Please whitelist cPanel in your adblocker so that you’re able to see our version release promotions, thanks!

The Community Forums

Interact with an entire community of cPanel & WHM users!

Pending Publication [CPANEL-21905] [CPANEL-21904] Virus Scan hammers /usr/local/cpanel/logs/error_log

Discussion in 'General Discussion' started by bloatedstoat, Jul 23, 2018.

  1. bloatedstoat

    bloatedstoat Well-Known Member

    Joined:
    Jun 14, 2012
    Messages:
    127
    Likes Received:
    11
    Trophy Points:
    18
    Location:
    Victoria, Australia
    cPanel Access Level:
    Root Administrator
    Hello,

    I ran a virus scan on a user account, whilst running the /usr/local/cpanel/logs/error_log file began filling with the following data.

    Is there any way to suppress this? If the virus scanner were to be run more frequently the error_log would become totally unusable.

    Whilst this could be deemed as a mere inconvenience it does make it difficult finding information that might be actually important within the error_log.

    Thanks

    Code:
    warn [Internal Warning while parsing ./frontend/paper_lantern/clamavconnector/live_go.html.tt 2696978] Use of uninitialized value $virus in string ne at /usr/local/cpanel/Cpanel/ClamScanner.pm line 657.
     at /usr/local/cpanel/Cpanel/ClamScanner.pm line 657.
        Cpanel::ClamScanner::_scanmbox("/home/username/mail/userdomain.com.au/user/cur/1230505555"...) called at /usr/local/cpanel/Cpanel/ClamScanner.pm line 276
        Cpanel::ClamScanner::ClamScanner_processfile() called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/5.26.0/File/Find.pm line 421
        File::Find::_find_dir(HASH(0x1f32a18), "/home/username/mail", 11) called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/5.26.0/File/Find.pm line 241
        File::Find::_find_opt(HASH(0x1f32a18), "/home/username/mail") called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/5.26.0/File/Find.pm line 771
        File::Find::finddepth(CODE(0x1f89740), "/home/username/mail") called at /usr/local/cpanel/Cpanel/ClamScanner.pm line 203
        Cpanel::ClamScanner::ClamScanner_scanhomedir("mail") called at cpanel.pl line 1612
        eval {...} called at cpanel.pl line 1612
        cpanel::cpanel::_api1("ClamScanner", "clamscanner", "scanhomedir(mail)", "scanhomedir", ARRAY(0x1efca48), "safe_html_encode") called at /usr/local/cpanel/Cpanel/Template/Plugin/Api1.pm line 93
        eval {...} called at /usr/local/cpanel/Cpanel/Template/Plugin/Api1.pm line 93
        Cpanel::Template::Plugin::Api1::_api1_exec(1, "ClamScanner", "scanhomedir", ARRAY(0x1efca48)) called at /usr/local/cpanel/Cpanel/Template/Plugin/Api1.pm line 43
        Cpanel::Template::Plugin::Api1::_live_api1_exec("ClamScanner", "scanhomedir", ARRAY(0x1efca48)) called at /usr/local/cpanel/base/frontend/paper_lantern/clamavconnector/live_go.html.tt line 3
        eval {...} called at /usr/local/cpanel/base/frontend/paper_lantern/clamavconnector/live_go.html.tt line 3
        eval {...} called at /usr/local/cpanel/base/frontend/paper_lantern/clamavconnector/live_go.html.tt line 5
        Template::Provider::__ANON__(Template::Context=HASH(0x1eda280)) called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/cpanel_lib/x86_64-linux-64int/Template/Document.pm line 163
        eval {...} called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/cpanel_lib/x86_64-linux-64int/Template/Document.pm line 161
        Template::Document::process(Template::Document=HASH(0x1efcca0), Template::Context=HASH(0x1eda280)) called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/cpanel_lib/x86_64-linux-64int/Template/Context.pm line 357
        eval {...} called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/cpanel_lib/x86_64-linux-64int/Template/Context.pm line 327
        Template::Context::process(Template::Context=HASH(0x1eda280), Template::Document=HASH(0x1efcca0)) called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/cpanel_lib/x86_64-linux-64int/Template/Service.pm line 94
        eval {...} called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/cpanel_lib/x86_64-linux-64int/Template/Service.pm line 91
        Template::Service::process(Template::Service=HASH(0x1ec69a8), "/usr/local/cpanel/base/frontend/paper_lantern/clamavconnector"..., HASH(0x16d0860)) called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/cpanel_lib/x86_64-linux-64int/Template.pm line 64
        Template::process(Template=HASH(0x1e1a440), "/usr/local/cpanel/base/frontend/paper_lantern/clamavconnector"..., HASH(0x16d0860)) called at /usr/local/cpanel/Cpanel/Template.pm line 489
        Cpanel::Template::process_template("cpanel", HASH(0x16d0860), HASH(0x17965d8)) called at /usr/local/cpanel/Cpanel/Template/Interactive.pm line 54
        Cpanel::Template::Interactive::process_template("cpanel", HASH(0x16d0860), HASH(0x17965d8)) called at /usr/local/cpanel/Cpanel/Template/Interactive.pm line 60
        Cpanel::Template::Interactive::process_template_cached("cpanel", HASH(0x16d0860), HASH(0x17965d8)) called at cpanel.pl line 1031
        cpanel::cpanel::cptt_exectag("/usr/local/cpanel/base/frontend/paper_lantern/clamavconnector"..., 1) called at cpanel.pl line 4408
        cpanel::cpanel::run_standard_mode() called at cpanel.pl line 864
        cpanel::cpanel::script("cpanel::cpanel", "./frontend/paper_lantern/clamavconnector/live_go.html.tt") called at cpanel.pl line 271
     
