Users randomly unable to access sites on server?

Discussion in 'Apache' started by Anveto, Sep 20, 2011.

  1. #1
    I have a really weird issue where users are randomly unable to access the server, then after a few hours the problem dissapears, not sure why and what is causing it.
    -I am running apache with WHM and cPanel
    -The site users try to access is billigaapan.se on dedicated ip 173.208.165.197
    -No other sites can be accessed on the server when this problem occurs.
    -Pinging and doing a traceroute on the server shows no errors.
    -Typing in the ip 173.208.165.197 into the users browser when the site is down will redirect the user to the domain billigaapan.se, try to load and then time out.
    -load averages during outage 0.15 0.10 0.08
    -Mainly affects users from Sweden, have not seen this issue with USA users

    Anyone know what might be causing this issue, any ideas on things I can try to do to fix it?
     
    Anveto, Sep 20, 2011 IP
  2. AnthonyG

    AnthonyG Well-Known Member

    Messages:
    114
    Likes Received:
    3
    Best Answers:
    2
    Trophy Points:
    135
    #2
    Disable hulkcp & firewall.

    When they are blocked, you can check iptables:
    iptables -nL | more
    hit the space bar to scroll thru the ips, verify their ip is listed.

    iptables -F (to empty iptable rules)
     
    AnthonyG, Sep 20, 2011 IP
  3. Anveto

    Anveto Well-Known Member

    Messages:
    697
    Likes Received:
    40
    Best Answers:
    19
    Trophy Points:
    195
    #3
    Thanks, how do I go about disabling hulkcp and firewall? Won't this pose security risks?

    here is the rule for his ip in the iptables, does it mean anything?

    Chain LOCALINPUT (1 references)
    num   pkts bytes target     prot opt in     out     source               destination         
    1     2833  482K ACCEPT     all  --  !lo    *       193.11.132.44        0.0.0.0/0
    Code (markup):
     
    Anveto, Sep 20, 2011 IP
  4. AnthonyG

    AnthonyG Well-Known Member

    Messages:
    114
    Likes Received:
    3
    Best Answers:
    2
    Trophy Points:
    135
    #4
    cphulk can be disabled in whm

    why are you even adding a rule for his ip to be accepted?

    doing as i suggested above is a test to see if he is being stopped via iptables.
     
    AnthonyG, Sep 20, 2011 IP
  5. Anveto

    Anveto Well-Known Member

    Messages:
    697
    Likes Received:
    40
    Best Answers:
    19
    Trophy Points:
    195
    #5
    I disabled cphulk

    The rule was already there

    It seems to be working now, but im not sure if the problem simply went away or if I solved it, I will get back to this thread when i find out if it seems to be working or not
     
    Anveto, Sep 20, 2011 IP
  6. AnthonyG

    AnthonyG Well-Known Member

    Messages:
    114
    Likes Received:
    3
    Best Answers:
    2
    Trophy Points:
    135
    #6
    Did you flush the iptable rules as i suggested before, when the issue happens?
     
    AnthonyG, Sep 20, 2011 IP
  7. Anveto

    Anveto Well-Known Member

    Messages:
    697
    Likes Received:
    40
    Best Answers:
    19
    Trophy Points:
    195
    #7
    Yes I have
     
    Anveto, Sep 20, 2011 IP
  8. AnthonyG

    AnthonyG Well-Known Member

    Messages:
    114
    Likes Received:
    3
    Best Answers:
    2
    Trophy Points:
    135
    #8
    Either cphulk blocked them because it believes they are port flooding or you have a fw adding the block, thats why i suggested disabling them & flushing the rules.

    Your welcome.
     
    AnthonyG, Sep 20, 2011 IP
  9. Anveto

    Anveto Well-Known Member

    Messages:
    697
    Likes Received:
    40
    Best Answers:
    19
    Trophy Points:
    195
    #9
    Yea, that didn't work... I disabled cphulk but firewall is enabled still, should I disable it or are there other things I should check?
     
    Anveto, Sep 21, 2011 IP
  10. AnthonyG

    AnthonyG Well-Known Member

    Messages:
    114
    Likes Received:
    3
    Best Answers:
    2
    Trophy Points:
    135
    #10
    Its hard to say what fw/script on the server is doing it, as i dont have access to your server, its really hard to say, could be APF/CSF, you will have to poke & see whats installed and disable them one by one to see which one is doing the blocking.
     
    AnthonyG, Sep 21, 2011 IP
  11. Anveto

    Anveto Well-Known Member

    Messages:
    697
    Likes Received:
    40
    Best Answers:
    19
    Trophy Points:
    195
    #11
    Server went down during a reboot today, now its sort of up again.

    Where can I see what processes are enabled or disabled, where can I find logs and stuff like that where I could see these issues?
     
    Anveto, Sep 21, 2011 IP