Corey S

Seems im not the only one with a problem. Everything is working fine but I went to check the server status:

httpd (1.3.41 (Unix)) failed

Now im not sure what that has to to do with the site and how it works but the server is running much slower then usual and my Zencart canada post module is receiving "110 Connection timed out" errors.

This problem doesn't seem to be related to my module on zencart or canada post itself so I was curious to see if something else on the server is causing this problem. (ive tested other sites with the module and had no problem)

I'll make a ticket if need be, I just wanted to see if this was actually a server side problem.

-Corey

(Edit.. for those not familiar with the Canada post module in zencart, its used to swap information from our main shipping company Canada Post and the module to give an accurate quote for shipping on items. It needs certain ports open to work correctly and those ports had been opened by surpass... up until now everything has been great)

2nd Edit - It appears this 110 timed out has to do with the server side ports. Back when I had this setup I had support open up port 30000 incoming and outgoing.

Corey S

Submitted a support ticket as this is most definitely a server issue.

Ticket: OST-989332

Styx

I opened up a ticket earlier, also. When httpd is down on sh138, any web site hosted on that server is down. Mine is one of them. I got a response that httpd had been restarted, but obviously something causes it to fail afterward.
Fortunately, my email still functions on that server.

Corey S

Support has told me the post is still open but the server is under DDOS attack... not fun.

Styx

Re: DDoS of sh138

That's the reasoning that I got, also. However, my email is functioning properly, so unless the "DDoS" is targetted specifically at httpd, I suspect that the problem is more likely related to something like resource exhaustion. (i.e. a poorly behaved CGI script, out of memory, etc.)
Log files are our friends...

removed

That's exactly what's going on -- the HTTP service is the only service affected by this attack.

__________________

Surpass Abuse & Security

unofficial IRC chat: #surpass irc.blessed.net (efnet)

Corey S

So is this something that would affect information being sent to and from the server, for instance my Canada Post module? I realize the slowness is an effect of the DDOS as well as the pages not loading half the time.. but what else?

thanks

Styx

When the httpd service (web server) is down, all sites hosted by that service are down. What this means is that when your web browser attempts to connect to port 80 (or 443) for any site hosted on sh138, you will not be able to connect (nothing is listening on those ports).
If someone is DDoS'ing a particular site hosted on sh138, it should be apparent in the access log which domain is being targeted. If that site's DNS is hosted by Surpass, they should be able to change that domain's www record to localhost (127.0.0.1) to thwart any further attempts directed solely toward that domain's site.
It has been over a day, and the "DDoS" explanation has me raising an eyebrow.

Corey S

This problem is still going on. It was working fine again for a few days but now its back to the same old crap.

It worked for about 6 or 7 days after support had done whatever they needed to do.

(httpd (1.3.41 (Unix)) failed)

^ Again, im not sure what that means... but thats what it says in my server status.