SOLVED [CPANEL-21113] Virus Scan hammers /usr/local/cpanel/logs/error_log

[bloatedstoat]

Hello,

I ran a virus scan on a user account, whilst running the /usr/local/cpanel/logs/error_log file began filling with the following data.

Is there any way to suppress this? If the virus scanner were to be run more frequently the error_log would become totally unusable.

Whilst this could be deemed as a mere inconvenience it does make it difficult finding information that might be actually important within the error_log.

Thanks

warn [Internal Warning while parsing ./frontend/paper_lantern/clamavconnector/live_go.html.tt 2696978] Use of uninitialized value $virus in string ne at /usr/local/cpanel/Cpanel/ClamScanner.pm line 657.
 at /usr/local/cpanel/Cpanel/ClamScanner.pm line 657.
    Cpanel::ClamScanner::_scanmbox("/home/username/mail/userdomain.com.au/user/cur/1230505555"...) called at /usr/local/cpanel/Cpanel/ClamScanner.pm line 276
    Cpanel::ClamScanner::ClamScanner_processfile() called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/5.26.0/File/Find.pm line 421
    File::Find::_find_dir(HASH(0x1f32a18), "/home/username/mail", 11) called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/5.26.0/File/Find.pm line 241
    File::Find::_find_opt(HASH(0x1f32a18), "/home/username/mail") called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/5.26.0/File/Find.pm line 771
    File::Find::finddepth(CODE(0x1f89740), "/home/username/mail") called at /usr/local/cpanel/Cpanel/ClamScanner.pm line 203
    Cpanel::ClamScanner::ClamScanner_scanhomedir("mail") called at cpanel.pl line 1612
    eval {...} called at cpanel.pl line 1612
    cpanel::cpanel::_api1("ClamScanner", "clamscanner", "scanhomedir(mail)", "scanhomedir", ARRAY(0x1efca48), "safe_html_encode") called at /usr/local/cpanel/Cpanel/Template/Plugin/Api1.pm line 93
    eval {...} called at /usr/local/cpanel/Cpanel/Template/Plugin/Api1.pm line 93
    Cpanel::Template::Plugin::Api1::_api1_exec(1, "ClamScanner", "scanhomedir", ARRAY(0x1efca48)) called at /usr/local/cpanel/Cpanel/Template/Plugin/Api1.pm line 43
    Cpanel::Template::Plugin::Api1::_live_api1_exec("ClamScanner", "scanhomedir", ARRAY(0x1efca48)) called at /usr/local/cpanel/base/frontend/paper_lantern/clamavconnector/live_go.html.tt line 3
    eval {...} called at /usr/local/cpanel/base/frontend/paper_lantern/clamavconnector/live_go.html.tt line 3
    eval {...} called at /usr/local/cpanel/base/frontend/paper_lantern/clamavconnector/live_go.html.tt line 5
    Template::Provider::__ANON__(Template::Context=HASH(0x1eda280)) called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/cpanel_lib/x86_64-linux-64int/Template/Document.pm line 163
    eval {...} called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/cpanel_lib/x86_64-linux-64int/Template/Document.pm line 161
    Template::Document::process(Template::Document=HASH(0x1efcca0), Template::Context=HASH(0x1eda280)) called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/cpanel_lib/x86_64-linux-64int/Template/Context.pm line 357
    eval {...} called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/cpanel_lib/x86_64-linux-64int/Template/Context.pm line 327
    Template::Context::process(Template::Context=HASH(0x1eda280), Template::Document=HASH(0x1efcca0)) called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/cpanel_lib/x86_64-linux-64int/Template/Service.pm line 94
    eval {...} called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/cpanel_lib/x86_64-linux-64int/Template/Service.pm line 91
    Template::Service::process(Template::Service=HASH(0x1ec69a8), "/usr/local/cpanel/base/frontend/paper_lantern/clamavconnector"..., HASH(0x16d0860)) called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/cpanel_lib/x86_64-linux-64int/Template.pm line 64
    Template::process(Template=HASH(0x1e1a440), "/usr/local/cpanel/base/frontend/paper_lantern/clamavconnector"..., HASH(0x16d0860)) called at /usr/local/cpanel/Cpanel/Template.pm line 489
    Cpanel::Template::process_template("cpanel", HASH(0x16d0860), HASH(0x17965d8)) called at /usr/local/cpanel/Cpanel/Template/Interactive.pm line 54
    Cpanel::Template::Interactive::process_template("cpanel", HASH(0x16d0860), HASH(0x17965d8)) called at /usr/local/cpanel/Cpanel/Template/Interactive.pm line 60
    Cpanel::Template::Interactive::process_template_cached("cpanel", HASH(0x16d0860), HASH(0x17965d8)) called at cpanel.pl line 1031
    cpanel::cpanel::cptt_exectag("/usr/local/cpanel/base/frontend/paper_lantern/clamavconnector"..., 1) called at cpanel.pl line 4408
    cpanel::cpanel::run_standard_mode() called at cpanel.pl line 864
    cpanel::cpanel::script("cpanel::cpanel", "./frontend/paper_lantern/clamavconnector/live_go.html.tt") called at cpanel.pl line 271

