access to database restricted by host

[buildingblocks]

we are trying to figure out where the problem is for database access restriction by host for the 2nd time this week. As per their two solutions we optimized the database which brought it from 17mb to 7mb. We don't want to move to a dedicated server.
We have no idea what the data, CPU_TIME, Top table row reads: etc. is telling us. There is nothing new installed in over year and all of a sudden we are getting this problem. Not sure what to look for.

From our host.

> - Why did this happen?

> Per our terms of service (http://www.hostgator.com/tos) a single hosting account may use no more than 25% of the entire server's resources. Accounts are typically not actively restricted until they exceed those resource limitations exceptionally. Unfortunately, in this instance, we were forced to place a temporary restriction on your user to prevent service issues with the server's over-all system performance. For more information about resource usage limitations, please see:https://support.hostgator.com/articl...limits-summary
>
> Please reply to this email once you have determined a resolution to this issue.

>
- How can you resolve the issue?

> We have two solutions available. Moving the account to a dedicated server, which will allow far greater hardware resources or you may try following the basic recommendations for optimizing your database. If you feel your database has already been optimized, it may simply be time to consider the hardware upgrade. http://support.hostgator.com/article...resource-usage
>



CPU_TIME:208 table_rows_read:3493546 SELECTS:2144339 ROWS_UPDATED:367 ROWS_FETCHED:1689844 BUSY_TIME:227 ONNECTED_TIME:692 BYTES_SENT:5570560 BYTES_RECEIVED:500607495 WAIT_TIME:19
>
>
> Top table row reads:
> DB_USER: dbowner_zc1 -- TOTAL_CONNECTIONS: 83 -- CONNECTED_TIME: 692 -- CPU_TIME: 208 -- TABLE_ROW_READS: 3493546 -- SELECT_COMMANDS: 2144339 -- UPDATE_COMMANDS: -- BUSY_TIME: 227 -- BYTES_SENT: 5570560 -- BYTES_RECEIVED: 500607495 -- WAIT_TIME (IO): 19
>
>
>
> Top WAIT (IO) TIME:
> DB_USER: dbowner_zc1 -- TOTAL_CONNECTIONS: 83 -- CONNECTED_TIME: 692 -- CPU_TIME: 208 -- TABLE_ROW_READS: 3493546 -- SELECT_COMMANDS: 2144339 -- UPDATE_COMMANDS: -- BUSY_TIME: 227 -- BYTES_SENT: 5570560 -- BYTES_RECEIVED: 500607495 -- WAIT_TIME (IO): 19
>
>
>
>
> Sun May 4 14:37:25 CDT 2014
> Running Processes:
>
> Running Queries:
>
> Open connections
>
> Current Site Requests:
> 107.23.154.193 websiteurl.com /shopping-cart?sort=20a&zenid=18f10a1db342a66f4edb391e931dd
> 107.23.154.193 websiteurl.com /shopping-cart?sort=20a&zenid=18f10a1db342a66f4edb391e931dd
> 54.84.52.179 websiteurl.com /shopping-cart?sort=20a&zenid=18f10a1db342a66f4edb391e931dd
> 54.84.52.179 websiteurl.com /shopping-cart?sort=20a&zenid=18f10a1db342a66f4edb391e931dd
> 54.84.52.179 websiteurl.com /shopping-cart?sort=20a&zenid=18f10a1db342a66f4edb391e931dd


The other day this is what they sent:


CPU_TIME:218 table_rows_read:3330606 SELECTS:2053239 ROWS_UPDATED:360 ROWS_FETCHED:1622742 BUSY_TIME:249 ONNECTED_TIME:2259 BYTES_SENT:5373952 BYTES_RECEIVED:480199298 WAIT_TIME:31


Top table row reads:
DB_USER: dbowner_zc1 -- TOTAL_CONNECTIONS: 83 -- CONNECTED_TIME: 2259 -- CPU_TIME: 218 -- TABLE_ROW_READS: 3330892 -- SELECT_COMMANDS: 2053476 -- UPDATE_COMMANDS: -- BUSY_TIME: 249 -- BYTES_SENT: 5373952 -- BYTES_RECEIVED: 480256676 -- WAIT_TIME (IO): 31



