discuz 升级到X2.5使用被空间商警告，邮件翻译看不懂，求指点

飞刀123博客

是不是程序出了问题，重装一下。你的流量多大？

搜客80社区

论坛X2.0版本时候没问题的，运行一年多，最近才刚回去管理，升级到X2.5后不久，今天收到GODADDY空间商的邮件和电话，要我解决这问题，要不论坛上不了，以下是邮件内容，翻译了还是不太懂..

The souke80.com hosting account has been disabled for violating Section 3 "Your Obligations" of the Go Daddy's “Web Hosting and Virtual Private Hosting Service Agreement.”

The relevant passage of this agreement has been provided below:

"Go Daddy prohibits the use of software or scripts run on its servers that cause the server to load beyond a reasonable level, as determined by Go Daddy. You agree Go Daddy reserves the right to remove Your web site temporarily or permanently from its servers if Go Daddy is the recipient of activities that threaten the stability of its network."

Go Daddy's "Web Hosting and Virtual Private Hosting Service Agreement" is located at the following URL: https://www.godaddy.com/agreements/ShowDoc.aspx?pageid=HOSTING_SA

The administrators of Go Daddy’s Hosting Operations Center discovered that your hosting account caused an overload of shared resources (CPU) for the server on which it resides. This overload threatened the health of the server and, in turn, threatened the connectivity of other web sites housed on this server. This is, of course, unacceptable. Your services were suspended as a result.

After detecting this problem Go Daddy's hosting administrators requested that Go Daddy's Advanced Hosting Support team notify you of this action and request that you resolve the underlying issue. Unfortunately, we are unable to troubleshoot custom scripting, and therefore, unable to provide a specific solution to you. However the following information has been provided by our server administrators, and should be the starting point for further troubleshooting on your end:

This hosting account was seen to be significantly over-utilizing CPU on the shared server. It appears that this may be due to unchecked forum spamming.

You will need to remove all current unwanted spam and spam users, and implement anti-spam devices such as CAPTCHA, Akismet, etc.

Due to the serious nature of this issue, the 'forum.php' file has been disabled until the issue has been resolved.


Date             Username    # procs   CPU time                Memory Usage
---------- ---------------- -------   ----------------------   ------------------------
2013-01-17       xingye163   28458    9291 secs (0.33/proc)   558.01 GB (20.08 MB/proc)
2013-01-16       xingye163   30258   10439 secs (0.35/proc)   595.02 GB (20.14 MB/proc)
2013-01-15       xingye163   31373   10251 secs (0.33/proc)   615.29 GB (20.08 MB/proc)
2013-01-14       xingye163   25571    7156 secs (0.28/proc)   500.83 GB (20.06 MB/proc)
2013-01-13       xingye163   20629    5410 secs (0.26/proc)   403.51 GB (20.03 MB/proc)
2013-01-12       xingye163   12067    3223 secs (0.27/proc)   236.49 GB (20.07 MB/proc)
2013-01-11       xingye163   12193    3629 secs (0.30/proc)   239.11 GB (20.08 MB/proc)
2013-01-10       xingye163   10345    3059 secs (0.30/proc)   202.59 GB (20.05 MB/proc)
2013-01-09       xingye163   10897    3191 secs (0.29/proc)   213.95 GB (20.11 MB/proc)
2013-01-08       xingye163   12549    3497 secs (0.28/proc)   245.98 GB (20.07 MB/proc)

Top accessed unique URLs sorted by hitcount:
6791 - GET www.souke80.com/forum.php
3301 - GET souke80.com/forum.php
408 - GET www.souke80.com/forum-13-1.html?mod=forumdisplay&fid=13&page=1&page=1[/url]
376 - GET www.souke80.com/forum.php?mod=post&action=newthread&fid=13
251 - GET www.souke80.com/member.php?mod=logging&action=login&infloat=yes&handlekey=login&inajax=1&ajaxtarget=fwin_content_login
207 - POST souke80.com/uc/index.php?__times__=1
160 - GET www.souke80.com/member.php?mod=logging&action=login[/url]
54 - POST www.souke80.com/forum.php?mod=post&action=newthread&fid=13&extra=&topicsubmit=yes
41 - GET www.souke80.com/misc.php?mod=seccode&action=update&idhash=SC9zZ9U0&inajax=1&ajaxtarget=seccode_SC9zZ9U0
40 - POST www.souke80.com/member.php?mod=register
37 - POST www.souke80.com/member.php?mod=logging&action=login&infloat=yes&handlekey=login&inajax=1&ajaxtarget=fwin_content_login
36 - GET www.souke80.com/misc.php?mod=seccode&action=update&idhash=SuuP1Tu0&inajax=1&ajaxtarget=seccode_SuuP1Tu0
36 - GET www.souke80.com/misc.php?mod=seccode&action=update&idhash=Sg5ZZj00&inajax=1&ajaxtarget=seccode_Sg5ZZj00
32 - GET www.souke80.com/misc.php?mod=seccode&action=update&idhash=SFMyv9W0&inajax=1&ajaxtarget=seccode_SFMyv9W0
30 - GET www.souke80.com/vhome.php
30 - GET www.souke80.com/misc.php?mod=seccode&action=update&idhash=ShsdDLN0&inajax=1&ajaxtarget=seccode_ShsdDLN0
30 - GET www.souke80.com/member.php?mod=register.php
30 - GET www.souke80.com/member.php?mod=register
29 - GET www.souke80.com/static/js/logging.js?kBo
29 - GET www.souke80.com/static/js/common.js?kBo
29 - GET www.souke80.com/misc.php?mod=seccode&action=update&idhash=SedxtXS0&inajax=1&ajaxtarget=seccode_SedxtXS0
28 - GET www.souke80.com/misc.php?mod=seccode&action=update&idhash=Syx1O4x0&inajax=1&ajaxtarget=seccode_Syx1O4x0
25 - GET www.souke80.com/misc.php?mod=seccode&action=update&idhash=SPizcI50&inajax=1&ajaxtarget=seccode_SPizcI50
25 - GET [url]www.souke80.com/ad/js/xixi.js
21 - GET [url]www.souke80.com/data/cache/style_1_common.css?kBo

