Hi guys,
Out of the blue I'm getting extremely high load on my server every hour.
[2016-01-14 23:33:21] Load average (324.51) is higher than maximum limit of 20
I have handled double the current traffic and more than 3 times the downloads without any issue so I was wondering if it is possible this is an attack to bring my site down.
The script causing the downtime is index_dl.cgi. i understand this is a core function but as mentioned, my server has handled more traffic without any problems.
Your assistance is much appreciated. thanks!
XFileSharing Pro - Unusual high load on server
Check your HTTP Logs, check your "netstat" connection. unusual DDOS connection mostly came from China and dedicated based IP'si.
Normally 1 real downloader open 1-5 connections and after few seconds stay with 1 index_dl.cgi connections.
If you upload last 5000 connection on Apache HTTP log to pastebin similar sites, someone (maybe Im) check it for you.
Another info, i suggest to use "ExtendedStatus On" for real time Apache data.
https://mediatemple.net/community/produ ... -my-server
Normally 1 real downloader open 1-5 connections and after few seconds stay with 1 index_dl.cgi connections.
If you upload last 5000 connection on Apache HTTP log to pastebin similar sites, someone (maybe Im) check it for you.
Another info, i suggest to use "ExtendedStatus On" for real time Apache data.
https://mediatemple.net/community/produ ... -my-server
ri Jan 15 06:32:45 2016] [error] [client 114.111.167.239] [Fri Jan 15 06:32:45 2016] index_dl.cgi: Subroutine AUTOLOAD redefined at /usr/lib64/perl5/POSIX.pm line 38., referer: https://medium.com/
[Fri Jan 15 06:32:45 2016] [error] [client 114.111.167.239] [Fri Jan 15 06:32:45 2016] index_dl.cgi: Subroutine DESTROY redefined at /usr/lib64/perl5/POSIX.pm line 73., referer: https://medium.com/
[Fri Jan 15 06:32:45 2016] [error] [client 190.202.82.238] [Fri Jan 15 06:32:45 2016] index_dl.cgi: Subroutine import redefined at /usr/lib64/perl5/POSIX.pm line 24., referer: https://twitter.com/
[Fri Jan 15 06:32:45 2016] [error] [client 190.202.82.238] [Fri Jan 15 06:32:45 2016] index_dl.cgi: Subroutine croak redefined at /usr/lib64/perl5/POSIX.pm line 32., referer: https://twitter.com/
[Fri Jan 15 06:32:45 2016] [error] [client 190.202.82.238] [Fri Jan 15 06:32:45 2016] index_dl.cgi: Subroutine AUTOLOAD redefined at /usr/lib64/perl5/POSIX.pm line 38., referer: https://twitter.com/
[Fri Jan 15 06:32:45 2016] [error] [client 190.202.82.238] [Fri Jan 15 06:32:45 2016] index_dl.cgi: Subroutine DESTROY redefined at /usr/lib64/perl5/POSIX.pm line 73., referer: https://twitter.com/
[Fri Jan 15 06:32:45 2016] [error] [client 51.255.33.52] [Fri Jan 15 06:32:45 2016] index_dl.cgi: Subroutine import redefined at /usr/lib64/perl5/POSIX.pm line 24., referer: http://search.aol.com/aol/webhome
[Fri Jan 15 06:32:45 2016] [error] [client 58.20.184.187] [Fri Jan 15 06:32:45 2016] index_dl.cgi: Subroutine import redefined at /usr/lib64/perl5/POSIX.pm line 24., referer: https://search.yahoo.com/
[Fri Jan 15 06:32:45 2016] [error] [client 51.255.33.52] [Fri Jan 15 06:32:45 2016] index_dl.cgi: Subroutine croak redefined at /usr/lib64/perl5/POSIX.pm line 32., referer: http://search.aol.com/aol/webhome
[Fri Jan 15 06:32:45 2016] [error] [client 58.20.184.187] [Fri Jan 15 06:32:45 2016] index_dl.cgi: Subroutine croak redefined at /usr/lib64/perl5/POSIX.pm line 32., referer: https://search.yahoo.com/
[Fri Jan 15 06:32:45 2016] [error] [client 51.255.33.52] [Fri Jan 15 06:32:45 2016] index_dl.cgi: Subroutine AUTOLOAD redefined at /usr/lib64/perl5/POSIX.pm line 38., referer: http://search.aol.com/aol/webhome
[Fri Jan 15 06:32:45 2016] [error] [client 58.20.184.187] [Fri Jan 15 06:32:45 2016] index_dl.cgi: Subroutine AUTOLOAD redefined at /usr/lib64/perl5/POSIX.pm line 38., referer: https://search.yahoo.com/
[Fri Jan 15 06:32:45 2016] [error] [client 51.255.33.52] [Fri Jan 15 06:32:45 2016] index_dl.cgi: Subroutine DESTROY redefined at /usr/lib64/perl5/POSIX.pm line 73., referer: http://search.aol.com/aol/webhome
[Fri Jan 15 06:32:45 2016] [error] [client 58.20.184.187] [Fri Jan 15 06:32:45 2016] index_dl.cgi: Subroutine DESTROY redefined at /usr/lib64/perl5/POSIX.pm line 73., referer: https://search.yahoo.com/
[Fri Jan 15 06:32:45 2016] [error] [client 122.96.59.104] [Fri Jan 15 06:32:45 2016] index_dl.cgi: Subroutine croak redefined at /usr/lib64/perl5/POSIX.pm line 32., referer: http://search.aol.com/aol/webhome
[Fri Jan 15 06:32:45 2016] [error] [client 122.96.59.104] [Fri Jan 15 06:32:45 2016] index_dl.cgi: Subroutine AUTOLOAD redefined at /usr/lib64/perl5/POSIX.pm line 38., referer: http://search.aol.com/aol/webhome
[Fri Jan 15 06:32:45 2016] [error] [client 122.96.59.104] [Fri Jan 15 06:32:45 2016] index_dl.cgi: Subroutine DESTROY redefined at /usr/lib64/perl5/POSIX.pm line 73., referer: http://search.aol.com/aol/webhome
[Fri Jan 15 06:32:45 2016] [error] [client 176.112.247.82] [Fri Jan 15 06:32:45 2016] index_dl.cgi: Subroutine import redefined at /usr/lib64/perl5/POSIX.pm line 24., referer: http://secret.com/
does this mean i am getting DDOSed?
