сайт на Joomla 1.5.8, модули и компоненты не добавлял/обновлял где-то около года (кидал только статьи), нагрузка на сервер была примерно 15-25% при ~1к уникумов в день
последние 2 месяца хостер начал жаловаться на пиковые критические превышения нагрузки на сервере до 300%-600%
вот лог
2012-07-18 12:00:02 cpu usage: 356.66%
2012-07-18 12:15:01 cpu usage: 16.53%
2012-07-18 12:30:01 cpu usage: 16%
2012-07-18 12:45:02 cpu usage: 5.73%
2012-07-18 13:00:01 cpu usage: 340.2%
2012-07-18 13:15:01 cpu usage: 12.26%
2012-07-18 13:30:01 cpu usage: 16%
2012-07-18 13:45:01 cpu usage: 17.93%
2012-07-18 14:00:01 cpu usage: 12%
2012-07-18 14:15:02 cpu usage: 12.73%
2012-07-18 14:30:01 cpu usage: 13.53%
2012-07-18 14:45:01 cpu usage: 23.46%
2012-07-18 15:00:01 cpu usage: 10.26%
2012-07-18 15:15:01 cpu usage: 255.06%
2012-07-18 15:30:02 cpu usage: 17.33%
2012-07-18 15:45:01 cpu usage: 17.73%
2012-07-18 16:00:01 cpu usage: 20.93%
2012-07-18 16:15:02 cpu usage: 19%
2012-07-18 16:30:02 cpu usage: 17.26%
2012-07-18 16:45:01 cpu usage: 28.46%
2012-07-18 17:00:03 cpu usage: 31.13%
2012-07-18 17:15:01 cpu usage: 24.53%
2012-07-18 17:30:01 cpu usage: 963.26%
искал посторонний код в скриптах и файлах PHP, вроде не нашел
зато роботы в момент "пика" просто валят сатй, например гуглбот:
DATE: 2012-07-18 11:24:52
PID: 29133 %CPU: 83.3% %MEM: 0.2% VSZ: 45196 kB RSS: 23216 STAT: R TIME: 24:26
SCRIPT: /hsphere/local/home/*****/index.php
Query String: option=com_jdownloads&task=viewcategory&catid=1&Itemid=29
Remote Address: 65.52.108.26
-----------------------------------------------------------------------------------
DATE: 2012-07-18 11:24:56
PID: 29133 %CPU: 83.4% %MEM: 0.2% VSZ: 45196 kB RSS: 23216 STAT: R TIME: 24:30
SCRIPT: /hsphere/local/home/*****/index.php
Query String: option=com_jdownloads&task=viewcategory&catid=1&Itemid=29
Remote Address: 65.52.108.26
-----------------------------------------------------------------------------------
DATE: 2012-07-18 11:25:00
PID: 29133 %CPU: 83.4% %MEM: 0.2% VSZ: 45196 kB RSS: 23216 STAT: R TIME: 24:34
SCRIPT: /hsphere/local/home/*****/index.php
Query String: option=com_jdownloads&task=viewcategory&catid=1&Itemid=29
Remote Address: 65.52.108.26
-----------------------------------------------------------------------------------
DATE: 2012-07-18 11:25:01
PID: 29133 %CPU: 83.4% %MEM: 0.2% VSZ: 45196 kB RSS: 23216 STAT: R TIME: 24:35
SCRIPT: /hsphere/local/home/*****/index.php
Query String: option=com_jdownloads&task=viewcategory&catid=1&Itemid=29
Remote Address: 65.52.108.26
-----------------------------------------------------------------------------------
DATE: 2012-07-18 11:25:05
PID: 29133 %CPU: 83.4% %MEM: 0.2% VSZ: 45196 kB RSS: 23216 STAT: R TIME: 24:39
SCRIPT: /hsphere/local/home/*****/index.php
Query String: option=com_jdownloads&task=viewcategory&catid=1&Itemid=29
Remote Address: 65.52.108.26
-----------------------------------------------------------------------------------
DATE: 2012-07-18 11:25:09
PID: 29133 %CPU: 83.4% %MEM: 0.2% VSZ: 45196 kB RSS: 23216 STAT: R TIME: 24:42
SCRIPT: /hsphere/local/home/*****/index.php
Query String: option=com_jdownloads&task=viewcategory&catid=1&Itemid=29
Remote Address: 65.52.108.26
-----------------------------------------------------------------------------------
DATE: 2012-07-18 11:25:13
PID: 29133 %CPU: 83.5% %MEM: 0.2% VSZ: 45196 kB RSS: 23216 STAT: R TIME: 24:46
SCRIPT: /hsphere/local/home/*****/index.php
Query String: option=com_jdownloads&task=viewcategory&catid=1&Itemid=29
Remote Address: 65.52.108.26
берет одну какую-то страницу и в течении 10 минут ее насилует
подскажите что делать, !? у хостера одно, баньте по IP
итак уже пробанил
deny from 89.189.170.25
deny from 66.249.72.2
deny from 96.47.224.50
deny from 96.47.225.82
deny from 69.31.80.91
deny from 69.31.80.92
deny from 69.31.80.93
deny from 69.31.80.94
deny from 69.31.80.90
deny from 209.9.171.231
deny from 95.108.247.253
deny from 96.47.225.74
05.05.2017, 07:06:46