 am
I just read your messages, thanks all!
It is IP of GODADDY and it is not my IP.
I did not block IP and disable AUTOCRON,

I have reinstalled new OSCLASS and restored database + oc-content / files
At this moment site is good, I am observing site and traffic.
If it happens again, I will follow your recommends ( _CONEJO, Aficionado )

Good. The thing is ... a CRON is needed. If you disable the Internal Cron you MUST enable an external one from within your hosting plan. You can't use properly Osclass without CRON.
Title: Re: Strange SPAM CPU Usage
Post by: mrtsoftware on December 01, 2016, 01:50:14 am
Yes I always enable CRON section because OSCLASS is recommending this, thanks for advices..I will do your recommends if it happens again and I'll write here results...
Title: Re: Strange SPAM CPU Usage
Post by: Aficionado on December 01, 2016, 01:52:26 am
Yes I always enable CRON section because OSCLASS is recommending this, thanks for advices..I will do your recommends if it happens again and I'll write here results...

Maybe you didn't got what i said. Are you using RIGHT now a CRON ?

Title: Re: Strange SPAM CPU Usage
Post by: mrtsoftware on December 13, 2016, 02:13:36 am
This problem repeated again, now it uses high CPU resources..
http://www.nannyturkey.com/oc-admin/ can not be found too...
I am really suprized why this problem is repeating 3/4 times in each mounth...
Title: Re: Strange SPAM CPU Usage
Post by: mrtsoftware on December 13, 2016, 02:18:55 am
160.153.161.238 12.12.2016 16:14   0             Osclass (v.361) - /
160.153.161.238 12.12.2016 15:59   147432        Osclass (v.361) - /
160.153.161.238 12.12.2016 16:14   0             Osclass (v.361) - /
160.153.161.238 12.12.2016 15:59   147440        Osclass (v.361) - /
160.153.161.238 12.12.2016 16:14   0             Osclass (v.361) - /
160.153.161.238 12.12.2016 15:59   147440        Osclass (v.361) - /

.........
İt goes thousands records every seconds ...How to stop this?
Title: Re: Strange SPAM CPU Usage
Post by: Aficionado on December 13, 2016, 02:26:01 am
I don't really understand. A few weeks back you posted:

Quote
Hi everbody,
as Aficionado adviced, I stopped to work with hostdime, and I have immigrated my web to another hosting, now it is working fine..
Thank you for advice Aficionado!

But now you post again the same. You said it is WORKING. Now you say it is NOT WORKING.

How that can be ? Same questions all over again and again without any sense for us.

We told you what to do. What to check. You didn't even replied to my last question.

Title: Re: Strange SPAM CPU Usage
Post by: Aficionado on December 13, 2016, 03:36:19 am

İt goes thousands records every seconds ...How to stop this?

Also IMPOSSIBLE to create thousands records per second. Can't happen, since it will bring down the whole server. OR this is the cause your site is offline (godaddy removed it temporarily because of abuse of the server) ?

Title: Re: Strange SPAM CPU Usage
Post by: mrtsoftware on December 13, 2016, 09:27:55 am
Yes server was down, to do not affect other sites I have changed root folder name and therefore it is off...
My previous solution was a new installation and restore backup files...But it goes max 1 week and it repeats again...
Yes I have selected OSCLASS cron. I am using osclass cron. Should I disable this?

Title: Re: Strange SPAM CPU Usage
Post by: mrtsoftware on December 13, 2016, 10:31:15 am
As Aficionado adviced a while ago I stopped HOSTDIME and moved site to GODADDY. Now same problem is repeated there.
How to stop 147432 bytes CPU using for each minute / seconds?

160.153.161.238 12.12.2016 16:14   0             Osclass (v.361) - /
160.153.161.238 12.12.2016 15:59   147432        Osclass (v.361) - /
160.153.161.238 12.12.2016 16:14   0             Osclass (v.361) - /
160.153.161.238 12.12.2016 15:59   147440        Osclass (v.361) - /
160.153.161.238 12.12.2016 16:14   0             Osclass (v.361) - /
160.153.161.238 12.12.2016 15:59   147440        Osclass (v.361) - /

I have today reinstalled osclass / restored only database and oc-content/   folder.
I have now disabled internal CRON osclass, and I am looking what will happen.

