multiple 500 errors

multiple 500 errors

Ticket 2683182 for account vincentke.com
  • Posted: 24 Apr, 2018 19:09 CDT
  • Status: Resolved
  • Ticket Subject: Technical Issues
+Expand AllTicket Messages:

Avatar

You
  • Posted On 24 Apr, 2018 19:09 CDT

On behalf of client: Hello
I am receiving multiple 500 errors on my websites. Not sure what caused this or how can I resolve it , any assistance is highly appreciated

 

Avatar

Renato Frota
  • Support Guru
  • Posts: 12515
  • Posted On 24 Apr, 2018 19:27 CDT

Hello, Albert.

Thank you for contacting our Help Desk.

Please allow us some time to investigate your case.

I will update this ticket with more information once it is available.

Best regards,

Renato Frota
Technical Support Team

 

Avatar

Renato Frota
  • Support Guru
  • Posts: 12515
  • Posted On 24 Apr, 2018 23:04 CDT

Thank you for your patience, Albert.

I suspect the 50X errors (like 500, 503 and 504) are caused by a high number of requests to https://uservice.211cn.ca//api/extend-session.php from 99.232.251.135 IP address.

Here are the most recent script executions stats of your account (last 110 minutes), for your reference:

Code:
=== Top 10 Executed Scripts ====================================================================================
Count Script Local Path
—– ———————————————— ——————————————————-
18210 http://uservice.211cn.ca/api/extend-session.php /home/vincen56/pubweb/uservice/api/extend-session.php
8072 http://m.211.services/tracker/index.php /home/vincen56/pubweb/211app/tracker/index.php
5989 http://uservice.211cn.ca/tracker/index.php /home/vincen56/pubweb/uservice/tracker/index.php
1738 http://211cn.ca/index.php /home/vincen56/pubweb/211cn/index.php
598 http://m.211.services/api/get-service-points.php /home/vincen56/pubweb/211app/api/get-service-points.php
332 http://vincentke.com/index.php /home/vincen56/public_html/index.php
306 http://it.211cn.ca/index.php /home/vincen56/pubweb/it/index.php
223 http://taiji.vincentke.com/index.php /home/vincen56/pubweb/taiji/index.php
219 http://211cn.ca/wp-cron.php /home/vincen56/pubweb/211cn/wp-cron.php
208 http://taiji.vincentke.com/wp-cron.php /home/vincen56/pubweb/taiji/wp-cron.php
—————————————————————————————————————-=== Top 10 IP Addresses ============================================================================================================
Hits IP Address UserAgent
—– ————— ————————————————————————————————————
18467 99.232.251.135 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWeb …… ML, like Gecko) Chrome/65.0.3325.181 Safari/537.36
107 58.153.81.211 Mozilla/5.0 (Linux; Android 8.0.0; H8296 Build/51. …… 6.6.2.1240(0x26060240) NetType/WIFI Language/zh_HK
102 109.199.127.103 WordPress/4.9.5; http://taiji.vincentke.com
80 216.165.201.136 Mozilla/5.0 (Linux; Android 8.0.0; LON-AL00 Build/ …… 6.6.6.1300(0x26060636) NetType/WIFI Language/zh_CN
74 46.4.80.195 Mozilla/5.0 (compatible; MJ12bot/v1.4.8; http://mj12bot.com/)
63 192.0.91.177 jetmon/1.0 (Jetpack Site Uptime Monitor by WordPress.com)
62 76.71.100.10 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_3) Ap …… (KHTML, like Gecko) Version/11.0.3 Safari/604.5.6
60 24.212.194.104 Mozilla/5.0 (Linux; Android 8.1.0; ONEPLUS A5010 B …… e Gecko) Chrome/65.0.3325.109 Mobile Safari/537.36
54 170.52.74.62 Mozilla/5.0 (iPhone; CPU iPhone OS 11_2_6 like Mac …… D100 MicroMessenger/6.6.6 NetType/WIFI Language/en
47 172.98.154.238 Mozilla/5.0 (iPhone; CPU iPhone OS 11_3 like Mac O …… 6 MicroMessenger/6.6.6 NetType/WIFI Language/zh_CN
————————————————————————————————————————————

As you can see, the requests from 99.232.251.135 are the most frequent, and they are almost exclusively to that same URL:

Code:
vincen56@vincentke.com [~/access-logs]# grep 99.232.251.135 uservice.211cn.ca | awk ‘{print $7}’ | sort -n | uniq -c | sort -rn | head
18206 //api/extend-session.php
24 //api/get-service-points.php
12 //api/get-service-types.php
11 //tracker/index.php?ref=http://127.0.0.1:8020/UServe/app/login.html?__hbt=1524625490290&qs=token=a6cc681548af9eb2a23e71f4c255a7ee&=15b62
9 /server/api/extend-session.php
7 //tracker/index.php?ref=http://127.0.0.1:8020/UServe/app/login.html?__hbt=1524624913977&qs=token=e2f93f314602b4426f85c7efc0507866&=1c1bf
7 //api/login-action.php
5 /api/extend-session.php
3 //tracker/index.php?ref=&qs=__hbt=1524625131147
2 //tracker/index.php?ref=http://127.0.0.1:8020/UServe/app/login.html?19d27&qs=token=0aac7d4293520bfa7bd2f777528bd914&=1874f

(the number if front is the amount of times the URL has been requested the last 110 minutes by this same IP)

This seems to be the cause of an high CPU usage on your account, causing the 50X errors.

Best regards,

Renato Frota
Technical Support Team

 

Avatar

You
  • Posted On 26 Apr, 2018 19:55 CDT

Thank you Renato. This is very helpful information. Is it a log somewhere on the server? Could you tell me where it located so I can look at it later time?

 

Avatar

Valeri Kratunkov
  • Support Guru
  • Posts: 13100
  • Posted On 26 Apr, 2018 20:35 CDT

You can download the raw access logs for each one of your websites to your local computer via cPanel > Raw Access Logs and analyze them. On the bottom of the page, you can also find archived logs for the previous months.

If you have other questions or concerns, please do not hesitate to contact us.

Best Regards,

Valeri Kratunkov
Technical Support Team

发表评论