An attack or not?

[Notebook]

Hi,

I looked in WHM and in the Apache Status and see a lot of this:

4-1 - 0/0/37 . 0.25 3217 0 0.0 0.00 98.20 127.0.0.1 server.mybox.com OPTIONS * HTTP/1.0
35-1 - 0/0/19 . 1.07 2956 0 0.0 0.00 75.70 127.0.0.1 server.mybox.com OPTIONS * HTTP/1.0
36-1 - 0/0/27 . 1.40 2927 0 0.0 0.00 175.27 127.0.0.1 server.mybox.com OPTIONS * HTTP/1.0
37-1 - 0/0/13 . 0.38 3769 0 0.0 0.00 88.20 127.0.0.1 server.mybox.com OPTIONS * HTTP/1.0
38-1 - 0/0/13 . 0.82 3878 0 0.0 0.00 73.54 127.0.0.1 server.mybox.com OPTIONS * HTTP/1.0
39-1 - 0/0/26 . 1.14 2930 0 0.0 0.00 91.88 127.0.0.1 server.mybox.com OPTIONS * HTTP/1.0
40-1 - 0/0/9 . 0.23 3787 0 0.0 0.00 28.24 127.0.0.1 server.mybox.com OPTIONS * HTTP/1.0
41-1 - 0/0/11 . 1.14 3669 0 0.0 0.00 81.73 127.0.0.1 server.mybox.com OPTIONS * HTTP/1.0
42-1 - 0/0/24 . 1.46 2945 0 0.0 0.00 41.53 127.0.0.1 server.mybox.com OPTIONS * HTTP/1.0
43-1 - 0/0/26 . 1.34 2930 0 0.0 0.00 48.24 127.0.0.1 server.mybox.com OPTIONS * HTTP/1.0
44-1 - 0/0/16 . 1.83 3366 0 0.0 0.00 10.29 127.0.0.1 server.mybox.com OPTIONS * HTTP/1.0
45-1 - 0/0/8 . 0.00 3681 0 0.0 0.00 14.74 127.0.0.1 server.mybox.com OPTIONS * HTTP/1.0
46-1 - 0/0/14 . 0.60 3568 0 0.0 0.00 47.93 127.0.0.1 server.mybox.com OPTIONS * HTTP/1.0
47-1 - 0/0/11 . 0.00 3968 0 0.0 0.00 103.99 127.0.0.1 server.mybox.com OPTIONS * HTTP/1.0
48-1 - 0/0/9 . 0.01 3880 0 0.0 0.00 119.11 127.0.0.1 server.mybox.com OPTIONS * HTTP/1.0
49-1 - 0/0/7 . 0.00 3973 0 0.0 0.00 112.87 127.0.0.1 server.mybox.com OPTIONS * HTTP/1.0
50-1 - 0/0/6 . 0.00 3973 0 0.0 0.00 48.71 127.0.0.1 server.mybox.com OPTIONS * HTTP/1.0
51-1 - 0/0/5 . 0.00 3972 0 0.0 0.00 87.98 127.0.0.1 server.mybox.com OPTIONS * HTTP/1.0
52-1 - 0/0/8 . 0.00 3970 0 0.0 0.00 20.02 127.0.0.1 server.mybox.com OPTIONS * HTTP/1.0
53-1 - 0/0/6 . 0.00 3969 0 0.0 0.00 79.77 127.0.0.1 server.mybox.com OPTIONS * HTTP/1.0
54-1 - 0/0/5 . 0.00 3968 0 0.0 0.00 38.04 127.0.0.1 server.mybox.com OPTIONS * HTTP/1.0

Server is not overloaded and running at a load of 0.30 which is normal. I just don't understand what the above is and I have checked Google and it says a SYN attack but as I said the server is not running away being at 0.30.

[thisisit3]

Its normal.

Its apache's MPM prefork way of waking up the worker processes, which unfortunately produces all that garbage in the status.

[Notebook]

Thanks mate!

[Notebook]

Well if I may

Could you explain something else to me about the bandwidth:

In CPanel I see that my bandwidth usage is 45GB for the month. In the WHM panel I note it gives the same amount. When I look at Apache however it gives a different story:

Current Time: Wednesday, 23-Jul-2008 07:50:59 ICT
Restart Time: Tuesday, 22-Jul-2008 15:32:43 ICT
Parent Server Generation: 2
Server uptime: 16 hours 18 minutes 15 seconds
Total accesses: 34841 - Total Traffic: 92.8 GB
CPU Usage: u94.84 s13.42 cu0 cs0 - .184% CPU load
.594 requests/sec - 1.6 MB/second - 2.7 MB/request
8 requests currently being processed, 7 idle workers

Why is there a discrepancy in the Bandwidth usage?

[thisisit3]

the 45GB is probably for a specific domain while apache reports the overall bandwidth consumed by all domains on the server

[Notebook]

Hi,

There is only one account on the server. There are many domains however all the domains are under the 1 account. That is why I wondered why it does not update in CPanel.

Cheers