Bandwidth overusage

To add an update to this issue, I've completely disabled
the cron  
jobs, and I'm still seeing a huge amount of traffic coming
from my  
eventum installation, so I don't think it's e-mail
related, or  
related to the process_mail_queue

I thought that my site might have been used to send spam
e-mail  
through a vulnerability in the system, but I've put it
behind  
Apache's login mechanism (.htaccess) and that didn't seem
to have any  
effect.

Can someone help here?



> From: Andrew Hankinson <andrew.hankinsongmail.com>
> Date: 22 September, 2006 1:05:12 AM EDT (CA)
> To: eventum-userslists.mysql.com
> Subject: Bandwidth overusage
>
> Hi all,
>
> I have been having an ongoing battle with Eventum and
bandwidth usage.
>
> A couple weeks ago, I was seeing massive amounts of
traffic being  
> sent from our server (7+ GB/day!) This is for a small
(~200  
> visitors/day) website, so I knew something was not
right.
>
> I eventually narrowed it down to Eventum - as best I
can tell, it  
> was trying to send out e-mails, the e-mails were
bouncing back,  
> creating more e-mails to send, and not having any
success... they  
> just kept bouncing around in the system, building and
building  
> until they were generating about 7G of traffic!
>
> I went through the database, cleaned out these error
e-mails,  
> installed a version of Eventum with the patch that
Brian sent  
> around a couple weeks ago, and everything went back to
normal.
>
> Except now, I'm starting to see my traffic go up
again. I'm at  
> 800MB today, up from 300 yesterday, up from 200 the day
before.  I  
> removed Eventum from its directory and put it in a
'quarantine'  
> directory, and now my traffic has returned to normal.
(~50MB/day)   
> Only this time, I've looked through the database and I
can't find  
> any errors or queued messages, no messages in the error
logs, nothing.
>
> The only thing I can think of is that sometimes people
reply to an  
> issue that aren't on the 'notification' list, so
their message is  
> 'blocked' and made into a note.  Before, this used to
generate a  
> new note every time the mail queue cron job ran.  Prior
to the new  
> version, I would get an e-mail every time this
happened, so I would  
> go in and add the person to the notification list,
making their  
> message unblocked.  Now, the system just creates one
note so I  
> don't bother adding them to the notification list.  Is
it possible  
> that it's still creating all those notes and e-mailing
it out every  
> time the mail_queue is processed, I'm just not seeing
it?
>
> Again, no error messages in the database, no error
messages in the  
> logs, and nothing showing in the mail queue.  I'm
stumped.
>
> I'm using a nightly build (because it contained the
patch), but I  
> was having this issue before with 1.7.1 Release.  It's
on a LAMP  
> host.  If you need any more detail, I'd be happy to
oblige.
>
> Any clues? Thoughts?
>
> Cheers,
> Andrew

Install ntop (http://www.ntop.org) and find
out:

- What protocol is causing the usage spike
- What hosts are being accessed

Then do a

netstat -anp

and drill down until you find the culprit. Regards,

Georger

--- Andrew Hankinson <andrew.hankinsongmail.com>
escreveu:

> To add an update to this issue, I've completely
> disabled the cron  
> jobs, and I'm still seeing a huge amount of traffic
> coming from my  
> eventum installation, so I don't think it's e-mail
> related, or  
> related to the process_mail_queue
> 
> I thought that my site might have been used to send
> spam e-mail  
> through a vulnerability in the system, but I've put
> it behind  
> Apache's login mechanism (.htaccess) and that didn't
> seem to have any  
> effect.
> 
> Can someone help here?


		
_______________________________________________________ 
Novidade no Yahoo! Mail: receba alertas de novas mensagens
no seu celular. Registre seu aparelho agora! 
http://br.mob
ile.yahoo.com/mailalertas/ 
 


-- 
Eventum Users Mailing List
For list archives: http://lists.mys
ql.com/eventum-users
To unsubscribe:    http:
//lists.mysql.com/eventum-users?unsub=bondyahoo.com

Hi Andrew,

Andrew Hankinson wrote:
> To add an update to this issue, I've completely
disabled the cron jobs, 
> and I'm still seeing a huge amount of traffic coming
from my eventum 
> installation, so I don't think it's e-mail related,
or related to the 
> process_mail_queue

Mail Queue was my first guess, but since you disabled it I
guess that 
isn't it. Without the crons running, there really would be
no way for 
Eventum to actively use bandwidth, something else would have
to contact 
Eventum and display a page to use bandwidth.

Do you have any apache logs to see if pages are being pulled
extremely 
often?

> I thought that my site might have been used to send
spam e-mail through 
> a vulnerability in the system, but I've put it behind
Apache's login 
> mechanism (.htaccess) and that didn't seem to have any
effect.

I am aware of no such vulnerability, though I am glad you
have ruled out 
  that possibility by protecting the installation.

If you would like to discuss this interactively, please feel
free to 
join our IRC channel, We are on Freenode, #eventum.