  2. bloatedstoat

    bloatedstoat Well-Known Member

    Joined:
    Jun 14, 2012
    Messages:
    127
    Likes Received:
    11
    Trophy Points:
    18
    Location:
    Victoria, Australia
    cPanel Access Level:
    Root Administrator
    Just to add to this.

    Configserver configured a script to send Log Scanner reports hourly with a limit of 5,000 lines.

    The error_log has been filled with so much data (as above) from the virus scan that our hourly email since running it is truncated at 5000 lines and a lot of log file information is now missing completely.

    I tried to truncate the /usr/local/cpanel/logs/error_log but received "Operation not permitted".

    Can someone please advise how to either truncate the file or rotate it manually so our hourly Log Scanner emails contain useful information again. Rather not wait another 5 days until Sunday when it rotates.

    Thank you.
     
  3. cPanelLauren

    cPanelLauren Forums Analyst II
    Staff Member

    Joined:
    Nov 14, 2017
    Messages:
    3,204
    Likes Received:
    228
    Trophy Points:
    173
    Location:
    Houston
    cPanel Access Level:
    DataCenter Provider
    Hi @bloatedstoat

    cpanellogd handles log rotation of cPanel log files, you can ensure the error_log is in rotation by going to WHM>>Service Configuration>>cPanel Log Rotation Configuration

    You can also modify the Log rotation size threshold so when the log file reaches a set size it will be rotated out. This can be done from WHM>>servicer Configuration>>Tweak Settings -> Log Rotation Size Threshold.

    In regard to the errors that are being dumped into the cPanel error log when running ClamScan - I am curious if you have any customizations to the Paper Lantern theme, if not I believe this may be best handled with a ticket as this output shouldn't be occurring in the cPanel error_log. Can you please open a ticket using the link in my signature? Once open please reply with the Ticket ID here so that we can update this thread with the resolution once the ticket is resolved.


    Thanks!
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  4. rpvw

    rpvw Well-Known Member

    Joined:
    Jul 18, 2013
    Messages:
    841
    Likes Received:
    304
    Trophy Points:
    113
    Location:
    Spain
    cPanel Access Level:
    Root Administrator
    cPanel v72.0.10