[Fri Jan 15 06:32:45 2016] [error] [client 114.111.167.239] [Fri Jan 15 06:32:45 2016] index_dl.cgi: Subroutine DESTROY redefined at /usr/lib64/perl5/POSIX.pm line 73., referer: https://medium.com/
[Fri Jan 15 06:32:45 2016] [error] [client 190.202.82.238] [Fri Jan 15 06:32:45 2016] index_dl.cgi: Subroutine import redefined at /usr/lib64/perl5/POSIX.pm line 24., referer: https://twitter.com/
[Fri Jan 15 06:32:45 2016] [error] [client 190.202.82.238] [Fri Jan 15 06:32:45 2016] index_dl.cgi: Subroutine croak redefined at /usr/lib64/perl5/POSIX.pm line 32., referer: https://twitter.com/
[Fri Jan 15 06:32:45 2016] [error] [client 190.202.82.238] [Fri Jan 15 06:32:45 2016] index_dl.cgi: Subroutine AUTOLOAD redefined at /usr/lib64/perl5/POSIX.pm line 38., referer: https://twitter.com/
[Fri Jan 15 06:32:45 2016] [error] [client 190.202.82.238] [Fri Jan 15 06:32:45 2016] index_dl.cgi: Subroutine DESTROY redefined at /usr/lib64/perl5/POSIX.pm line 73., referer: https://twitter.com/
[Fri Jan 15 06:32:45 2016] [error] [client 51.255.33.52] [Fri Jan 15 06:32:45 2016] index_dl.cgi: Subroutine import redefined at /usr/lib64/perl5/POSIX.pm line 24., referer: http://search.aol.com/aol/webhome
[Fri Jan 15 06:32:45 2016] [error] [client 58.20.184.187] [Fri Jan 15 06:32:45 2016] index_dl.cgi: Subroutine import redefined at /usr/lib64/perl5/POSIX.pm line 24., referer: https://search.yahoo.com/
[Fri Jan 15 06:32:45 2016] [error] [client 51.255.33.52] [Fri Jan 15 06:32:45 2016] index_dl.cgi: Subroutine croak redefined at /usr/lib64/perl5/POSIX.pm line 32., referer: http://search.aol.com/aol/webhome
[Fri Jan 15 06:32:45 2016] [error] [client 58.20.184.187] [Fri Jan 15 06:32:45 2016] index_dl.cgi: Subroutine croak redefined at /usr/lib64/perl5/POSIX.pm line 32., referer: https://search.yahoo.com/
[Fri Jan 15 06:32:45 2016] [error] [client 51.255.33.52] [Fri Jan 15 06:32:45 2016] index_dl.cgi: Subroutine AUTOLOAD redefined at /usr/lib64/perl5/POSIX.pm line 38., referer: http://search.aol.com/aol/webhome
[Fri Jan 15 06:32:45 2016] [error] [client 58.20.184.187] [Fri Jan 15 06:32:45 2016] index_dl.cgi: Subroutine AUTOLOAD redefined at /usr/lib64/perl5/POSIX.pm line 38., referer: https://search.yahoo.com/
[Fri Jan 15 06:32:45 2016] [error] [client 51.255.33.52] [Fri Jan 15 06:32:45 2016] index_dl.cgi: Subroutine DESTROY redefined at /usr/lib64/perl5/POSIX.pm line 73., referer: http://search.aol.com/aol/webhome
[Fri Jan 15 06:32:45 2016] [error] [client 58.20.184.187] [Fri Jan 15 06:32:45 2016] index_dl.cgi: Subroutine DESTROY redefined at /usr/lib64/perl5/POSIX.pm line 73., referer: https://search.yahoo.com/
[Fri Jan 15 06:32:45 2016] [error] [client 122.96.59.104] [Fri Jan 15 06:32:45 2016] index_dl.cgi: Subroutine croak redefined at /usr/lib64/perl5/POSIX.pm line 32., referer: http://search.aol.com/aol/webhome
[Fri Jan 15 06:32:45 2016] [error] [client 122.96.59.104] [Fri Jan 15 06:32:45 2016] index_dl.cgi: Subroutine AUTOLOAD redefined at /usr/lib64/perl5/POSIX.pm line 38., referer: http://search.aol.com/aol/webhome
[Fri Jan 15 06:32:45 2016] [error] [client 122.96.59.104] [Fri Jan 15 06:32:45 2016] index_dl.cgi: Subroutine DESTROY redefined at /usr/lib64/perl5/POSIX.pm line 73., referer: http://search.aol.com/aol/webhome
[Fri Jan 15 06:32:45 2016] [error] [client 176.112.247.82] [Fri Jan 15 06:32:45 2016] index_dl.cgi: Subroutine import redefined at /usr/lib64/perl5/POSIX.pm line 24., referer: http://secret.com/
does this mean i am getting DDOSed?