CPU exceeded... DOS attack?

[Raph]

On 1/24 and previous, I had virtually no reports of problems in my logs. I'd had some issues with slow SQL queries from time to time (I run a pretty popular WordPress blog), but nothing too dramatic.

On 1/25 and since, my cpu_exceeded_logs are full. Like, from 0k I have gone to

2007-01-25.log 85 k
2007-01-26.log 268 k
2007-01-27.log 50 k
2007-01-28.log 410 k
2007-01-29.log 317 k (this is just so far today!)

I added WP-Cache to my installs. I removed some plugins from my site. I upgraded to WP 2.1. None of it seems to have made any difference, really.

The result is constant unavailability of the site, as I trigger the CPU utilization suspension.

The cpu exceeded logs look like this:

Mon Jan 29 15:14:36 2007: used 0.05 seconds of cpu time for HTTP Request: www.raphkoster.com : GET /wp-content/plugins/live-comment-preview.php/commentPreview.js HTTP/1.1
Mon Jan 29 15:14:37 2007: used 0.07 seconds of cpu time for HTTP Request: www.raphkoster.com : GET /wp-content/plugins/flags/flag_de.gif HTTP/1.1
Mon Jan 29 15:14:37 2007: used 0.06 seconds of cpu time for HTTP Request: www.raphkoster.com : GET /images/widefill.jpg HTTP/1.1
Mon Jan 29 15:14:40 2007: used 0.39 seconds of cpu time for HTTP Request: www.raphkoster.com : GET /areae/wiki/tiki-index.php?page=Business HTTP/1.1
Mon Jan 29 15:14:43 2007: used 0.38 seconds of cpu time for HTTP Request: www.raphkoster.com : GET /areae/wiki/tiki-index.php?page=Potential+partners HTTP/1.1
Mon Jan 29 15:14:44 2007: used 0.51 seconds of cpu time for HTTP Request: www.raphkoster.com : GET /2005/12/12/the-future-of-content/feed/ HTTP/1.1
Mon Jan 29 15:14:44 2007: used 0.72 seconds of cpu time for HTTP Request: www.raphkoster.com : GET /2006/12/15/announcing-areae/ HTTP/1.1
Mon Jan 29 15:14:45 2007: used 0.04 seconds of cpu time for HTTP Request: www.raphkoster.com : GET / HTTP/1.1

I called support on Sunday, and was told that it just looked like the site has crossed some threshold and was just a bit too popular for the shared hosting.

For comparison, these are my daily stats reported by Webalizer. As you can see, the stats before and after the CPU load problems are pretty comparable -- in fact, they're higher earlier in the month.

Day Hits Files Pages Visits Sites KBytes
22 92532 3.83% 74636 3.75% 15196 3.17% 7792 3.67% 5557 7.43% 1429379 3.50%
23 161079 6.67% 137852 6.93% 20109 4.19% 10151 4.78% 7471 10.00% 2301545 5.63%
24 108496 4.49% 91006 4.57% 21032 4.38% 9159 4.31% 6387 8.55% 2073752 5.07%
25 86156 3.57% 71544 3.59% 17489 3.64% 8641 4.07% 5828 7.80% 1572410 3.85%
26 77583 3.21% 64505 3.24% 17359 3.62% 8346 3.93% 5642 7.55% 1416050 3.46%
27 66050 2.73% 55036 2.77% 15577 3.24% 7702 3.63% 5214 6.98% 1169107 2.86%
28 69142 2.86% 58317 2.93% 17648 3.68% 9230 4.35% 6789 9.08% 1309004 3.20%

So, does something look fishy? I don't see how I could have suddenly tipped over to such high load. One poster on my website suggested that perhaps it was a DDOS attack of some sort.

I apologize to everyone else on box 50, btw. ;) I am sure this is frustrating them as much as me!

[borderline]

The cpu exceeded logs look like this:





where do you see the cpu logs? I can't find them :confused:

[Raph]

In cPanel, choose "File manager."

Then look in /tmp/cpu_exceeded_logs for the files.

[teddydov]

I have been having the same issues in the past week. My issues also started on the 25th and today they reached the point where they shut me off. I am not sure what triggered it but I am on Box 45 and don't have nearly as many visitors as you do (about 400-600 a day).

Does any one have any idea what is going on??

[Angelspit]

I have the very same problems since January 25th! I feel so much better knowing that I'm not alone.