Title: Re: Strange SPAM CPU Usage
Post by: Aficionado on December 13, 2016, 12:33:34 pm
Yes server was down, to do not affect other sites I have changed root folder name and therefore it is off...
My previous solution was a new installation and restore backup files...But it goes max 1 week and it repeats again...
Yes I have selected OSCLASS cron. I am using osclass cron. Should I disable this?

1. Enable OSclass debug to a LOG.

https://doc.osclass.org/Debug_PHP_errors

Leave it as it is for at least 48 hours or more (doesn't hurt). Check the log files arfer a few hours and let us know.

2. Does an ERROR.LOG exist in your Osclass directory ? If so what is it in there ?

3. DISABLE FOR A WHILE ALL CRONS. Doesn't hurt for 1-2 days and see how it goes.

4. After that Enable EXTERNAL CRON ONLY twice a day.

5. Tell us what is the Folders and Files permissions (using an ftp for example). Check one "oc-" folder and one file.
Title: Re: Strange SPAM CPU Usage
Post by: dev101 on December 13, 2016, 01:27:04 pm
If that IP is not yours, you have to report it for abuse.
Title: Re: Strange SPAM CPU Usage
Post by: mrtsoftware on December 14, 2016, 01:37:43 am
1) Enabled debug log
2) I have added attachment log files from yesterday my problem occured. Now there is no a recorded log file into root.
3) Disabled cron into OSCLASS ( do you mean external cron " cron into CPANEL " ) if yes I did not do something with cron of hosting panel. should I also disable?
4) Folder permission is 755 and file permissions is 644

Since this morning 13.12.2016 at 10:00 AM I have reinstalled OSCLASS and restored SQL database and only oc-content/ folder it is now working fine 13 hours.

When I look OSCLASS visitor statistic yesterday visitors are raised from 400 to 2768 suddenly ...and now is again down to 440
Title: Re: Strange SPAM CPU Usage
Post by: Aficionado on December 14, 2016, 02:04:33 am
Ok here is the log file for easy reading.

