Website Using Too Many Resources

[xata11]

Hello, I am seriously having issues on my mysql I have 2 sites running on my current vps server, But Site A is using almost all my resource, I duplicated the database and make a new site B out of the first one.

but it seems the site A is been hitted heavily when I run top command,

Both site A and B have less traffic maximum of 10 users online, but when I run top command I find out that site A is using almost all my resource, while most of the time I dont even see site B on top c command. Now I did a 301 redirect, I redirect site A to site B just for a test, and I find out that Site B is now heavily using my resources, almost all of them, just as what site A has been doing, I dont really understand.

after I downloaded my mysql error log I check through it, I find out that attempt with different user is trying to access my mysql, I dont really understand, here is the link to ip trying to access mysql server: - Removed -

the Link above is dead here is the link:
- Removed -

2018-11-28 13:25:38 139919581391040 [Note] /usr/sbin/mysqld: ready for connections.
2018-12-07 22:34:32 139907493377792 [Warning] Access denied for user 'root'@'74.208.xxx.xx' (using password: YES)
2018-12-07 22:34:34 139907494606592 [Warning] Access denied for user 'root'@'74.208.xxx.xx' (using password: YES)
2018-12-07 22:34:34 139907494299392 [Warning] Access denied for user 'root'@'74.208.xxx.xx' (using password: YES)
2018-12-07 22:34:35 139907492763392 [Warning] Access denied for user 'root'@'74.208.xxx.xx' (using password: YES)
2018-12-07 22:34:37 139907493070592 [Warning] Access denied for user 'root'@'74.208.xxx.xx' (using password: YES)
2018-12-07 22:34:37 139908682868480 [Warning] Access denied for user 'root'@'74.208.xxx.xx' (using password: YES)
2018-12-07 22:34:39 139907493377792 [Warning] Access denied for user 'root'@'74.208.xxx.xx' (using password: YES)

 

[Infopro]

There's no need to post that super long log file with the same details repeated hundreds of times with different IP addresses, so the text file has been removed and replaced with a snip of the log.

You might want to Suspend the site, assuming you have root access to the server.

Also, the log file entries are from December 2018.

 

[xata11]

yes, and I am still experiencing then same thing uptil now, right now as I am typing this my server is down, because I tried to restart mysql when my average load has reach 31 out of my 6core server.

 

[xata11]

There's no need to post that super long log file with the same details repeated hundreds of times with different IP addresses, so the text file has been removed and replaced with a snip of the log.

You might want to Suspend the site, assuming you have root access to the server.

Also, the log file entries are from December 2018.

I dont really want to suspend any of the site, because that is my project, and I am using it.

 

[Infopro]

Do you have root access to this server? Your forum profile lists you as Website Owner.

If you've got root access, you can enter the suspended sites cPanel account from WebHost Manager to fix your project. If you don't, you might want to consider contacting your hosting provider about this.

 

[xata11]

I have root access to this sites, the site was never suspended, it has numerous IP users trying to attack mysql, you deleted the link I provided. Check on it again, u will see various users with different user name trying to access the server. I think it is an attack.


I have root access to this server, how can I edit my cPanel Access Level on this forum

 

[cPanelLauren]

For starters I would get a system administrator inolved in this if you haven't already. If you don't have one you might find one here: System Administration Services | cPanel Forums.

Secondly, I would suggest checking the following tutorial which might help you mitigate some of the load issues: Tutorial - Troubleshooting high server loads on Linux servers

Though it does look like you understand why it's occurring - it seems like a brute force attempt...does it all originate from the same IP address?