Best Regards,
/bryan

> 
> Can someone help here?
> 
> 
> 
>> From: Andrew Hankinson <andrew.hankinsongmail.com>
>> Date: 22 September, 2006 1:05:12 AM EDT (CA)
>> To: eventum-userslists.mysql.com
>> Subject: Bandwidth overusage
>>
>> Hi all,
>>
>> I have been having an ongoing battle with Eventum
and bandwidth usage.
>>
>> A couple weeks ago, I was seeing massive amounts of
traffic being sent 
>> from our server (7+ GB/day!) This is for a small
(~200 visitors/day) 
>> website, so I knew something was not right.
>>
>> I eventually narrowed it down to Eventum - as best
I can tell, it was 
>> trying to send out e-mails, the e-mails were
bouncing back, creating 
>> more e-mails to send, and not having any success...
they just kept 
>> bouncing around in the system, building and
building until they were 
>> generating about 7G of traffic!
>>
>> I went through the database, cleaned out these
error e-mails, 
>> installed a version of Eventum with the patch that
Brian sent around a 
>> couple weeks ago, and everything went back to
normal.
>>
>> Except now, I'm starting to see my traffic go up
again. I'm at 800MB 
>> today, up from 300 yesterday, up from 200 the day
before.  I removed 
>> Eventum from its directory and put it in a
'quarantine' directory, and 
>> now my traffic has returned to normal. (~50MB/day) 
Only this time, 
>> I've looked through the database and I can't find
any errors or queued 
>> messages, no messages in the error logs, nothing.
>>
>> The only thing I can think of is that sometimes
people reply to an 
>> issue that aren't on the 'notification' list, so
their message is 
>> 'blocked' and made into a note.  Before, this
used to generate a new 
>> note every time the mail queue cron job ran.  Prior
to the new 
>> version, I would get an e-mail every time this
happened, so I would go 
>> in and add the person to the notification list,
making their message 
>> unblocked.  Now, the system just creates one note
so I don't bother 
>> adding them to the notification list.  Is it
possible that it's still 
>> creating all those notes and e-mailing it out every
time the 
>> mail_queue is processed, I'm just not seeing it?
>>
>> Again, no error messages in the database, no error
messages in the 
>> logs, and nothing showing in the mail queue.  I'm
stumped.
>>
>> I'm using a nightly build (because it contained
the patch), but I was 
>> having this issue before with 1.7.1 Release.  It's
on a LAMP host.  If 
>> you need any more detail, I'd be happy to oblige.
>>
>> Any clues? Thoughts?
>>
>> Cheers,
>> Andrew
> 
> 

-- 
Bryan Alsdorf, Manager of Support Systems
MySQL AB, www.mysql.com

Are you MySQL certified?  www.mysql.com/certification

-- 
Eventum Users Mailing List
For list archives: http://lists.mys
ql.com/eventum-users
To unsubscribe:    http:
//lists.mysql.com/eventum-users?unsub=bondyahoo.com

Hi Georger,

Thanks, but I am on a shared hosting service, so installing
a piece  
of software is not an option.  I do have shell access, but
looking at  
the netstat output gives me the traffic for the whole
server, so  
picking out my own traffic (especially if I don't know what
I'm  
looking for) isn't really a practical solution.

Thanks!

Andrew


On 25-Sep-06, at 10:56 AM, Georger Araujo wrote:

> Install ntop (http://www.ntop.org) and find
out:
>
> - What protocol is causing the usage spike
> - What hosts are being accessed
>
> Then do a
>
> netstat -anp
>
> and drill down until you find the culprit. Regards,
>
> Georger
>
> --- Andrew Hankinson <andrew.hankinsongmail.com>
> escreveu:
>
>> To add an update to this issue, I've completely
>> disabled the cron
>> jobs, and I'm still seeing a huge amount of
traffic
>> coming from my
>> eventum installation, so I don't think it's
e-mail
>> related, or
>> related to the process_mail_queue
>>
>> I thought that my site might have been used to send
>> spam e-mail
>> through a vulnerability in the system, but I've
put
>> it behind
>> Apache's login mechanism (.htaccess) and that
didn't
>> seem to have any
>> effect.
>>
>> Can someone help here?
>
>
> 		
> _______________________________________________________
> Novidade no Yahoo! Mail: receba alertas de novas
mensagens no seu  
> celular. Registre seu aparelho agora!
> http://br.mob
ile.yahoo.com/mailalertas/
>
>
>
> -- 
> Eventum Users Mailing List
> For list archives: http://lists.mys
ql.com/eventum-users
> To unsubscribe:    http://lists.my
sql.com/eventum-users? 
> unsub=andrew.hankinsongmail.com
>


-- 
Eventum Users Mailing List
For list archives: http://lists.mys
ql.com/eventum-users
To unsubscribe:    http:
//lists.mysql.com/eventum-users?unsub=bondyahoo.com