[12-Dec-2016 23:00:42 UTC] PHP Warning:  require_once(/home/aytgroup/public_html/nannyturkey.com/oc-includes/osclass/model/City.php): failed to open stream: No such file or directory in /home/aytgroup/public_html/nannyturkey.com/oc-load.php on line 128
[12-Dec-2016 23:00:42 UTC] PHP Stack trace:
[12-Dec-2016 23:00:42 UTC] PHP   1. {main}() /home/aytgroup/public_html/nannyturkey.com/index.php:0
[12-Dec-2016 23:00:42 UTC] PHP   2. require_once() /home/aytgroup/public_html/nannyturkey.com/index.php:23
[12-Dec-2016 23:00:42 UTC] PHP Fatal error:  require_once(): Failed opening required '/home/aytgroup/public_html/nannyturkey.com/oc-includes/osclass/model/City.php' (include_path='/home/aytgroup/public_html/nannyturkey.com/oc-includes/htmlpurifier:.:/opt/alt/php55/usr/share/pear:/opt/alt/php55/usr/share/php') in /home/aytgroup/public_html/nannyturkey.com/oc-load.php on line 128
[12-Dec-2016 23:00:42 UTC] PHP Stack trace:
[12-Dec-2016 23:00:42 UTC] PHP   1. {main}() /home/aytgroup/public_html/nannyturkey.com/index.php:0
[12-Dec-2016 23:00:42 UTC] PHP   2. require_once() /home/aytgroup/public_html/nannyturkey.com/index.php:23
[12-Dec-2016 23:00:42 UTC] PHP Warning:  require_once(/home/aytgroup/public_html/nannyturkey.com/oc-includes/osclass/helpers/hDefines.php): failed to open stream: No such file or directory in /home/aytgroup/public_html/nannyturkey.com/oc-load.php on line 82
[12-Dec-2016 23:00:42 UTC] PHP Stack trace:
[12-Dec-2016 23:00:42 UTC] PHP   1. {main}() /home/aytgroup/public_html/nannyturkey.com/index.php:0
[12-Dec-2016 23:00:42 UTC] PHP   2. require_once() /home/aytgroup/public_html/nannyturkey.com/index.php:23
[12-Dec-2016 23:00:42 UTC] PHP Fatal error:  require_once(): Failed opening required '/home/aytgroup/public_html/nannyturkey.com/oc-includes/osclass/helpers/hDefines.php' (include_path='.:/opt/alt/php55/usr/share/pear:/opt/alt/php55/usr/share/php') in /home/aytgroup/public_html/nannyturkey.com/oc-load.php on line 82
[12-Dec-2016 23:00:42 UTC] PHP Stack trace:
[12-Dec-2016 23:00:42 UTC] PHP   1. {main}() /home/aytgroup/public_html/nannyturkey.com/index.php:0
[12-Dec-2016 23:00:42 UTC] PHP   2. require_once() /home/aytgroup/public_html/nannyturkey.com/index.php:23
[13-Dec-2016 00:00:42 Europe/Madrid] PHP Warning:  fopen(/home/aytgroup/public_html/nannyturkey.com/oc-content/plugins/cookie_consent/languages/tr_TR/messages.mo): failed to open stream: No such file or directory in /home/aytgroup/public_html/nannyturkey.com/oc-includes/php-gettext/streams.php on line 95
[13-Dec-2016 00:00:42 Europe/Madrid] PHP Stack trace:
[13-Dec-2016 00:00:42 Europe/Madrid] PHP   1. {main}() /home/aytgroup/public_html/nannyturkey.com/index.php:0
[13-Dec-2016 00:00:42 Europe/Madrid] PHP   2. CWebMain->__construct() /home/aytgroup/public_html/nannyturkey.com/index.php:141
[13-Dec-2016 00:00:42 Europe/Madrid] PHP   3. BaseModel->__construct() /home/aytgroup/public_html/nannyturkey.com/oc-includes/osclass/controller/main.php:23
[13-Dec-2016 00:00:42 Europe/Madrid] PHP   4. WebThemes::newInstance() /home/aytgroup/public_html/nannyturkey.com/oc-includes/osclass/core/BaseModel.php:57
Title: Re: Strange SPAM CPU Usage
Post by: Aficionado on December 14, 2016, 02:06:28 am
1) Enabled debug log


No it is NOT working right. Those are FATAL errors you have and probably that is the cause of your problems.

Have you modified Osclass script in any way ? Any 3rd party plugins ?

Title: Re: Strange SPAM CPU Usage
Post by: Aficionado on December 14, 2016, 02:16:37 am
1) Enabled debug log
2) I have added attachment log files from yesterday my problem occured. Now there is no a recorded log file into root.
3) Disabled cron into OSCLASS ( do you mean external cron " cron into CPANEL " ) if yes I did not do something with cron of hosting panel. should I also disable?
4) Folder permission is 755 and file permissions is 644


So permissions are ok. Just Disable Internal Cron and don't put Crons from Cpanel for 2-3 days (no harm done). Until you have a clear debug.log.

Title: Re: Strange SPAM CPU Usage
Post by: Aficionado on December 14, 2016, 02:19:24 am
Please post here the last two lines (with the paths) of your Osclass config.php

like this for example:

Code: [Select]
define('REL_WEB_URL', '/');

define('WEB_PATH', 'http://www.website.com/');

 (don't post any passwords etc etc).

Also please post here your .htaccess

Title: Re: Strange SPAM CPU Usage
Post by: mrtsoftware on December 14, 2016, 07:29:25 pm
I just modified adsense code placing location into header section and some color codes changing into css file not more. I do not use any third party plugin, only I use OSCLASS freeware plugings as sitemap, etc...

define('REL_WEB_URL', '/');
define('WEB_PATH', 'http://www.nannyturkey.com/');

.htaccess code now show as below ( Denied IP adresses I have added after last problem occuring, I have observed into visitorstats those ips are visiting web page and spending high KB )

