Please whitelist cPanel in your adblocker so that you’re able to see our version release promotions, thanks!

The Community Forums

Interact with an entire community of cPanel & WHM users!

After EasyApache rebuild Apache dies twice a day

Discussion in 'EasyApache' started by nabuhonodozor, Dec 20, 2014.

  1. nabuhonodozor

    nabuhonodozor Member

    Joined:
    Jun 22, 2007
    Messages:
    23
    Likes Received:
    0
    Trophy Points:
    51
    Dear cPanel Gurus,

    I am using cPanel since many years. Its working flawlessly. Till last 2-3 weeks.
    I coulnd update Apache through easyApache script because od openssl missing libs (? - 64Bit on 32bit Host). I was required to run some command through terminal/ssh. All worked ok and Ive finally recompiled apache (need to build mysqli module).

    After that apache crash almost precisely twice a day at 13:10 and 13:20 PM
    I was trying to find something in logs but I didnt.

    In chkservd.log I found:
    Code:
    [2014-12-14 13:21:48 +0100] Service check ....[socket connect:-][socket failure threshold:4/3][fail count:2]Restarting httpd....
    [notify:failed (load:0.42 0.36 0.29) (memory: used=1867,available=36028797018962100,installed=36028797018963968)]]...
    Also I am getting e-mails from cPanel monitor services:

    Code:
    Service: 	httpd
    Notification Type: 	failed
    Notification: 	httpd failed @ Sun Dec 14 13:16:47 2014. A restart was attempted automagically.
    Service Check Method: 	[socket connect]
    
    Reason: Unable to connect to port 80 on 127.0.0.1: Connection refused: Died
    
    Number of Restart Attempts: 	1
    Startup Log: 	
    
    Failed to fetch startup_log for “httpd” because of an error: 
    
    Log Messages: 	
    
    [Sun Dec 14 13:04:45 2014] [error] [client 66.249.67.103] File does not exist: /usr/local/apache/htdocs/robots.txt
    [Sun Dec 14 12:59:29 2014] [error] [client 83.28.239.182] ModSecurity: Rule b5ed550 [id "390149"][file "/usr/local/apache/conf/modsec/50_asl_rootkits.conf"][line "113"] - Execution error - PCRE limits exceeded (-8): (null). [hostname "mydomain1.pl"] [uri "/index.php/some-page.html"] [unique_id "VI17oLIgXckAAGiqFPcAAAAU"]
    [Sun Dec 14 12:53:28 2014] [error] [client 66.249.67.97] ModSecurity: Rule b5ed550 [id "390149"][file "/usr/local/apache/conf/modsec/50_asl_rootkits.conf"][line "113"] - Execution error - PCRE limits exceeded (-8): (null). [hostname "mydomain2.com"] [uri "/index.php"] [unique_id "VI16OLIgXckAAGBqU0QAAAAI"]
    [Sun Dec 14 12:46:33 2014] [error] [client 94.254.209.175] ModSecurity: Rule b5ed550 [id "390149"][file "/usr/local/apache/conf/modsec/50_asl_rootkits.conf"][line "113"] - Execution error - PCRE limits exceeded (-8): (null). [hostname "mydomian1.pl"] [uri "/index.php/catalog/product/gallery/image/333/id/222/"] [unique_id "VI14mbIgXckAAFxtOy4AAAAD"]
    [Sun Dec 14 12:46:26 2014] [error] [client 94.254.209.175] ModSecurity: Rule b5ed550 [id "390149"][file "/usr/local/apache/conf/modsec/50_asl_rootkits.conf"][line "113"] - Execution error - PCRE limits exceeded (-8): (null). [hostname "mydomian1.pl"] [uri "/index.php/catalog/product/gallery/image/333/id/222/"] [unique_id "VI14kbIgXckAAGIfbXgAAAAK"]
    [Sun Dec 14 12:46:11 2014] [error] [client 94.254.209.175] ModSecurity: Rule b5ed550 [id "390149"][file "/usr/local/apache/conf/modsec/50_asl_rootkits.conf"][line "113"] - Execution error - PCRE limits exceeded (-8): (null). [hostname "mydomian1.pl"] [uri "/index.php/catalog/product/gallery/image/444/id/333/"] [unique_id "VI14g7IgXckAAFY3TmYAAAAE"]
    [Sun Dec 14 12:44:44 2014] [error] [client 216.20.131.111] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?:mo(?:rfeus ****************ing scanner|siac 1)|internet(?:-exprorer| ninja)|s\\\\.t\\\\.a\\\\.l\\\\.k\\\\.e\\\\.r\\\\.|kenjin spider|neuralbot/)" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/conf/modsec/20_asl_useragents.conf"] [line "199"] [id "330082"] [rev "2"] [msg "Atomicorp.com UNSUPPORTED DELAYED Rules: Exploit User Agent"] [severity "CRITICAL"] [hostname "178.32.93.202"] [uri "/user/soapCaller.bs"] [unique_id "VI14LLIgXckAAFxtOxAAAAAD"]
    
    Memory Information: 	
    
        Used: 1948MB
        Available: 36028797018962020MB
        Installed: 36028797018963968MB 
    
    Load Information: 	0.14 0.21 0.24
    Uptime: 	106 days, 6 hours, 49 seconds
    IOStat Information: 	
    
    avg-cpu:  %user   %nice %system %iowait  %steal   %idle
               1.52    0.13    0.30   31.26    0.01   66.79
    Device:            tps   Blk_read/s   Blk_wrtn/s   Blk_read   Blk_wrtn
    
    ChkServd Version: 	15.6
    If I leave it it restarts after about 5 min. I can also force it to restart though login into WHM admin and klick restart https service.


    I have VPS with centOs 5. Its openVZ container. 4GB Ram Worked flawlessly for about 3 years. Issues started after forcefully rebuild easyapache.

    Please help.
    Kind regards,
     
    #1 nabuhonodozor, Dec 20, 2014
    Last edited: Dec 20, 2014
  2. cPanelPeter

    cPanelPeter Technical Analyst III
    Staff Member

    Joined:
    Sep 23, 2013
    Messages:
    575
    Likes Received:
    20
    Trophy Points:
    93
    cPanel Access Level:
    Root Administrator
    Twitter:
    Hello,

    Please open a support ticket using the link in my signature. We would be glad to look at that for you.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  3. nabuhonodozor

    nabuhonodozor Member

    Joined:
    Jun 22, 2007
    Messages:
    23
    Likes Received:
    0
    Trophy Points:
    51
    Dear cPanelPeter - thank You. Ive just submitted a ticket.
     
  4. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    43,711
    Likes Received:
    1,794
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Could you let us know the ticket number so we can update this thread with the outcome?

    Thank you.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
Loading...

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice