........the plot:

Just say - I am in this sort of trouble (and I [protagonist] am)....

I have a domain let's call it mydomain.com [crime scene]
under which I have several subdirectories (e.g. -mydomain.com/one, mydomain.com/two, etc) - each with A unique joomla! website - many tests sites a few not built by me (so therein lies the mystery)

Anyway - I'm on shared server and mydomain.com has misbehaved [but innocent until proven guilty] prompting this message from the hosting company:
"
This account has been suspended as it has caused a several-minute long outage on the server. This appears to be due to one of your scripts initiating over 400 simultaneous MySQL connections on the server. "

So......... where to start.

i havent' touched ANY of these sites for over a week

I thought there may have been external forces [suspects] - but the hosts tell me it's a script running an infinite loop or similar [guilty party?], and less likely to be due to hacking etc.

I could copy and test each site on a local server - or simply pull out my fingernails...... But is there an easier way to find which script is causing the problem

I have only cpanel and ftp access [no DNA evidence ] - the sites are down.....

All thoughts welcome - otherwise I will just pull down all sites and start from scratch.

Thanks for reading and hopefully solving!

Hey Audra

It would be nice to know which site is causing the probs. I guess you've looked at error logs? Also access by IP address (in case of hacking) - see site stats on cpanel. Check who has been in there.

I would (if the above yielded no clues) be tempted to Google the extensions for hacks and also look at the (fairly recently updated) extensions security vulnerability list.

It's also not unheard of for sloppy extension code to put you over the normal limits of MySQL calls. I'd Google them too.

Then I'd FTP in to the sites and find all the most recently updated files, to see if I could track a culprit that way.

Does any of that help?

Good luck (kinda poignant about backups now. huh?)
Dex

You could ask your hosting company for the log file or just tell you which script is running.

I moved to my own server so I could use WHM to identify wayward scripts and to kill their PID.

Cheers
Ian

This may just have to go down to being another Infamous Unsolved Mystery!!

Thanks for the input guys!

I had a bit of a log file from the hosts which pointed to a particular database – hence site – so I’m assuming that’s the problem. There were no errors logged or recent suspicious access – so a rogue script seemed likely.

I had forgotten to check the JE – vulnerabilities list – thanks for reminding me of that obvious one!! – there were indeed a couple that were relevant. But I don’t think the cause of this problem.

I ended up copying & running each site locally but I couldn’t reproduce the problem!!

So have deleted ALL sites / directories bar one which was just a fresh install.

My NEW problem is ditching the client who had the VERY likely culprit site !!

Ian – when you say WHM – do you mean web host manager (or some other fandangled thing)? How do you check queries with that?

"cPanel and WebHost Manager (WHM) combine to form a fully featured web hosting control panel system. The cPanel and WHM package allows you to manage every aspect of your server's web hosting needs through two easy-to-use interfaces. cPanel and WHM help your customers and your staff to manage your servers and the domains and accounts on them."

ie cpanel is for individual domains and WHM managers the server and the domains. If you have a hosting account you will have access to WHM but without the features that you get a the root level on VPS or dedicated server.

With WHM you can look at things like Service Status which gives an over view of memory usage, server load, disk space and services running. For your situation another section shows current CPU usage and you can sort by CPU or memory - the list also shows you the PID (process identification number)which you can end if it is behaving badly..