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
<Files 403.shtml>
order allow,deny
allow from all
</Files>
deny from 136.243.36.81
deny from 163.172.66.1
deny from 163.172.66.2/31
deny from 163.172.66.4/30
deny from 163.172.66.8/29
deny from 163.172.66.16/28
deny from 163.172.66.32/27
deny from 163.172.66.64/26
deny from 163.172.66.128/26
deny from 163.172.66.192/29
deny from 213.142.148.11
deny from 213.142.148.1
deny from 213.142.148.2/31
deny from 213.142.148.4/30
deny from 213.142.148.8/29
deny from 213.142.148.16/28
deny from 213.142.148.32/27
deny from 213.142.148.64/27
deny from 213.142.148.96/30
deny from 188.143.232.22
deny from 188.143.232.1
deny from 188.143.232.2/31
deny from 188.143.232.4/30
deny from 188.143.232.8/29
deny from 188.143.232.16/28
deny from 188.143.232.32/27
deny from 188.143.232.64/26
deny from 188.143.232.128/25
deny from 160.153.161.238


Title: Re: Strange SPAM CPU Usage
Post by: Aficionado on December 14, 2016, 07:40:56 pm
Damn, everything seems to be ok, config and htaccess, security.

Let me think a bit more. I m out of ideas because 2 hosting companies can't have the same problems.
Title: Re: Strange SPAM CPU Usage
Post by: Aficionado on December 14, 2016, 08:07:06 pm
Ok, most probably it is because of this:

/home/aytgroup/public_html/nannyturkey.com/

This means you are running it in a subdirectory and not in "public_html". Am i right ? If so, why you do this ?

Try moving everything to "public_html" OR make some ABS_PATH change (i don't remember how, if anyone else does ....)

Title: Re: Strange SPAM CPU Usage
Post by: mrtsoftware on December 14, 2016, 08:57:24 pm
/home/aytgroup/public_html/nannyturkey.com/ is being created by GODADDY panel automatically while add on, I am also hosting 15 another web pages into same server account, therefore GODADDY is creating auto folder for each domain after /public_html/

This is also same my other hosting companies ( I use 5 different companies now )

For examle justhost.com is creating folder without .com, only " nannyturkey " folder
Title: Re: Strange SPAM CPU Usage
Post by: Aficionado on December 14, 2016, 09:22:45 pm
/home/aytgroup/public_html/nannyturkey.com/ is being created by GODADDY panel automatically while add on, I am also hosting 15 another web pages into same server account, therefore GODADDY is creating auto folder for each domain after /public_html/

This is also same my other hosting companies ( I use 5 different companies now )

For examle justhost.com is creating folder without .com, only " nannyturkey " folder

Well not correct. the addon domain should be created in the same level as public_htlml otherwise ther are not domains but subdirectories.

Osclass team could comment on this ...
Title: Re: Strange SPAM CPU Usage
Post by: mrtsoftware on December 14, 2016, 10:15:15 pm
At the attachment I have added GODADDY domain add on panel's secreenshoots,
into number 1 when I insert domain name, below number 2 + 3 system is creating itself. ( see secrenshoot " godadd add on "

I see all domains into /public_html/  and /www/ folder. 
Please see secreeshoots. I do not know whether I am doing something wrong but all CPANELS I use, does not have an another domain add on system.


Title: Re: Strange SPAM CPU Usage
Post by: Aficionado on December 14, 2016, 10:19:34 pm
At the attachment I have added GODADDY domain add on panel's secreenshoots,
into number 1 when I insert domain name, below number 2 + 3 system is creating itself. ( see secrenshoot " godadd add on "

I see all domains into /public_html/  and /www/ folder. 
Please see secreeshoots. I do not know whether I am doing something wrong but all CPANELS I use, does not have an another domain add on system.

No, i manage a variety of Osclass and Wordpess in 5 well-respected hosting companies. And Add On Domains are created by Cpanel in the same level as public_html.

I'm not saying you lie, just poiting what the problem could be.
Title: Re: Strange SPAM CPU Usage
Post by: Aficionado on December 14, 2016, 10:22:25 pm
Seeing the Capture #3, i understand that you are ALLOWED to select the PATH of the directory and you select to be a subdirectory.

So it is not a Cpanel problem but your choice. It is NOT auto-created but your choice.