Top WAIT (IO) TIME:
DB_USER: dbowner_zc1 -- TOTAL_CONNECTIONS: 83 -- CONNECTED_TIME: 2259 -- CPU_TIME: 218 -- TABLE_ROW_READS: 3330924 -- SELECT_COMMANDS: 2053511 -- UPDATE_COMMANDS: -- BUSY_TIME: 249 -- BYTES_SENT: 5373952 -- BYTES_RECEIVED: 480265617 -- WAIT_TIME (IO): 31



dbowner 1053 12.7 0.0 403428 25708 ? SN 10:46 0:04 /usr/bin/php /home4/dbowner/public_html/index.php
dbowner 1164 11.7 0.0 403428 25708 ? SN 10:46 0:04 /usr/bin/php /home4/dbowner/public_html/index.php
dbowner 2478 12.8 0.0 403172 25536 ? RN 10:46 0:03 /usr/bin/php /home4/dbowner/public_html/index.php
dbowner 3529 12.4 0.0 402840 24728 ? RN 10:46 0:01 /usr/bin/php /home4/dbowner/public_html/index.php
dbowner 3626 12.0 0.0 401816 23944 ? SN 10:46 0:01 /usr/bin/php /home4/dbowner/public_html/index.php
dbowner 4540 18.0 0.0 401812 24272 ? SN 10:46 0:00 /usr/bin/php /home4/dbowner/public_html/index.php
dbowner 32513 13.5 0.0 403684 25972 ? SN 10:46 0:06 /usr/bin/php /home4/dbowner/public_html/index.php

Wed Apr 9 10:47:02 CDT 2014
Running Processes:
dbowner 1053 12.4 0.0 403428 25708 ? SN 10:46 0:04 /usr/bin/php /home4/dbowner/public_html/index.php
dbowner 1164 11.5 0.0 403428 25708 ? SN 10:46 0:04 /usr/bin/php /home4/dbowner/public_html/index.php
dbowner 2478 12.4 0.0 403172 25536 ? RN 10:46 0:03 /usr/bin/php /home4/dbowner/public_html/index.php
dbowner 3529 12.0 0.0 402912 24972 ? RN 10:46 0:01 /usr/bin/php /home4/dbowner/public_html/index.php
dbowner 3626 11.6 0.0 401816 24208 ? SN 10:46 0:01 /usr/bin/php /home4/dbowner/public_html/index.php
dbowner 4540 16.2 0.0 401812 24272 ? RN 10:46 0:00 /usr/bin/php /home4/dbowner/public_html/index.php
dbowner 32513 13.4 0.0 403684 25972 ? RN 10:46 0:06 /usr/bin/php /home4/dbowner/public_html/index.php

[mc12345678]

Maybe someone else is able to explain all of the data and what it means, but on the surface what I see is that 1) the cart is outdated even for it's own time (139h was the latest in that version) 2) seems that your site receives more data than it sends, to me this means that someone is using the reduced security of that version to send information in some way. Not exactlysure how they can send more than is sent out, but that's what I think I get out of the report and I haven't ggone to look at the links provided.

Would suggest upgrading to the newest version of ZC (currently 1.5.1) also not sure if they have upgraded your php version so that too could be a reason for things becoming an issue "beyond your knowledge" (ie, a change made without you knowing/making the change.)

[buildingblocks]

I'm going through the access log file. I'm seeing a lot of sessions where a product url is accessed and then the same session ID goes to the shopping cart so I'm wondering if this is robot activity adding lots of products to the cart. The log is a txt file and not permitted to be uploaded.

I do understand about the cart needing to be updated.

[buildingblocks]

I just happened to catch compute-1.amazonaws.com adding lots of items to cart. How to stop that?

[DrByte]

FIRST, inspect EVERYTHING on your server to be SURE that you don't have someone else storing and running stuff in there that you don't know about:
Treat it as though you've been hacked until you prove otherwise, by following these steps: http://www.zen-cart.com/wiki/index.p...ing_From_Hacks