 

[bloatedstoat]

Just to add to this.

Configserver configured a script to send Log Scanner reports hourly with a limit of 5,000 lines.

The error_log has been filled with so much data (as above) from the virus scan that our hourly email since running it is truncated at 5000 lines and a lot of log file information is now missing completely.

I tried to truncate the /usr/local/cpanel/logs/error_log but received "Operation not permitted".

Can someone please advise how to either truncate the file or rotate it manually so our hourly Log Scanner emails contain useful information again. Rather not wait another 5 days until Sunday when it rotates.

Thank you.

 

[cPanelLauren]

Hi @bloatedstoat

cpanellogd handles log rotation of cPanel log files, you can ensure the error_log is in rotation by going to WHM>>Service Configuration>>cPanel Log Rotation Configuration

You can also modify the Log rotation size threshold so when the log file reaches a set size it will be rotated out. This can be done from WHM>>servicer Configuration>>Tweak Settings -> Log Rotation Size Threshold.

In regard to the errors that are being dumped into the cPanel error log when running ClamScan - I am curious if you have any customizations to the Paper Lantern theme, if not I believe this may be best handled with a ticket as this output shouldn't be occurring in the cPanel error_log. Can you please open a ticket using the link in my signature? Once open please reply with the Ticket ID here so that we can update this thread with the resolution once the ticket is resolved.


Thanks!

 

[rpvw]

cPanel v72.0.10

I am also seeing clamav errors in the /usr/local/cpanel/logs/error_log (completely un-customized paper lantern). eg:

[2018-07-24 08:19:47 +0000] warn [Internal Warning while parsing ./frontend/paper_lantern/clamavconnector/index.html.tt 254800] Use of uninitialized value in addition (+) at /usr/local/cpanel/Cpanel/ClamScanner.pm line 92.
 at /usr/local/cpanel/Cpanel/ClamScanner.pm line 92.
   Cpanel::ClamScanner::ClamScanner_main("") called at cpanel.pl line 1612
   eval {...} called at cpanel.pl line 1612
   cpanel::cpanel::_api1("ClamScanner", "clamscanner", "main()", "main", ARRAY(0x39c6648), "safe_html_encode") called at /usr/local/cpanel/Cpanel/Template/Plugin/Api1.pm line 93
   eval {...} called at /usr/local/cpanel/Cpanel/Template/Plugin/Api1.pm line 93
   Cpanel::Template::Plugin::Api1::_api1_exec(0, "ClamScanner", "main", ARRAY(0x39c6648)) called at /usr/local/cpanel/Cpanel/Template/Plugin/Api1.pm line 47
   Cpanel::Template::Plugin::Api1::_captured_api1_exec("ClamScanner", "main", ARRAY(0x39c6648)) called at /usr/local/cpanel/base/frontend/paper_lantern/clamavconnector/index.html.tt line 1
   eval {...} called at /usr/local/cpanel/base/frontend/paper_lantern/clamavconnector/index.html.tt line 1
   eval {...} called at /usr/local/cpanel/base/frontend/paper_lantern/clamavconnector/index.html.tt line 16
   Template::Provider::__ANON__(Template::Context=HASH(0x396bb90)) called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/cpanel_lib/x86_64-linux-64int/Template/Document.pm line 163
   eval {...} called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/cpanel_lib/x86_64-linux-64int/Template/Document.pm line 161
   Template::Document::process(Template::Document=HASH(0x39c75a0), Template::Context=HASH(0x396bb90)) called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/cpanel_lib/x86_64-linux-64int/Template/Context.pm line 357
   eval {...} called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/cpanel_lib/x86_64-linux-64int/Template/Context.pm line 327
   Template::Context::process(Template::Context=HASH(0x396bb90), Template::Document=HASH(0x39c75a0)) called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/cpanel_lib/x86_64-linux-64int/Template/Service.pm line 94
   eval {...} called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/cpanel_lib/x86_64-linux-64int/Template/Service.pm line 91
   Template::Service::process(Template::Service=HASH(0x396b758), "/usr/local/cpanel/base/frontend/paper_lantern/clamavconnector"..., HASH(0x396e498)) called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/cpanel_lib/x86_64-linux-64int/Template.pm line 64
   Template::process(Template=HASH(0x396ea68), "/usr/local/cpanel/base/frontend/paper_lantern/clamavconnector"..., HASH(0x396e498), SCALAR(0x1666d38)) called at /usr/local/cpanel/Cpanel/Template.pm line 501
   Cpanel::Template::process_template("cpanel", HASH(0x396e498), HASH(0x17965d8)) called at cpanel.pl line 1031
   cpanel::cpanel::cptt_exectag("/usr/local/cpanel/base/frontend/paper_lantern/clamavconnector"..., 1) called at cpanel.pl line 4408
   cpanel::cpanel::run_standard_mode() called at cpanel.pl line 864
   cpanel::cpanel::script("cpanel::cpanel", "./frontend/paper_lantern/clamavconnector/index.html.tt") called at cpanel.pl line 271

