Support

Joomla! version: 2.5.4
PHP version: 5.3.8
MySQL version: 5.1.52-cll
Host: Arvixe
Admin Tools version: (Pro) 2.2.6

Description of my issue:

My host notified me at 3am this morning that my site has been causing way out of the ordinary memory and MySQL usage, for the past week -- which roughly corresponds with my usage of the Application Firewall, so I'm wondering if something in that part of ATpro is causing it, or someone is doing something malicious to my site that I can't find in the security exceptions log, or if it could be the entire ATPro suite.

I have the firewall configured to send me an email everytime there's a security exception, and there's been a real lot of those, since I have all those old spam usernames that keep trying to login and generating a security exception, and an email to me. Could this be the resource-usage problem?

Please help, I have to talk to Arvixe about this today or they're going to suspend my acct.

Thx,
Andria

PS: it appears that the problem is primarily MySQL, though something is causing the memory usage to go a little higher than Arvixe prefers; here's the table they included in the email to me:

Day CPU % Memory% MySQL Processes
Jun 09th 0.38 6.15 20.5
Jun 08th 0.06 2.76 9.1
Jun 07th 0.09 3.92 13.0
Jun 06th 0.09 3.89 12.9
Jun 05th 0.08 3.58 11.9
Jun 04th 0.08 4.07 13.5
Jun 03rd 0.10 4.15 13.8

As you see, the CPU usage is ok; the memory usage is a bit high; Arvixe says of memory usage:
"Memory %: 0.0-1.0 is Moderate, 2.0 is High, higher than 5.0 is Unacceptable. This is the average percentage of the entire server's Memory used by your account in that day."

But look at that MySQL column -- OMG!! This is what they say about MySQL usage:
"MySQL Usage: 0.0-0.5 is Moderate, 1.0 is High, higher than 1.0 is Unacceptable. This is the average number of Mysql instances you were running at all specific seconds of that day."

Higher than 1.0 is unacceptable -- and I'm running anywhere from 9 to 20 times that! For a whole week! As you can see, I **HAVE** to fix this ASAP; I just hope it doesn't mean that my purchase of ATPro was a waste of money and that I can't use it at all. Could it be all those login failure security exceptions?

Thx!
ABD

Hmm, well I uninstalled it from the other 2 sites I have, as I haven't seen any particular security or any other kinds of problems with those sites; I bought it primarily for CrypticSites to help me with this enormous spammer problem.

For my main Crypticsites, I have turned off sending me an email for every security exception, and I have set it to not treat failed logins as security exceptions. Maybe that will help.

Based on what you said, it would seem to me that someone is doing something nefarious to my hosting acct, that is so subtle all that can be seen is how much it's taxing the system resources. So that is how I will approach it when I call Arvixe, and tell them what you said about AdminTool not being capable of this sort of thing; there really isn't anything else installed in my site(s), and I'm not getting THAT much traffic, so it's got to be some kind of malicious attack -- probably one of those idiots I'm keeping from logging in with both ATPro and http:BL.

This is just strange, to say the least.

Thx!
Andria

Well, I'm not really sure there are any, except maybe for remository with all those downloadable files -- but since I put the new 2.5 site in place, I haven't even had any registered users, nevermind subscribers, so nothing is yet being downloaded (some of my files, my old 1.5 templates, and some fonts and graphics, are still available for free download, but they do require registration).

Other than that, I have Akeeba Backup, but I've run just one backup of the main site since I put it into place and finished configuring it, and you know, that took almost no time at all, even for this large a site (around 65 MB).

I have the JCE editor, but again, no real users, so that's not really being used -- all the articles were in place from the dev site, only one added since June 1.

I have the Kunena forum installed, though not yet fully configured, but again -- no users.

The other 2 sites also get very few users; one is a little known adult site, not much content; the other is my template demo site, and though it has the potential to be a real hog, with more than 30 templates installed, so far, very few have visited, and that site doesn't allow registration at all; it's a very bare-bones "sample data installed" site, to display my templates.

So I really have no earthly idea what, if anything of mine, could be causing this; that's what makes me think "malicious attack."

Oh, the other thing I did, I went and deleted about 6 databases that were no longer being used by any site, just in case those were attracting malicious use.

At this point I'm kinda stumped. My host is in California, which is 3 hrs behind us, so I figured I'd wait till like noon here (it's only about 10:30am right now), and give them a call, instead of trying to tackle a hairy issue like this in trouble-tickets.

Thx!
Andria

No, I'm not using that -- though I did read that article about setting up backups as a cron job, and using that plugin to make it possible, but so far I haven't done anything about that.

So, I'll call them, and see if they have any means of tracking down which specific db is causing all this; right now I have so little info to go on; I've done all that I can think of, to try and fix it, but since I don't know exactly what's causing it, it's difficult to know if those steps will be effective.

Thx,
Andria