• Hello,

    I hope I’m in the right place. Every few months I get this crazy cpu spike and siteground temporarily disables my site. I’m not a professional programmer or anything, so it of course worries me and is extremely frustrating given that I don’t understand the terminology. I finally found out how to check access logs to try to find the culprit.
    From what I can see, the dates that these errors occurred I had over 40,000 visits. Whereas normally we have just something like 1-2,000.
    looking at the access log for that date I get a repeated attempt from something to do with google.
    can I paste the access log entry here in order to get help 1. Interpreting it , and 2. Ideally getting some direction as to how to resolve my issue ?
    I’d be very very grateful, this is causing a lot of stress of course .
    thank you

    The page I need help with: [log in to see the link]

Viewing 4 replies - 1 through 4 (of 4 total)
  • Moderator bcworkz

    (@bcworkz)

    Please do not post a large volume of data in these forums. Thank you very much for asking first. Typically a brief snippet representative of the suspect data will suffice for someone to confirm if the access is really Google or some kind of impostor.

    If you feel a larger volume is necessary, you can post elsewhere like pastebin.com or gist.github.com and simply provide the link here.

    True Googlebots typically space out their requests while crawling a site specifically to avoid overloading your server. If the alleged Googlebot requests are overloading your server, I suspect they are impostors. Of course I’m guessing since I have not seen your access data.

    If the requests are coming from a limited range of IP addresses, you could block that range in .htaccess to help reduce the server load.

    Thread Starter badmammal

    (@badmammal)

    Thank you so much for your reply, I hope this paste isn’t excessive. But it also shows the frequency of these requests, which I think might be relevant ..

    2023-03-20 17:07:51 UTC [apache][:warn] [pid 40895] [client 35.214.141.83:12148] Timeout waiting for output from CGI script /home/u309-nr639cbukdfr/www/weyerhof.at/public_html/index.php, referer: http://www.google.com

    2023-03-20 17:07:50 UTC [apache][:warn] [pid 2101] [client 35.214.141.83:12148] Timeout waiting for output from CGI script /home/u309-nr639cbukdfr/www/weyerhof.at/public_html/index.php, referer: http://www.google.com

    2023-03-20 17:07:50 UTC [apache][:warn] [pid 97219] [client 35.214.141.83:12148] Timeout waiting for output from CGI script /home/u309-nr639cbukdfr/www/weyerhof.at/public_html/index.php, referer: http://www.google.com

    2023-03-20 17:07:49 UTC [apache][:warn] [pid 67209] [client 35.214.141.83:12148] Timeout waiting for output from CGI script /home/u309-nr639cbukdfr/www/weyerhof.at/public_html/index.php, referer: http://www.google.com

    Moderator bcworkz

    (@bcworkz)

    That IP address is from Google alright, but not Googlebot’s. It’s from a Google hosted server (googleusercontent.com), meaning someone’s personal or business site is the problem source. It’s very possible that their site had been hacked and is being abused, all unknown to the site owner.

    If all abuse is coming from that one IP address, you can block it with a .htaccess directive like

    # Block abusive IP addresses
    <Files "*.*">
    	Order Allow,Deny
    	Allow from all
    	Deny from 35.214.141.83
    </Files>

    You can add other Deny from lines as necessary. Or if all are from a limited range, you can use CIDR formatting to block a range, for example
    Deny from 35.214.141.0/24
    will block 35.214.141.0 through 35.214.141.255

    You can also report abuse to Google. I’m not sure how effective it’d be.

    Thread Starter badmammal

    (@badmammal)

    Thank you so so so much , it’s henna giving me a headache. Happens every couple months, unfortunately I can’t see the access logs from that far back (only traffic, which has the same insane increase in traffic corresponding with the cpu usage problem). I’ll try blocking that and see what happens . Thank you again 🙏🏼🙏🏼

Viewing 4 replies - 1 through 4 (of 4 total)
  • The topic ‘Beginner in need of interpreting access log’ is closed to new replies.