Most active IP's:
6532 - 122.248.247.129
1721 - 198.143.32.1
1348 - 198.143.32.209
1330 - 198.143.33.1
1282 - 198.143.32.177
1115 - 198.143.32.193
1107 - 198.143.32.145
1024 - 198.143.32.161
955 - 198.143.32.129
557 - 149.126.75.1
549 - 198.143.34.1
543 - 149.126.78.1
535 - 149.126.76.1
450 - 198.143.33.193
305 - 103.28.248.3

Please keep in mind that, as the owner of this hosting account, it is incumbent upon you to determine how to best resolve this situation.

FTP access has remained enabled on your account to allow you to address this issue. Once you have done so, your forum may be reactivated by responding to this notice with the following:

1. A statement that you have reviewed and agree to abide by the terms of the "Web Hosting and Virtual Private Hosting Service Agreement".

2. A detailed description of the steps you have taken and/or intend  to take to fully resolve this issue.

3. A statement that you agree to configure your website(s) in such a way as to ensure that there is no recurrence of this issue in the future.

大概是下载过量还是程序问题或是被攻击？正规论坛，访客也不多，最多几十IP。。求指教。

暮木娃娃

超CPU了
程序问题

搜客80社区

暮木娃娃 发表于 2013-1-18 02:01 PM
超CPU了
程序问题

谢谢回复，我的X2。5版本是官方下载更新升级的，那个有没可能网站被挂马还是什么的？这方面的不太懂：
Most active IP's:
6532 - 122.248.247.129
1721 - 198.143.32.1
1348 - 198.143.32.209
1330 - 198.143.33.1
1282 - 198.143.32.177
1115 - 198.143.32.193
1107 - 198.143.32.145
1024 - 198.143.32.161
955 - 198.143.32.129
557 - 149.126.75.1
549 - 198.143.34.1
543 - 149.126.78.1
535 - 149.126.76.1
450 - 198.143.33.193
305 - 103.28.248.3
看连接IP多的都是国外的，新加坡，美国的IP，这个有没影响？

暮木娃娃

搜客80社区 发表于 2013-1-18 02:48 PM
谢谢回复，我的X2。5版本是官方下载更新升级的，那个有没可能网站被挂马还是什么的？这方面的不太懂：
Mo ...

Godaddy的提示是因为你账户超CPU了
你有没有通过袋里访问或者是不是你论坛会员在国外呢？如果没有的话个人觉得建议你重新安装下程序

搜客80社区

暮木娃娃 发表于 2013-1-18 02:59 PM
Godaddy的提示是因为你账户超CPU了
你有没有通过袋里访问或者是不是你论坛会员在国外呢？如果没有的话个 ...

嗯，才想起我网站开了Incapsula的CDN加速，刚查了下那新加坡IP好像就那服务器的，那访问来源应该没什么问题了，就是那个应该不会造成CPU过载的原因吧，我论坛的数据备份都是最近的，重装后恢复的话应该也会一样的，考虑到那网站不用CDN又很多地区访问不了，不懂E文也不知道怎么跟他们交流，在想着换空间了，刚看到站里推荐的LunarPages那个好像还不错，就怕换了还是CPU负载就麻烦了，呵

暮木娃娃

搜客80社区 发表于 2013-1-18 03:27 PM
嗯，才想起我网站开了Incapsula的CDN加速，刚查了下那新加坡IP好像就那服务器的，那访问来源应该没什么问 ...

Godaddy的负载在虚拟主机中已经是比较高的了。建议你检查下你的程序，做做优化什么的