[2018-07-24 08:19:47 +0000] warn [Internal Warning while parsing ./frontend/paper_lantern/clamavconnector/index.html.tt 254800] Use of uninitialized value in substitution (s///) at /usr/local/cpanel/Cpanel/Path/Safety.pm line 19.
 at /usr/local/cpanel/Cpanel/Path/Safety.pm line 19.
   Cpanel::Path::Safety::make_safe_for_path(SCALAR(0x16b0670)) called at /usr/local/cpanel/Cpanel/Branding/Lite.pm line 602
   Cpanel::Branding::Lite::_get_nv_brandingpkg() called at /usr/local/cpanel/Cpanel/Branding/Lite.pm line 525
   Cpanel::Branding::Lite::_getbrandingpkg() called at /usr/local/cpanel/Cpanel/DynamicUI/App.pm line 453
   Cpanel::DynamicUI::App::_ensure_options_for_dynamic_ui_loader(HASH(0x175dd70)) called at /usr/local/cpanel/Cpanel/DynamicUI/App.pm line 351
   Cpanel::DynamicUI::App::_load_parsed_dynamicui_app_cache_if_valid("/home/ji5fyn2sl67/.cpanel/datastore/AVAILABLE_APPLICATIONS_CA"..., "arglist", 1) called at /usr/local/cpanel/Cpanel/DynamicUI/App.pm line 206
   Cpanel::DynamicUI::App::get_available_applications("arglist", 1) called at /usr/local/cpanel/Cpanel/Template/Plugin/Master.pm line 97
   Cpanel::Template::Plugin::Master::load("Cpanel::Template::Plugin::Master", Template::Context=HASH(0x396bb90)) called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/cpanel_lib/x86_64-linux-64int/Template/Plugins.pm line 217
   eval {...} called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/cpanel_lib/x86_64-linux-64int/Template/Plugins.pm line 217
   Template::Plugins::_load(Template::Plugins=HASH(0x396c370), "Master", Template::Context=HASH(0x396bb90)) called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/cpanel_lib/x86_64-linux-64int/Template/Plugins.pm line 108
   Template::Plugins::fetch(Template::Plugins=HASH(0x396c370), "Master", undef, Template::Context=HASH(0x396bb90)) called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/cpanel_lib/x86_64-linux-64int/Template/Context.pm line 195
   Template::Context::plugin(Template::Context=HASH(0x396bb90), "Master") called at /var/cpanel/template_compiles//usr/local/cpanel/base/frontend/paper_lantern/_assets/master.html.tt line 1
   eval {...} called at /var/cpanel/template_compiles//usr/local/cpanel/base/frontend/paper_lantern/_assets/master.html.tt line 1
   Template::Provider::__ANON__(Template::Context=HASH(0x396bb90)) called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/cpanel_lib/x86_64-linux-64int/Template/Document.pm line 163
   eval {...} called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/cpanel_lib/x86_64-linux-64int/Template/Document.pm line 161
   Template::Document::process(Template::Document=HASH(0x3c3ebe8), Template::Context=HASH(0x396bb90)) called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/cpanel_lib/x86_64-linux-64int/Template/Context.pm line 357
   eval {...} called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/cpanel_lib/x86_64-linux-64int/Template/Context.pm line 327
   Template::Context::process(Template::Context=HASH(0x396bb90), "_assets/master.html.tt", HASH(0x3b58770), "localize me!") called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/cpanel_lib/x86_64-linux-64int/Template/Context.pm line 415
   Template::Context::include(Template::Context=HASH(0x396bb90), "_assets/master.html.tt", HASH(0x3b58770)) called at /usr/local/cpanel/base/frontend/paper_lantern/clamavconnector/index.html.tt line 27
   eval {...} called at /usr/local/cpanel/base/frontend/paper_lantern/clamavconnector/index.html.tt line 16
   Template::Provider::__ANON__(Template::Context=HASH(0x396bb90)) called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/cpanel_lib/x86_64-linux-64int/Template/Document.pm line 163
   eval {...} called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/cpanel_lib/x86_64-linux-64int/Template/Document.pm line 161
   Template::Document::process(Template::Document=HASH(0x39c75a0), Template::Context=HASH(0x396bb90)) called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/cpanel_lib/x86_64-linux-64int/Template/Context.pm line 357
   eval {...} called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/cpanel_lib/x86_64-linux-64int/Template/Context.pm line 327
   Template::Context::process(Template::Context=HASH(0x396bb90), Template::Document=HASH(0x39c75a0)) called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/cpanel_lib/x86_64-linux-64int/Template/Service.pm line 94
   eval {...} called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/cpanel_lib/x86_64-linux-64int/Template/Service.pm line 91
   Template::Service::process(Template::Service=HASH(0x396b758), "/usr/local/cpanel/base/frontend/paper_lantern/clamavconnector"..., HASH(0x396e498)) called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/cpanel_lib/x86_64-linux-64int/Template.pm line 64
   Template::process(Template=HASH(0x396ea68), "/usr/local/cpanel/base/frontend/paper_lantern/clamavconnector"..., HASH(0x396e498), SCALAR(0x1666d38)) called at /usr/local/cpanel/Cpanel/Template.pm line 501
   Cpanel::Template::process_template("cpanel", HASH(0x396e498), HASH(0x17965d8)) called at cpanel.pl line 1031
   cpanel::cpanel::cptt_exectag("/usr/local/cpanel/base/frontend/paper_lantern/clamavconnector"..., 1) called at cpanel.pl line 4408

