The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Webalizer possible compromise

Discussion in 'General Discussion' started by wptechno, Sep 7, 2005.

  1. wptechno

    wptechno Active Member

    Joined:
    Jun 10, 2004
    Messages:
    42
    Likes Received:
    0
    Trophy Points:
    6
    when I'm in putty and in "top" I always see one account out of 5 or 6 accounts always rotating at top of list with webalizer running non stop for hours taking up bandwidth. I even get an important warning email from cpanel saying that user has been using up more than 50% of load for more than six hours. I'm constantly doing a killall -9 webalizer every time it pops up. It will rotate through 5 or 6 different users evertime I kill webalizer another user will startup like 10 minutes later. Anyone know what might be happening? The server is still fast though and loads fine. If it's a dos it sure is a lame one compared to past ones where my server has froze. I just want to elimate it as it is taking up bandwidth, load and my time.

    I'm running:
    WHM 10.1.0 cPanel 10.2.0-S83
    CentOS 4.1 i686 - WHM X v3.1.0

    Thanks,
    Ben
     
  2. patryk

    patryk Active Member

    Joined:
    May 3, 2005
    Messages:
    34
    Likes Received:
    0
    Trophy Points:
    6
    Maybe your logs are too big?
    Check also "Delete each domain's access logs after stats run" option in your WHM.
     
  3. wptechno

    wptechno Active Member

    Joined:
    Jun 10, 2004
    Messages:
    42
    Likes Received:
    0
    Trophy Points:
    6
    Thanks for the fast reply!

    Delete each domain's access logs after stats run was already checked.
     
  4. wptechno

    wptechno Active Member

    Joined:
    Jun 10, 2004
    Messages:
    42
    Likes Received:
    0
    Trophy Points:
    6
    Thank you so much. I've done what you said and set it to "2" so we'll see what happens. I just didn't want the load to be consistantly high for no reason on my server.

    How come the default is "0" in whm?

    Also, if I have 2 cpus is the number "2" the correct number? You'd mentioned "3" as well.

    Thank you so much for this response.

    Ben
     
  5. wptechno

    wptechno Active Member

    Joined:
    Jun 10, 2004
    Messages:
    42
    Likes Received:
    0
    Trophy Points:
    6
    After making the changes I just noticed that the load hasn't gone down +100% avg and that the user for webalizer is still just hanging there for hours in top. Why is this the case. I've never seen this before. Wouldn't the stats just kind of do there thing and move on to the next user etc, I don't like this at all.
     
  6. chirpy

    chirpy Well-Known Member

    Joined:
    Jun 15, 2002
    Messages:
    13,475
    Likes Received:
    20
    Trophy Points:
    38
    Location:
    Go on, have a guess
    It is possible that if it sticks on a particular user that that domains logs files contain something that is causing webalizer to loop. If that is the case, then you're probably best off emptying the domains log file in /usr/local/apache/domlogs/userdomain.com with the following:

    >/usr/local/apache/domlogs/userdomain.com

    Then kill -9 that process and see how it continues.
     
  7. wptechno

    wptechno Active Member

    Joined:
    Jun 10, 2004
    Messages:
    42
    Likes Received:
    0
    Trophy Points:
    6
    /usr/local/apache/domlogs/userdomain.com

    these accounts have no data in their logs or very little.

    i.e. here's one that acutally started this whole thing. I mean his account was the one that first started hanging.

    here's what's in his logs:

    IP edited:

    **.194.6.** - - [08/Sep/2005:04:40:16 -0400] "GET / HTTP/1.1" 200 1047 "-" "Mozilla/5.0 (compatible; Konqueror/3.1-rc6; i686 Linux; 20021022)"

    Doesn't that look normal?
     
  8. wptechno

    wptechno Active Member

    Joined:
    Jun 10, 2004
    Messages:
    42
    Likes Received:
    0
    Trophy Points:
    6
    Ok, now I got this email again after those chages:
    ______________________________________________

    IMPORTANT: Do not ignore this email.
    This is cPanel stats runner on servername!
    While processing the log files for user , the cpu has been maxed out for more then a 6 hour period. The current load/uptime line on the server at the time of this email is
    13:27:32 up 7 days, 11:41, 1 user, load average: 2.02, 1.80, 1.70
    You should check the server to see why the load is so high and take steps to lower the load. If you want stats to continue to run even with a high load; Edit /var/cpanel/cpanel.config and change extracpus to a number larger then 0 (run /usr/local/cpanel/startup afterwards to pickup the changes).

