PHP Abuse

Customer Support Customer Only Discussion
1

I’ve been notified (for the second time now) that one of my websites is in violation of the TOS for PHP abuse. The claim is that there are many (30-40) php processes opening for my website at a time causing high CPU usage. The website in question has been running with the same PHP code without problems for well over a year. Also, the only PHP on this website is the counter (on one page), guestbook, and a php admin script which is rarely used. The other 95% of the website is just HTML/JS. If I had to guess, the issue is with the Guestbook, but why is it now all of a sudden causing an issue?

After the first occurrence on Sept 11 I tried to get assistance from Jodo support, but the thing they keep telling me is “check your code and fix it†and look at the logs to find the error. I was advised to move my site from Windows to Linux if I wanted to use PHP heavily, but it doesn’t use it heavily. Jodo turned PHP back on later that day and there hasn’t been an issue again until yesterday morning.

So now I’m back to where I was before… “please check your code and fix it†“you can find the issue in the log fileâ€. Perhaps I’m asking too much of support for assistance in isolating the issue. I’m usually pretty happy with support here, but in this instance I’m starting to lose my patience. They gave me a time-frame between 10:00 and 11:00 a.m., however they emailed me at 10:24 a.m. to tell my they disabled PHP on my site. I’ve looked through the log file and I don’t see anything alarming in it.

Can somebody else please browse my log file and tell me if they can see what might be causing my issue? I would greatly appreciate any help from my fellow resellers.

http://www.cliffseals.com/log.txt

Thanks,
Cliff

2

look at around this time:
10:08:23

3

Hi Stephen,

Thanks for responding. I see a request being made to “index.php” by the same IP around that time (multiple times) which resulted in a 400 Error (Bad Request). Does a 400 error really indicate that there’s “bad code”? Can you help me understand exactly what’s going on at the 10:08 mark that’s causing a problem? The php counter running on the home page has been in place for at least 2 years and hasn’t been a problem.

Thanks,
Cliff

2008-10-03 10:08:09 65.24.144.49 - W3SVC1018 ABJH-WIN10 204.14.108.240 80 GET /index.php - 400 0 2171 411 96063 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+en-US;+rv:1.8.1.17)+Gecko/20080829+Firefox/2.0.0.17 - - 2008-10-03 10:08:23 122.109.255.64 - W3SVC1018 ABJH-WIN10 204.14.108.240 80 GET /lovemisc/page3.html - 500 1229 0 622 0 HTTP/1.1 Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+6.0;+SLCC1;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.04506;+InfoPath.1) - http://www.holliesquotes.com/lovemisc/page2.html 2008-10-03 10:08:24 204.186.226.163 - W3SVC1018 ABJH-WIN10 204.14.108.240 80 GET /quoteoftheday.html - 304 0 213 584 64593 HTTP/1.1 Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+5.1;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727) - - 2008-10-03 10:08:24 65.24.144.49 - W3SVC1018 ABJH-WIN10 204.14.108.240 80 GET /index.php - 400 0 2171 411 155281 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+en-US;+rv:1.8.1.17)+Gecko/20080829+Firefox/2.0.0.17 - - 2008-10-03 10:08:23 64.254.66.26 - W3SVC1018 ABJH-WIN10 204.14.108.240 80 GET /lovesad/page5.html - 200 0 21246 531 90609 HTTP/1.1 Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+.NET+CLR+1.1.4322;+InfoPath.1) - http://holliesquotes.com/lovesad/index.html 2008-10-03 10:08:24 65.24.144.49 - W3SVC1018 ABJH-WIN10 204.14.108.240 80 GET /index.php - 400 0 2171 411 155266 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+en-US;+rv:1.8.1.17)+Gecko/20080829+Firefox/2.0.0.17 - - 2008-10-03 10:08:24 65.24.144.49 - W3SVC1018 ABJH-WIN10 204.14.108.240 80 GET /index.php - 400 0 2171 411 155281 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+en-US;+rv:1.8.1.17)+Gecko/20080829+Firefox/2.0.0.17 - - 2008-10-03 10:08:24 65.24.144.49 - W3SVC1018 ABJH-WIN10 204.14.108.240 80 GET /index.php - 400 0 2171 411 155281 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+en-US;+rv:1.8.1.17)+Gecko/20080829+Firefox/2.0.0.17 - - 2008-10-03 10:08:24 64.151.172.165 - W3SVC1018 ABJH-WIN10 204.14.108.240 80 GET /index.php - 400 0 2171 368 157422 HTTP/1.1 Mozilla/5.0+(Macintosh;+U;+Intel+Mac+OS+X+10_4_11;+en)+AppleWebKit/525.18+(KHTML,+like+Gecko)+Version/3.1.2+Safari/525.22 - - 2008-10-03 10:08:24 65.24.144.49 - W3SVC1018 ABJH-WIN10 204.14.108.240 80 GET /index.php - 400 0 2171 411 156094 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+en-US;+rv:1.8.1.17)+Gecko/20080829+Firefox/2.0.0.17 - - 2008-10-03 10:08:29 65.24.144.49 - W3SVC1018 ABJH-WIN10 204.14.108.240 80 GET /index.php - 400 0 2171 411 180016 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+en-US;+rv:1.8.1.17)+Gecko/20080829+Firefox/2.0.0.17 - - 2008-10-03 10:08:29 65.24.144.49 - W3SVC1018 ABJH-WIN10 204.14.108.240 80 GET /index.php - 400 0 2171 411 179281 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+en-US;+rv:1.8.1.17)+Gecko/20080829+Firefox/2.0.0.17 - - 2008-10-03 10:08:30 64.107.84.170 - W3SVC1018 ABJH-WIN10 204.14.108.240 80 GET /index.php - 200 0 0 549 123563 HTTP/1.1 Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+6.0;+SLCC1;+.NET+CLR+2.0.50727;+Media+Center+PC+5.0;+.NET+CLR+3.0.04506) - -