They are not filling up the log file with the volume that @bloatedstoat is reporting.

 

[bloatedstoat]

@rpvw I suspect the volume of errors logged to the error_log is determined by the size of the actual mailboxes in the user's home directory. In my case the account I ran it on has a few mailboxes that are fairly large. So if the scan is looping through each item of mail and logging the errors to the error_log as it skips along then it can quickly get out of hand - which mine did. The error_log was totally infested and unusable.

@SS-Maddy the post you made appears to have been removed, I received the email notification but the post appears to be missing, that said thank you for your time posting.

@cPanelLauren Thank you for the information. I have log rotation set up already as you mention, the size for the rotation is set to 300MB and last night the file was rotated out so my reports are back to normal today thankfully.

I have not made any customisations to the theme, not that I'm aware of, pretty confident on this one.

I will shortly open a support ticket. Thank you for your help.

 

[bloatedstoat]

Support ticket: 9973425

 

[SS-Maddy]

@SS-Maddy the post you made appears to have been removed, I received the email notification but the post appears to be missing, that said thank you for your time posting.

Post was removed because the workaround is not at all recommended and was definitely not inline with the QoS of cPanel The real issue is the error logs are getting full and that should be fixed. I oversaw it.

 

[bloatedstoat]

For those who might be following this and those that are experiencing the same problem, such as @rpvw , two internal cases have been opened by the support analyst who investigated and replicated the issue described above - and I quote:

Internal case CPANEL-21904, this first case has to do with how we use the timestamps on a file to check for the time at which a user last performed a virus scan -- this causes some errors to get logged to the cPanel error log unnecessarily.

Internal case CPANEL-21905, has to do with the virus scanning itself logging a warning regarding uninitialized variables for each message that is not a virus.

 

[cPanelLauren]

Hi @bloatedstoat

Thank you for opening the ticket and then updating with the outcome. I'm really happy that they were able to get the cases open for this, those errors should never have been occurring. I'm now watching the cases and I'll update here when they're resolved.


Thanks!

 

[cPanelMichael]

Hello,

To update, the two cases referenced in this thread were addressed as part of CPANEL-21113 in cPanel & WHM version 74:

Fixed case CPANEL-21113: Prevent warning when scanning with ClamAV.

Thank you.