Mystery bandwidth problems..

Hello,

I just received a huge overage bill for my bandwidth.

I had previously asked about high loads and slow speeds on my server, and I think this has alot to do with it.

Basically, I had an account that was no longer in use but it seemed to be showing up under multiple unrelated domains (the ~user/ account). I had a look through my bandwidth today, and this sub domain had used 360gig of bandwidth already this month. My entire server only uses about 200 gig a month normally. Last month I was upto 1200 gig which is 200 gig over my alotment.

I terminated the account, but I did this once before with another account and it seemed to just pass over to this new account.

Does anyone know why it's going through crazy bandwidth like this, or how to stop it. It basically ate all my profits for this month and had my server pinging at 1000 ms with server loads at 20 or higher all month. I have to stop this right away, but my support for the server seems useless. I have asked them over and over to help me find the cause of this and they keep sending me in circles (run upgrade scripts, mitage usage, upgrade your connection, all of which I've done to no avail.). Is it possible my server has been compromised somehow? Is there any way for me to see what files are causing the mass bandwith usage?

I noticed after I deleted the account in WHM the bandwidth usage disappeared. Why did this happen?

Please help me as I'm not really sure where to turn. Cpanel allowed this account to use 400% of it's bandwidth which didn't help matters at all.

Maybe this will help you a bit:

In WHM:

Server Setup > Tweak Security > mod_userdir Tweak

Quote:

---

Apache's mod_userdir allows users to view their sites by entering a tilde(~) and their username as the uri on a specific host. For example http://test.cpanel.net/~fred will bring up the user fred's domain. The disadvantage of this feature is that any bandwidth usage used by this site will be put on the domain it is accessed under (in this case test.cpanel.net). mod_userdir protection prevents this from happening. You may however want to disable it on specific virtual hosts (generally shared ssl hosts.)

---

Thanks,

I'm going to try that. The server burned through 30 gig of bandwidth today.

Thanks again.

MRTG is your friend ..i keep 3 monitors in my office that refresh all my MRTG screens on several servers. Turn ON the bandwidth exceeders suspension and emails and there is also a program that works like TOP that is for bandwidth in real-time ..I think rfx has a link to it on his site.

I think I figured this out, it was someone sharing illegal files but for some reason the usage was not showing up under their account as they were using the ~/user account to share the files, and not the domain. For some reason the server was placing this under another ~/user. I suspended all of the accounts involved and hopefully this corrects the problem.