    _______________________________________________

    On top of that, there were two user accounts hanging in top view w/webalizer.

    I'm about to just disable webalizer and use awstats but then again, I got a dos using awstats too. I think my stats and how they process are all messed up on my server.
     
  9. wptechno

    wptechno Active Member

    Joined:
    Jun 10, 2004
    Messages:
    42
    Likes Received:
    0
    Trophy Points:
    6
    Thanks Bailey for the detailed explaination. Actually that was a dos on another box that I was referring to in the last post giving reason to why I was using webalizer and not awstats. someone used a cpanel user's account and ran a script in awstats to cause a dos attack. But that's a different story.
     
  10. jurgenbos

    jurgenbos Registered

    Joined:
    Jan 14, 2004
    Messages:
    1
    Likes Received:
    0
    Trophy Points:
    1
    I also received some of these mails from the C-panel statsrunner. Server load was going up and down at the most odd moments. After looking at the top processes i found out the my.cnf configurationfile was heavy for the machine (but necessary).

    After adding 512 MB's of ram the problem is gone. The server runs much smoother now and i can keep the my.cnf configuration.
     
  11. netlook

    netlook Well-Known Member
    PartnerNOC

    Joined:
    Mar 25, 2004
    Messages:
    335
    Likes Received:
    0
    Trophy Points:
    16
    I also run CentOs 4.1 and also have problem with webalizer processing stats for some users. Is there any way to solve this? Maybe cPanel stuff should take a look at it?

    Thanks
     
  12. jester.ro

    jester.ro Well-Known Member
    PartnerNOC

    Joined:
    Feb 6, 2004
    Messages:
    304
    Likes Received:
    0
    Trophy Points:
    16
    Location:
    Bucharest, Romania
    cPanel Access Level:
    DataCenter Provider
    there's nothing wrong with this situation.

    you can tweak the server to make it a little faster when processing logs.


    what i did on my servers:

    use the cpanel addon to configure stats. I allow only awstats, as it's much better than webalizer, and gives more info anyway. So i removed analog and webalizer. That left me with only one stats run per domain.

    Next, i set stats running times to be during the night (actually between 11 PM and 8 AM), and set it to run 2 times/day. (set to 0.5). That way, it's supposed to run once at abount 11 PM, and once in the morning. By doing this, you take care of the problem during the day, when stats shouldn't run.

    One thing that could GREATLY increase running times is setting DNS Resolution to "Off" for awstats. Of course, your clients might need this very much, so maybe it's not an option for you.

    Also, if yo have clients that are not interested in statistics at all (maybe they have other ways of tracking visitors), and they are producing huge stats files, just edit the vhosts in httpd.conf and set their domlogs to /dev/null
     
  13. netlook

    netlook Well-Known Member
    PartnerNOC

    Joined:
    Mar 25, 2004
    Messages:
    335
    Likes Received:
    0
    Trophy Points:
    16
    I know that awstats are better, but on all my server there is only Webaliser. To solve this problem I deleted current /tmp folders for that users who has problems with stats and manually run /scripts/runweblogs for those accounts.

    Thanks
     
  14. porcupine

    porcupine Well-Known Member
    PartnerNOC

    Joined:
    Apr 18, 2002
    Messages:
    74
    Likes Received:
    0
    Trophy Points:
    6
    Location:
    Toronto, Ontario
    cPanel Access Level:
    DataCenter Provider
    I've been having the same problem (and ignoring it primarily) on a few of our dual xeons. Webalizer gets stuck in a loop/crashes somewhere and is chewing 99.9% cpu, on logfiles that are tiny, or empty alltogether.

    eg:
    I've seen this across three servers going on for 1+ months. With the dual xeon's, its generally just a nuisance (4 virtual procs, they're nicely underloaded, so we can just let it drift every now and then), so its reproducable (just 'wait' for it), and I'm a bit surprised nobody else is running into this. Ticket time I suppose =\.
     
Loading...

Share This Page