I had CPU problems a couple of times in the past year, but there was always a bad script somewhere that was causing the issue. But since last Thursday, I had to disable my forums completely to keep my front page online, and I still get a couple of CPU Quota errors anyway.

Let's hope that BH figures out what is causing this.

[mrsam]

My site has previously exceeded the cpu quota every now and then because of heavy traffic!
But this problem has become persistent starting January 25th.
Since then, My site is going down many times per day eventhough I have installed a fresh copy of my PhpBB, and visitors have become much less because of the down time I spent refreshing and cleaning my scripts!!

Weird huh?

Maybe the CPU Quota was reduced on this date "Jan 25th"

I hope that bluehost has the right answer for our questions!!

[indy2kro]

Same thing happened for my site (http://funhouse.bubble.ro)and as well starting from january 25th .. Bluehost support says everything's working fine, but then why is this happening to so many people?

[Angelspit]

I told tech support on the phone that it was strange that many people have been experiencing problems since the 25th. He replied that my site was not on the same box as the poster above, so the two issues were not connected. In my case, according to him, that's just my site getting too many request simultenously. However, my traffic has been decreasing from 11,000 unique visitors a day last June to less than 4,000 this week.

My guess is that they are enforcing more severe CPU limits. I'm very disappointed that they leave me with no other option than to move. :(

[ChgoBrad]

Was on a live chat with a tech for 2 hours. she was having a level 3 look at my site, as I was having empty logs so could not debug on my end...here is what she said:

lmoksha: k it looks like the admins just had to debug some script and the issue has been resolved so you should be fine in the future
Brad: so the issue want with the scripts on my account at all?
lmoksha: no it was something on here

[mrsam]

I spent a great time here with you guys!

20 great months of wonderful services and great support!!

Blue Host has been a legend!! But not anymore!!

[mrsam]

That's what I got in a 25 min Live support chat session!!
"CPU exceeded Error" Section!

Blue Host Support: Hello! My name is Blue Host Support. How may I help you?
Sam: I need to know what happened on jan. 25th please, everything was smooth before this magical date!
Blue Host Support: Due to the hign amount of chats taken, yours will be answered in the order it came. Thanks for your patience.

5 min later
Blue Host Support: Alright what happened jan 25
Sam: the CPU Quota Exceede msg starting jumping every 5 mins
Sam: and it takes 5 min to reactivate
Sam: so my site is practically down
Sam: the CPU Quota Exceeded msg started jumping every 5 mins*
Sam: As if you are giving us all the resources we dream of and we are not allowed to use them!!
Sam: A huge bottle with a tiny little neck :s
Blue Host Support: Let me see what I can find out for you

10 min Later
Sam: now u don't even have the time to answer!! Good luck on the huge grow of Bluehost, really!! But A king needs people to rein! right? people are falling apart from your kingdom and I am seriously considering moving!
Blue Host Support: ...Yeah. Ok
Blue Host Support: I'm checking to see what I can do for you.
Sam: keep checking man!! i asked a simple question; what happend on jan 25, ain't no rocket scientist needed here!!
Blue Host Support: Well I can tell you that we have not throttled more when it comes to cpu usage Sam. It's not like we are doing this to get you angry

I guess I was a bit rude! But he was toooo polite to give me an answer :confused:

[areidmtm]

He has SEVERAL chats going at once. As he said it may take time for him to see whats going on. He may even have to ask a higher level tech to find out the problem. Just calm down. They can't help you very well when you wont give them the time to find it out.

If you want leave bluehost, then get a refund, but I guarantee that you'll find the same problems other places.

[agcssautomotive.com]

Dude, if you want drama and fighting join a girl's fight club, or mud wrestling.

Your talking skills absolutely none existent. Learn some sosuave for your own sake.


Your problem, and given that you cant control yourself while chatting, is best answered over the phone. Because Im sure you will be able to explain your situation better and at the same time wont go bullistic like its that time of the month again.


1 888 401 HOST... Put them on speaker, and let them take care of you. Its just like getting a massage, you sit back and relax.

[crosby]

i have the problem describ in this post. But my account is deactivated ... The only explanation is " too much DDoS attack" ... maybe because I dont have beret :D but in my case "support" says : " say bye,bye from your account" . I consider is not my mistake. In this day I try to send an email to reconsider hers position regard my account. If someone is in this situation pls contact me. Best regard and ... good hosting ... elsewhere

[Rusted]

Same on my site. Can anyone tell me what has to happen to get a 20% cpu error message? The log files show slow queries, but when I duplicate them they work fast. I don't belive it is my site, or the queries, but some back end process at bluehost that using up cpu and causing my users errors.

