yasir.iqbal12

Member
Jan 1, 2012
18
0
51
cPanel Access Level
Root Administrator
Dear All,
Today my Cpanel apache process was down accidentally. Due to that my sites did not work for some time. I have seen in the logs but could not find the issue why my apache process was down, may be some one else manually down the process. Can any one help me to figure out this issue. So that it can not be happened in the future.
 

yasir.iqbal12

Member
Jan 1, 2012
18
0
51
cPanel Access Level
Root Administrator
Sorry I forgot to put the apache logs

[Tue Mar 06 18:32:58 2012] [error] [client 98.248.191.7] ModSecurity: Access denied with code 501 (phase 2). Match of "rx ^((?:(?:POS|GE)T|OPTIONS|HEAD))$" ag
ainst "REQUEST_METHOD" required. [file "/usr/local/apache/conf/modsec2.user.conf"] [line "38"] [id "960032"] [msg "Method is not allowed by policy"] [severity
"CRITICAL"] [tag "POLICY/METHOD_NOT_ALLOWED"] [hostname "server.biomeanalytics.com"] [uri "/"] [unique_id "T1asuqwYh8IAAF5MKMUAAAAG"]
[Tue Mar 06 18:32:58 2012] [error] [client 98.248.191.7] File does not exist: /usr/local/apache/htdocs/501.shtml
[Tue Mar 06 18:34:50 2012] [error] [client 208.67.167.38] File does not exist: /usr/local/apache/htdocs/gpmtalog.cfm
[Tue Mar 06 18:35:12 2012] [error] [client 208.67.167.38] File does not exist: /usr/local/apache/htdocs/gingx.cfm
[Tue Mar 06 18:35:13 2012] [error] [client 208.67.167.38] File does not exist: /usr/local/apache/htdocs/gtrex.cfm
[Tue Mar 06 18:35:13 2012] [error] [client 208.67.167.38] File does not exist: /usr/local/apache/htdocs/gtrex_pre.cfm
[Tue Mar 06 18:35:13 2012] [error] [client 208.67.167.38] File does not exist: /usr/local/apache/htdocs/gunsubx.cfm
[Tue Mar 06 18:37:20 2012] [error] [client 180.76.6.222] File does not exist: /home/biomew7/public_html/500.shtml
[Tue Mar 06 18:37:47 2012] [notice] caught SIGTERM, shutting down
 

Infopro

Well-Known Member
May 20, 2003
17,075
524
613
Pennsylvania
cPanel Access Level
Root Administrator
Twitter
Not much to see there. A few comments on what you've posted from the log:

ModSecurity: Access denied with code 501
Good, you have ModSecurity on the server, that's important. It's working.

File does not exist: /usr/local/apache/htdocs/501.shtml
No one should be accessing this directory, directly. And if they do, there is no error pages in there. You can add common error pages to this directory which would stop this sort of message from appearing in your log.

File does not exist: /usr/local/apache/htdocs/gingx.cfm
.cfm file extension is not common I don't think on a cPanel server. Those files being called do not exist in this directory, so you get an error.

You might want to hire a reputable Server Administrator from the cPanel Application Catalog for assistance with this if you're unsure of the way forward.
Dev & Sys Admin Services « Application Catalog