Problem with statistics.exe/need help

[kami@]

Hope somebody here could help us out.

I am runing plesk 8.2.0 on window 03 server.
Upto 2 days ago the scheduled statistics.exe use to run smoothly and took about 3 hours to finish up.

Now all of sudden the statistics.exe keeps runing for ever using about 50% cpu and never finish. Today it ran for 10 hours and I finally had to manually end the process.

The only thing I have done to plesk since the last time statistics.exe ran ok is that I suspended a few domains.

I looked in event viewer and there are no error listed there.
I also tried runing statistics from command line with the same result.

Could somebody from plesk help us out please.

Thanks in advance

 

[techdesign]

I have had this same problem and it turns out that for me it was related to FTP dictionary attacks. If you look at your FTP log files, you will probably find they are over 1 meg in size and full of 'administrator' and other users who don't exist trying to login. According to Plesk (I opened a ticket with them on this a while back) statistics.exe makes a call to lsass.exe (the local security authority) to verify the user logging in so it can update statistics appropriately.

Well, when those users don't exist, it creates LOTS more work for the process, not to mention the sheer number of checks it does. This in turn causes statistics.exe and lsass.exe combined to take up almost 100% processor usage.

Plesk's fix for me: kill statistics.exe, stop the ftp service, zip up the existing ftp log files and delete the originals, then restart the ftp service. As long as you have normal log files on the next run, statistics.exe will run as planned.

The only problem with this is it doesn't address the basic problem. Next time you get an FTP dictionary attack (which is pretty frequent on my servers) your logs will fill up with junk again, causing another round of statistics.exe not working.

I haven't found a long term solution, but have been working with the script found here:

http://blog.netnerds.net/2006/07/ban-administrator-ftp-login-attempts/

It basically monitors the event log and when it sees bad logon attempts, it parses the ftp logs looking for 'x' failed attempts. It will then block the IP at the FTP level, and some versions of the scripts also block it at the routing level of Windows. It works pretty well, but it isn't a bulletproof solution.

It would be nice if Plesk could come up with some way to protect FTP from this hammering, but so far their only answer has been to use FTP over SSL or some other non-customer-service-friendly method...

 

[OlegB]

Yes, techdesign is definitely right. This problem is most probably caused by FTP compromising attempts.

 

[fosterm]

Hi

I have the same problem with statistics.exe bringing down my server after dictionary attacks

When you say clear the logs, is this refering to the windows sys 32 ftp logs or plesk logs?

The sys32 log file only contains old ftp logs from last year

Many thanks

Mark

 

[techdesign]

These logs files are the ones for your virtual FTP sites. In my case, it is something like:

c:\inetpub\vhosts\server\<number>\logs\MSFTPSVC<number>

Of course, the <number>s will depend on your config. Look in there for big logs files. And I'm not talking megs in size, but I've had the problem with logs over 200K!

 

[deepa]

statistics.exe amd lsass.exe high cpu usage plesk 9.0

We got the situation where in daily scheduled task plesk scedule runs in and statistics.exe and lsass.exe are being noticed to eat up all cpu resources until next 3-5 hours then.
We have plesk 9.0 for windows . in between explorer.exe cpu usage also shoots up.
other than that lod on server never goes so high.

we didnt find any of dictionary attacks on ftp and ftp logs doesnt show up any such issues.

could plesk support let menknow why is this happening and what is workaround.
the situation started 2-3 days back and continues to be same everyday.

the plesk log shows following error during the tiem scheduled job is running


Event Type: Error
Event Source: sshost.exe
Event Category: None
Event ID: 1
Date: 9/30/2009
Time: 4:27:04 PM
User: N/A
Computer: NS32
Description:
Cannot open backup device 'C:\Program Files\Parallels\Plesk\MySQL\Backup\psa-20090930.dump'. Operating system error 5(Access is denied.). BACKUP DATABASE is terminating abnormally.
at (VADOConnection::execute line 90)
at Unable to backup of vital Plesk settings(SettingsBackup::execute line 207)
Execute file name: C:\Program Files\Parallels\Plesk\admin\bin\sshost.exe