Paranoia after Kernel Panic

[mediakreativ]

Hello there,

this morning i found my server down - after contacting the server support they answered me that there is a kernel panic.

As i couldnt imagine or find out what was the source of that kernel panic i choose the fastest option to recover the server: a fresh install of the OS and WHM and then recovering all accounts.

Unfortunately i have not looked into the logs - so i cannot reproduce the source of that kernel panic - but i guess there is a big chance that it has to do with the automatic updates which ran in the night...

Would you recommend to run all the updates automatically? Is a kernel update included in the automatic system updates?

The server (i7-920 Quad-Core with 8 GB DDR3 RAM) is running CENTOS 5.5 x86_64 with WHM 11.26.8, updating to STABLE.

I am really afraid of running the next update - so it would be nice if you could give me an advice.

Kind regards,

Christian

[pjman]

Looks like you're running a 64-bit system. If you are not the only one using the server, your going to want to drop everything and check out the latest vulnerability to the kernel. It's on affects 64-bit version, but I hear it's pretty nasty. Allows local user to become root and is simply.

The latest patches came out Tuesday last week. So, if you haven't updated your kernel,after that, I would jump at it.

It was so serious that Cpanel sent an emergency email about and there is a sticky here:

http://forums.cpanel.net/f185/x86_64...it-165758.html

[mediakreativ]

Thanks for your answer, pjman!

As there is no automatic kernel update in WHM the source of the kernel panic has to be somewhere else. I was afraid that a incompatible new kernel was the problem...

So i dont know why the kernel panic took place and i just can hope that it doesnt appear again. I have ran the normal WHM-updates the last two days and so far everything is fine.

Although i dont think that the problem came through that exploit i thank you for the information! I will go through the post and update the kernel as soon as possible. (If the kernel is updated, i do not need any other patches like KSplice , right?)

Does anybody already updated to the newest kernel without problems? Is the kernel officially supported by cPanel?

Kind regards,

Christian

[GaryT]

I originally updated to the latest kernal and ran into hell only cause I used a RHEL kernal and then updated to stock and thats when issues started.

Mainly as the loads were going higher then higher and then crash due to massive mem + swap + cpu

In the end I rebooted, Logged on and killed everything from starting so I could revert the kernal and run the patch.

what kernal was you on, Or what are you on now ?

[mediakreativ]

Hello GaryT,

i just veryfied that and i found out that i have the newest kernel:

2.6.18-194.11.1.el5

I forgot that i had to reinstall the OS after the kernel panic two days before - so the newest kernel seemed to be included...

So if the above is the newest version i guess i have nothing else to do, right?

Kind regards,

Christian

[mediakreativ]

Hi again,

now i found out that the newest kernel is different:

2.6.18-194.3.1.el5

I am running 2.6.18-194.11.1.el5 ...

What would be your advice?

Kind regards,

Christian

[rackaid]

Many things can trigger a kernel panic. I would not expect WHM updates to trigger such an issue unless it was a major release or switching between stable/bleeding edge etc.

Typically, I see kernel updates or other software updates causing these problems. I've also seem them happen and then never happen again.

I would not worry about a once off event too much. If the issue becomes recurring, then dig into it some more.

See: https://access.redhat.com/kb/docs/DOC-40265

and the updates at the end:
https://rhn.redhat.com/errata/RHSA-2010-0704.html

Regarding the patched kernels.

We use Ksplice in our server management program and they rolled out the 64 bit patch before Red Hat did, so our systems were not a target for long.