[Angelspit]

mrsam was indeed rude during his chat, but the fact remains that something happened on January 25 and BlueHost blames it on the code of our sites and/or our traffic. I understand that some of our sites are fat, resource-intensive and perhaps not suitable for shared hosting, but after two years of good performance and BlueHost giving away more bandwith that we might possibly need and promising better performance, why should have we changed anything?

Telling us ahead of time that more severe CPU restrictions were coming would have been appreciated. We wouldn't have wasted hours on a pointless witch hunt, trying to find that bad script that simply doesn't exist. I'm saying this because I see other members here having the same questions I had recently, and possibly wasting their time opening support tickets. They deserve to know what is going on.

[walshb6413]

I came to the forums looking for answers regarding this as well... I've had no problems until recently, the only thing I run that is intensive is Gallery2, which they have on Fantastico...

This is really very very annoying and something needs to be done, we at least need to know what's going on! :confused:

(I'm on box 58)

[teddydov]

has anyone actually had any luck finding out what is causing this?? does anyone know who I should talk to?? How can we get the Bluehost "officials" to come over and take a look at this post, so they can see that something is going on!

If anyone has a solution (including Alternative Hosts) please let me know!! I cannot afford the down time - or worse the Suspension of my site.

[indy2kro]

It seems the cpu exceeded quota messages have only multiplied in the last days although it doesn't have anything to do with website traffic.

What seems to be even MORE interesting is that the cpu itself isn't used more than 4-5% most of the time. And this is on the overall system (linux 'uptime' command was used). I've even made a script to try and monitor the system load: http://www.c00lstuff.com/healthy/stats.php and except for some small spikes (which do NOT reflect my website traffic in any way), the cpu quota doesn't even go close to 20%.

Needless to say I got the exceeded cpu quota message at least 15 times a day.

This is why it is my belief that there is a problem with their script that causes the error, the quota level is far less than 20% or there is another factor taken into consideration.

And of course, on top of this, the support guy which seems to be in charge with the exceeded cpu quota is not capable of saying anything other than a copy/paste from a help file.

I tried to talk to some other guys from the support team and of course he said they'll look into it.

Now, I've been most satisfied with Bluehost until now, but this type of problems is unacceptable. I agree that some kind of cpu quota limitation should exist, but it should work properly, it should reflect the actual cpu load and not block a website for no reason.

Of course, this is not the most apropriate place to write down about frustrations related to the way Bluehost is handling this issue, but since they didn't do anything about it, I hope it might at least open their eyes and see something's wrong (and yes, I did tell the support team this as well).

[Gixxer]

When will this all stop? I have contact BH Support twice about this same issue and they claim nothing has changed on their servers. That's a load a BS! I haven't had an 'CPU exceeded' error message in almost 2 years and now all of a sudden I'm getting them every 15 minutes. All they do is direct you to the cpu_exceeded_logs files and try to tell you that it's someone or something hitting your site that's causing the problem.

BH be honest, we're not all stupid around here. Something changed, you know it did, otherwise no one here in this thread would be complaining of the same **** issue!

[saosangmo]

Today, i got the message "This Account Has Exceeded Its CPU Quota" many times.

And now, I'm going crazy because there is the only me browsing my site at the time i get the message.

i'm on box194.

[JoaoJose]

I started having the same problem around the 25th also. I even cached my pages and the problem still remains. I was thinking of getting a new account for serving just images but I think I won't after reading this. Either there is some bug on bluehost's end or they're enforcing tighter restrictions and ain't telling us.

I'll guess I'll have to find another host ,which is sad because I was really happy
with bluehost.

[Jennifer85]

^Yes I know where all you guys are coming from, the most upsetting part is the way the customers are treated. No explanation, just a 'deal with it' attitude, which is SO wrong, I paid money for this account and when I see things like this, I feel like its been severly wasted. Reason why I too will change hosts, not because of the account, but the utter disregard for customer feelings.

[magpie2419]

^Yes I know where all you guys are coming from, the most upsetting part is the way the customers are treated. No explanation, just a 'deal with it' attitude, which is SO wrong, I paid money for this account and when I see things like this, I feel like its been severly wasted. Reason why I too will change hosts, not because of the account, but the utter disregard for customer feelings.

