I have a really weird issue where users are randomly unable to access the server, then after a few hours the problem dissapears, not sure why and what is causing it. -I am running apache with WHM and cPanel -The site users try to access is billigaapan.se on dedicated ip 173.208.165.197 -No other sites can be accessed on the server when this problem occurs. -Pinging and doing a traceroute on the server shows no errors. -Typing in the ip 173.208.165.197 into the users browser when the site is down will redirect the user to the domain billigaapan.se, try to load and then time out. -load averages during outage 0.15 0.10 0.08 -Mainly affects users from Sweden, have not seen this issue with USA users Anyone know what might be causing this issue, any ideas on things I can try to do to fix it?
Disable hulkcp & firewall. When they are blocked, you can check iptables: iptables -nL | more hit the space bar to scroll thru the ips, verify their ip is listed. iptables -F (to empty iptable rules)
Thanks, how do I go about disabling hulkcp and firewall? Won't this pose security risks? here is the rule for his ip in the iptables, does it mean anything? Chain LOCALINPUT (1 references) num pkts bytes target prot opt in out source destination 1 2833 482K ACCEPT all -- !lo * 193.11.132.44 0.0.0.0/0 Code (markup):
cphulk can be disabled in whm why are you even adding a rule for his ip to be accepted? doing as i suggested above is a test to see if he is being stopped via iptables.
I disabled cphulk The rule was already there It seems to be working now, but im not sure if the problem simply went away or if I solved it, I will get back to this thread when i find out if it seems to be working or not
Either cphulk blocked them because it believes they are port flooding or you have a fw adding the block, thats why i suggested disabling them & flushing the rules. Your welcome.
Yea, that didn't work... I disabled cphulk but firewall is enabled still, should I disable it or are there other things I should check?
Its hard to say what fw/script on the server is doing it, as i dont have access to your server, its really hard to say, could be APF/CSF, you will have to poke & see whats installed and disable them one by one to see which one is doing the blocking.
Server went down during a reboot today, now its sort of up again. Where can I see what processes are enabled or disabled, where can I find logs and stuff like that where I could see these issues?