Create the addon-domain outside public_html (in the same level as public_html) and move all in there and see if that solve your problems.
Title: Re: Strange SPAM CPU Usage
Post by: mrtsoftware on December 15, 2016, 12:15:25 am
After your warning I have one more time checked add on panel, yes /public_html/ is being created automatically but panel gives option where I can remove /public_html/ ( rename ). Please see secreenshoot at the attachment.

I have already renamed one folder ( deleted /public_html/ ), it is also working there.
Now for this problem occured domain ( nannyturkey.com ) I prefer to wait untill problem repeats again. Last 40 hours did not occur a problem and I amstill obsorving it.

Or should I change directory ( remove /public_html/ right now ) ? What do you recommend?
 



Title: Re: Strange SPAM CPU Usage
Post by: Aficionado on December 15, 2016, 03:00:13 am
After your warning I have one more time checked add on panel, yes /public_html/ is being created automatically but panel gives option where I can remove /public_html/ ( rename ). Please see secreenshoot at the attachment.

I have already renamed one folder ( deleted /public_html/ ), it is also working there.
Now for this problem occured domain ( nannyturkey.com ) I prefer to wait untill problem repeats again. Last 40 hours did not occur a problem and I amstill obsorving it.

Or should I change directory ( remove /public_html/ right now ) ? What do you recommend?

Sorry, i can't help more.

This is more likely a hosting problem, since Osclass doesn't suffer from all that.

Since this is getting hairy, please ask your hosting for more help. They know better.

For me, when i create a addon domain, i can put whatever as Document Root. You say you can't.

Anyway, waiting will not solve your problems, praying also that they also don't come back will not help. I mean .... if you don't get rid/solve those FATAL errors, you wont' be ok.

Title: Re: Strange SPAM CPU Usage
Post by: Aficionado on December 15, 2016, 03:12:12 am
Also this is from Godaddy's support wiki:

Quote
Add addon domains to host multiple websites

If you want to host a website besides your primary domain name, you can use cPanel's Addon domain feature.

Addon Domains are only available for Deluxe and Ultimate cPanel shared hosting accounts. For more information, see What type of hosting account do I have?

    Log in to your GoDaddy account.
    Click Web Hosting.
    Next to the hosting account you want to use, click Manage.
    In the Domains section, click Addon Domains.
    Complete the following fields, and then click Add Domain.
        New Domain Name — Enter the domain name you want to use.
        Subdomain/FTP Username — Enter the FTP username you want to use.
        Document Root — Enter the name of a directory you want to create in the home directory. You'll upload the New Domain Name's files to this directory to make its website display.
        Password & Password (Again) — Enter the FTP password you want to use.

Adding domains to your cPanel account simultaneously creates FTP users for the domain name. This FTP user has access to the domain name's Document Root and all of its subdirectories, but nothing above it.
Title: Re: Strange SPAM CPU Usage
Post by: mrtsoftware on December 15, 2016, 11:10:32 am
Thanks for your help untill now, I will also ask Godaddy when next problem occured.
I have already asked HOSTDIME before, they said that this was a problem of OSCLASS software.
My only aim is to help OSCLAS's bettering, I really liked this project and I would like to contribute OSCLASS and it's users / community.

Therefore I need to be % 100 sure about the source of this error and how to repair or prevent it.
Title: Re: Strange SPAM CPU Usage
Post by: Aficionado on December 15, 2016, 12:08:01 pm

I have already asked HOSTDIME before, they said that this was a problem of OSCLASS software.
My only aim is to help OSCLAS's bettering, I really liked this project and I would like to contribute OSCLASS and it's users / community.

Therefore I need to be % 100 sure about the source of this error and how to repair or prevent it.

I can assure you this is not a problem from Osclass. It is either Hosting or User installation error/problem.

I run 5 Osclass for more than 3 years now, with a few thousands hits per month without a single problem (under two shared high-end hosting plans) and i also maintain a few osclass installations for customers. Works great.
Title: Re: Strange SPAM CPU Usage
Post by: mrtsoftware on June 18, 2017, 06:41:30 pm
I am hosting Osclass more than 10 different datacenters, Yes this problem caused from server side...I have faced this problem only with HOSTDIME HOSTING...

If you also face same problem, move your site to another server.