Very Ironic you should say that read the latest post by Matt the CEO of Bluehost. http://www.mattheaton.com/ ;)

[Early Out]

Very Ironic you should say that read the latest post by Matt the CEO of Bluehost. http://www.mattheaton.com/ ;)It seems to be down right now. He must have exceeded his CPU quota. ;)

Edit - Now it's back again.

[Jennifer85]

Very Ironic you should say that read the latest post by Matt the CEO of Bluehost. http://www.mattheaton.com/ ;)

Oh really, did I get an email? no, where is this even posted on the forum? AND YES I'VE LOOKED.

[magpie2419]

Oh really, did I get an email? no, where is this even posted on the forum? AND YES I'VE LOOKED.

Im sorry but I think you didnt understand my point, you mentioned customer support and lack of it at Bluehost. I posted a link to the CEOs blog where he talks about customer service being the most important thing, Ironic because his own customers (or some of them) are complaing about poor customer service.

[Jennifer85]

Im sorry but I think you didnt understand my point, you mentioned customer support and lack of it at Bluehost. I posted a link to the CEOs blog where he talks about customer service being the most important thing, Ironic because his own customers (or some of them) are complaing about poor customer service.


Im sorry, I should be redirecting that to Matt, who'll probably hire his representives to post something different, like I said, Im sorry, its just im losing traffic because of this crappy problem. (which btw isnt mentioned in the promo before you join.)

[areidmtm]

Im sorry, I should be redirecting that to Matt, who'll probably hire his representives to post something different, like I said, Im sorry, its just im losing traffic because of this crappy problem. (which btw isnt mentioned in the promo before you join.)

This is a user to user forum. BH employees do not come here.

Also, Matts blog IS posted within this forum. There are some thread out there and if you look in my signature, it's there. It's also on the main page of www.bluehost.com

If you were talking about the link to his blog...if not, then disregard :)

[agcssautomotive.com]

Rule #1, never say you sorry to a chick, unless you really screwed up. ;)


Rule #2, she should be saying sorry to us, because customer support indeed works flawlessly. You can either call them, or chat on the web. They have an excellent resolution percentage. It is very rare to call them and not get things done. If you weren't aware of this, that means you not even trying to call them, or you dont know how to communicate and explain your issues. :eek:

[demetris20]

ok i get the message 2 after 25th of january
the problem have a solution
i have phone to bluehost and they told me that:
i can pay $20 per month and upgrade me to a higher version of cpu quota

so...now you know we all of us have the same problem

[Angelspit]

I just want to quote the message Matt Heaton sent on January 18th, exactly one week before the massive increase in CPU problems:

"We finally have some good news to report. After literally months of research into system performance techniques and I/O tuning we have rolled out a series of changes to our servers that have immediate and beneficial effects. By the time you read this the server that hosts your website should have a decreased server load of between 100-300%. This means that for those users that experienced constant performance problems with our server speeds that your problems should be significantly reduced. (...)

Things are improving and long term problems are starting to subside. Thanks for sticking with us as we look forward to the continuation of improvements that are sure to come!"

I'm still trying to understand what happened...

[highnfar]

that's a stupid policy..

[Jennifer85]

Rule #1, never say you sorry to a chick, unless you really screwed up. ;)


Rule #2, she should be saying sorry to us, because customer support indeed works flawlessly. You can either call them, or chat on the web. They have an excellent resolution percentage. It is very rare to call them and not get things done. If you weren't aware of this, that means you not even trying to call them, or you dont know how to communicate and explain your issues. :eek:

Different strokes for different folks mate, maybe it works flawlessly for you but you're not everyone, so don't speak for us all. I also do not live in the US of A just to pick up the phone and just call them, do they have international number?

[Early Out]

I also do not live in the US of A just to pick up the phone and just call them, do they have international number?No, but you might try using live chat, instead. No guarantee that you'll get your problem resolved, but it's worth a shot.

[Kay]

I am a webmaster for a non for profit organization and I also moved my own website here.

While I don't remember the exact date, I was backing up MYSQL database and home directory, then I was restoring one and I get these CPU errors. It was very agravating.

Now I go to board meetings or regular meetings and I even get phone calls from people telling me the site is down.

The site is using Xoops from the Fantistico!

I emailed support and they say it is a problem of my script! But the script is offered by BH.

Then I come here and read this. And now I am angry. Being webmaster is a elected position and the majority of the members think I don't know what I am doing.

The other times it happened was when 3 people were in the Flashchat room, they all got booted and the website was taken away again.

