All server log entries having same IP address

Reading Server Logs

[grandma genie]

I have a website that is hosted using VPS hosting. My site host takes care of the site and doesn't like me to interfere. In the past I had lots of trouble with feeling my site was secure, so wanted to use a host that would take care of those issues. I have had no hacking in all the time I've been with his service. But, my site traffic has plummeted and I don't know why. My host has tried to be helpful, but nothing is working.

So I went onto the server to download the logs and discovered (this only happened within the last two months) that the logs are showing entries, all different types with different user agents, but all the initial IPs are the same. They are all my website's IPs. I am assuming my host set up the server to get this type of log, but it isn't helpful for me to see who is accessing my site. I can't call my host since he lives on another continent (UK), but he is not replying to my emails about this.

So I came here to see if the webmasterworld experts could just tell me what would cause the logs to only show the IP address as my website and not the actual visitor.

The traffic downturn happened when I changed my shopping cart from oscommerce to oscMax and my url changed. The host initiated a 301 redirect to allow for the difference, but still very little traffic. Changed cart in April this year. I just wanted to see if the logs could help.

Also, this host doesn't want me messing with the htaccess file by blocking certain IPs. So he removed all my blocks. He says his server setup will block any bad buys.

Thank you for your help.

[wilderness]

IMO, best thing you could do for your self is to find another host!

Search results are fairly inaccurate here, however try a search on VPS in the Apache Forum, and you see some weird issues. Generally speaking, VPS hosting is a bit cheaper, however the headaches, may not be worth the savings. I recall some of your previous requests for assistance/inquires and the current host may be ideal for your own requirements.

Most hosts rarely delve into htaccess and as a result have little experience with same.
Some years ago I had a smaller host where the two person team owners were top-notch Apache guys (they offered solutions that simply were not heard of), however even they had little experience with htaccess.

[robzilla]

Your Apache web server probably runs behind a proxy server. The proxy filters all incoming connections and forwards the HTTP requests to Apache where necessary. When the origin's IP address is not passed onto Apache by the proxy server, the proxy server's IP address will be logged rather than the visitor's. This is a configuration error that your host should be able to fix. If not, I would recommend finding a more knowledgeable host, or learn to do it yourself if you can.

[lucy24]

What you're describing simply should not be happening on a VPS. The whole point of having a Virtual Private Server instead of "vanilla" shared hosting is to have as much control as possible without having a physical server all to yourself (not worth it unless you've got a big and/or high-traffic site).

The host initiated a 301 redirect

See, that's what I mean. On a VPS, the host shouldn't be doing anything with your site. You've got your own config file with your own settings. In fact, given all this, are you sure it is a VPS?

[grandma genie]

Thank you for your help. I guess the problem is my host can be very helpful with the software as he is a developer and knows the code. But when it comes to helping with ranking and serp he "claims" to know what he is talking about, but the results are terrible. Sales have gone steadily down since I started using his hosting service. But this July was the worst ever. And no sales at all this last week. I have two different log files to check. The SSL one does show the different IPs, but with no sales there is almost no log activity on that one. I guess the bottom line is with no traffic there can be no sales. Why my traffic tanked I do not know and don't know how to find out. It is possible the fact that my site is not mobile friendly might have had something to do with it. My host is actually working on creating a mobile site, which was another reason to stay with him, since I have no clue how to make a site mobile friendly. But my purpose in posting to Webmasterworld was only to find out about the logs, and you have answered my question. I appreciate the information.

[grandma genie]

Lucy - My host said this about the server my site is on: Your website is actually hosted on the top version of a Cloud VPS, about three levels above the cheapest/poorer performance technology. Also it is very much underutilised with only 6 sites (some dormant) running on it.

[wilderness]

gg,
If your unable to review your access logs (with the actual visitor IP's), or determine precisely what traffic your host is blocking?

He says his server setup will block any bad buys.

Than your never going to able to determine if your getting actual-zero traffic or your hosts blocking is the cause of zero-traffic.

Are you able to download-view the master-server-conf file that blocks the bad buys?

[lucy24]

Why would you ever let someone else determine who you're locking out? Except in the rare case of exploits that are likely to harm the server, each site should be making its own rules.
...
After I typed this I remembered that my host uses mod_security as a site-by-site optional extra. So, yes, OK, I'm letting them slam the door on a few unwelcome robots using patterns of their own-- but most of then end up with a 403 anyway, because their pattern-recognition is overridden by my IP barriers.

[grandma genie]

I can always block IPs in cPanel, which I have access to. I got a reply to my email from my host and this is what he had to say about the IPs (I thought he might have changed a setting the last time he was on the server): I didn't change any setting, but a cPanel update may have. If I remember tomorrow, I'll rebuild Apache (it takes about an hour!) to see if that reverts the IP addresses. Perhaps it is a CloudFlare issue.

Lucy, I'm sure he uses mod_security, too.
Wilderness, I do not have access to the master-server-conf file.

[tangor]

Change hosts. I'm US, but host in Canada and never a problem. :) Go figure. Thirteen years for one site....

Even on shared hosting (most) you have, or should have, access to .htaccess AND the full logs, and can configure the log to report any way you like.

Your current host sounds too much like a nanny managing your life (website) and it is time to leave that nanny as you are all growed up, now. While Developers are a good thing, some can be a PITA because they believe that, too.

[grandma genie]

I'm going to wait and see if my host can come up with a solution to getting server logs with the IP addresses showing. At least he is trying. He didn't say I was a troublemaker or had too much time on my hands. I'm going to attempt to block some IPs using cPanel and see what happens.

I can access the htaccess files in the root folder, public folder and in the catalog folder.

I've changed hosts almost every two years. It is a royal pain in the neck. So I think I will try to stay the course and hope my host can come up with a solution. He may be a nanny, but he has done a lot for me at no charge and has kept my site safe while he is in control. Something I was not able to do alone.

I appreciate all your comments and advice. I think if I was as up to snuff as you guys, I wouldn't mind taking the reins again of my site.

[tangor]

As always, in all things, grandma genie, which I am sure you share with others, there is benefit if giving others a chance to rise and shine.

As an old phart who has been doing this since dirt began to age, one controls the plow and plants the seed to see the crop grow, ie: you have control of your website UNLESS you truly, fully, completely trust a third part (a foreman?) to do the work.

Over the years I;ve had to fire a couple of those folks. :(