This seems so unfair at the moment. I have no idea what I can do.

[stephen]

I was just checking out the forum, and saw this thread. Perhaps I can clear a couple things up, A change was made in the CPU_exceeded script that was basically not suspending anyones site. This had been going on for a couple months before we discovered it looking over HighLoads on the server and noticing accounts that should have been suspended. The correction was made and lo and behold sites that had nothing for months were now triggering the limit.

The posting that the CEO made about changes had nothing to do with this. They were changes in the kernel to lower io and overall load. We are constantly looking for ways to enhance and improve the services we offer.

Another point of interest is Fantastico, its a great product it gives any user the power to put together a forum or any other advanced program. However its not always optimized and can be too big for its briches, if you install a bunch of pluggins and or addons this can generate an enormous load. We have also seen php code that isnt terminating properly sit there chewing your % of cpu and resources.

When you are seeing this, if you swear up and down that your site fine, example static html and getting these, do live chat or call in and find out what the health of the box is then. That can go a long way in helping us trackdown issues.


PS we are thankful for those sticking with us, and helping with tracking down these issues. As Matt states over and over in his BLOG, "CUSTOMER Service and satisfaction" is of the utmost importance.

-s

[indy2kro]

Is it possible then to add to the CPU_exceeded logs also the output of 'uptime' command then, or perhaps some other script to prove that it was indeed triggered some kind of an exceeding quota? Or how can you explain that an account gets suspended for exceeding CPU quota which is suposed to be 20% and the 'uptime' command shows less than 5% ?

[Angelspit]

This had been going on for a couple months before we discovered it looking over HighLoads on the server and noticing accounts that should have been suspended. The correction was made and lo and behold sites that had nothing for months were now triggering the limit.
Oh, the time we would all have saved had tech support told us that two weeks ago! I appreciate that you take the time to post here, but now could you share that information to your tech support representatives? PLEASE?

[ajsloan]

I have also received this message for my site at austinsloan.com (http://austinsloan.com) over the past 2 months. Never had it happen before that. I have my own sites plus several clients I have setup Bluehost accounts for and they need their sites running to be successful businesses. I am getting tired of having to explain to them why their customers keep receiving these messages.

I was told I had a lot of visitors at my site. I don't think 100 visitors is a lot. I would hope that my CPU allowance would be higher.

I guess this is a message call to start looking for a new host. I've been impressed with Bluehost up to this point but telling me that I am exceeding the CPU quota with only 100 visitors leads me to believe that I need a host who can handle more.

I also want to switch to a host that offers FFMPEG.

Any recommendations on a new host?

[magpie2419]

A lot of the hosting companies of today have brought these problems onto themselves, they offer ridiculous amounts of space and bandwidth that encourage people to use stuff on their websites (through Fantasticrap) that they really should not be using on a shared enviorment.

Bandwidth and diskspace on shared hosting plans with the big hosting companies are just marketing terms. Nobody uses 200GB of storage and 1.8 Terabytes of bandwidth on a shared plan, the actual limits are the CPU/Memory usage rules hidden away in the companies TOS/AUP.

You usually find this out only once you have paid up front and all your sites are fully up and running.:eek:

[Jennifer85]

I have also received this message for my site at austinsloan.com (http://austinsloan.com) over the past 2 months. Never had it happen before that. I have my own sites plus several clients I have setup Bluehost accounts for and they need their sites running to be successful businesses. I am getting tired of having to explain to them why their customers keep receiving these messages.

I was told I had a lot of visitors at my site. I don't think 100 visitors is a lot. I would hope that my CPU allowance would be higher.

I guess this is a message call to start looking for a new host. I've been impressed with Bluehost up to this point but telling me that I am exceeding the CPU quota with only 100 visitors leads me to believe that I need a host who can handle more.

I also want to switch to a host that offers FFMPEG.

Any recommendations on a new host?

http://startlogic.com/index.html haha.;)

[areidmtm]

This thread was closed because this is just going on and on. If you continue to have problems with CPU errors, then you will have to optimize your script or contact support. No one here can do anything about the CPU issues and there is nothing left to gain from this thread. The admins of BH rarely come here. I am very surprised to see a tech support posted in this thread, that never happens. If that tech support happens to come back and post they still can and has the option of opening this back up.

This thread may have some useful or interesting information, but it's not going to stay that way and it's already starting to diminish.

If you need help optimizing your scripts and MySQL, then posts a thread and we can help you do that.