    I am also seeing clamav errors in the /usr/local/cpanel/logs/error_log (completely un-customized paper lantern). eg:
    Code:
    [2018-07-24 08:19:47 +0000] warn [Internal Warning while parsing ./frontend/paper_lantern/clamavconnector/index.html.tt 254800] Use of uninitialized value in addition (+) at /usr/local/cpanel/Cpanel/ClamScanner.pm line 92.
     at /usr/local/cpanel/Cpanel/ClamScanner.pm line 92.
       Cpanel::ClamScanner::ClamScanner_main("") called at cpanel.pl line 1612
       eval {...} called at cpanel.pl line 1612
       cpanel::cpanel::_api1("ClamScanner", "clamscanner", "main()", "main", ARRAY(0x39c6648), "safe_html_encode") called at /usr/local/cpanel/Cpanel/Template/Plugin/Api1.pm line 93
       eval {...} called at /usr/local/cpanel/Cpanel/Template/Plugin/Api1.pm line 93
       Cpanel::Template::Plugin::Api1::_api1_exec(0, "ClamScanner", "main", ARRAY(0x39c6648)) called at /usr/local/cpanel/Cpanel/Template/Plugin/Api1.pm line 47
       Cpanel::Template::Plugin::Api1::_captured_api1_exec("ClamScanner", "main", ARRAY(0x39c6648)) called at /usr/local/cpanel/base/frontend/paper_lantern/clamavconnector/index.html.tt line 1
       eval {...} called at /usr/local/cpanel/base/frontend/paper_lantern/clamavconnector/index.html.tt line 1
       eval {...} called at /usr/local/cpanel/base/frontend/paper_lantern/clamavconnector/index.html.tt line 16
       Template::Provider::__ANON__(Template::Context=HASH(0x396bb90)) called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/cpanel_lib/x86_64-linux-64int/Template/Document.pm line 163
       eval {...} called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/cpanel_lib/x86_64-linux-64int/Template/Document.pm line 161
       Template::Document::process(Template::Document=HASH(0x39c75a0), Template::Context=HASH(0x396bb90)) called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/cpanel_lib/x86_64-linux-64int/Template/Context.pm line 357
       eval {...} called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/cpanel_lib/x86_64-linux-64int/Template/Context.pm line 327
       Template::Context::process(Template::Context=HASH(0x396bb90), Template::Document=HASH(0x39c75a0)) called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/cpanel_lib/x86_64-linux-64int/Template/Service.pm line 94
       eval {...} called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/cpanel_lib/x86_64-linux-64int/Template/Service.pm line 91
       Template::Service::process(Template::Service=HASH(0x396b758), "/usr/local/cpanel/base/frontend/paper_lantern/clamavconnector"..., HASH(0x396e498)) called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/cpanel_lib/x86_64-linux-64int/Template.pm line 64
       Template::process(Template=HASH(0x396ea68), "/usr/local/cpanel/base/frontend/paper_lantern/clamavconnector"..., HASH(0x396e498), SCALAR(0x1666d38)) called at /usr/local/cpanel/Cpanel/Template.pm line 501
       Cpanel::Template::process_template("cpanel", HASH(0x396e498), HASH(0x17965d8)) called at cpanel.pl line 1031
       cpanel::cpanel::cptt_exectag("/usr/local/cpanel/base/frontend/paper_lantern/clamavconnector"..., 1) called at cpanel.pl line 4408
       cpanel::cpanel::run_standard_mode() called at cpanel.pl line 864
       cpanel::cpanel::script("cpanel::cpanel", "./frontend/paper_lantern/clamavconnector/index.html.tt") called at cpanel.pl line 271
    
    [2018-07-24 08:19:47 +0000] warn [Internal Warning while parsing ./frontend/paper_lantern/clamavconnector/index.html.tt 254800] Use of uninitialized value in substitution (s///) at /usr/local/cpanel/Cpanel/Path/Safety.pm line 19.
     at /usr/local/cpanel/Cpanel/Path/Safety.pm line 19.
       Cpanel::Path::Safety::make_safe_for_path(SCALAR(0x16b0670)) called at /usr/local/cpanel/Cpanel/Branding/Lite.pm line 602
       Cpanel::Branding::Lite::_get_nv_brandingpkg() called at /usr/local/cpanel/Cpanel/Branding/Lite.pm line 525
       Cpanel::Branding::Lite::_getbrandingpkg() called at /usr/local/cpanel/Cpanel/DynamicUI/App.pm line 453
       Cpanel::DynamicUI::App::_ensure_options_for_dynamic_ui_loader(HASH(0x175dd70)) called at /usr/local/cpanel/Cpanel/DynamicUI/App.pm line 351
       Cpanel::DynamicUI::App::_load_parsed_dynamicui_app_cache_if_valid("/home/ji5fyn2sl67/.cpanel/datastore/AVAILABLE_APPLICATIONS_CA"..., "arglist", 1) called at /usr/local/cpanel/Cpanel/DynamicUI/App.pm line 206
       Cpanel::DynamicUI::App::get_available_applications("arglist", 1) called at /usr/local/cpanel/Cpanel/Template/Plugin/Master.pm line 97
       Cpanel::Template::Plugin::Master::load("Cpanel::Template::Plugin::Master", Template::Context=HASH(0x396bb90)) called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/cpanel_lib/x86_64-linux-64int/Template/Plugins.pm line 217
       eval {...} called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/cpanel_lib/x86_64-linux-64int/Template/Plugins.pm line 217
       Template::Plugins::_load(Template::Plugins=HASH(0x396c370), "Master", Template::Context=HASH(0x396bb90)) called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/cpanel_lib/x86_64-linux-64int/Template/Plugins.pm line 108
       Template::Plugins::fetch(Template::Plugins=HASH(0x396c370), "Master", undef, Template::Context=HASH(0x396bb90)) called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/cpanel_lib/x86_64-linux-64int/Template/Context.pm line 195
       Template::Context::plugin(Template::Context=HASH(0x396bb90), "Master") called at /var/cpanel/template_compiles//usr/local/cpanel/base/frontend/paper_lantern/_assets/master.html.tt line 1
       eval {...} called at /var/cpanel/template_compiles//usr/local/cpanel/base/frontend/paper_lantern/_assets/master.html.tt line 1
       Template::Provider::__ANON__(Template::Context=HASH(0x396bb90)) called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/cpanel_lib/x86_64-linux-64int/Template/Document.pm line 163
       eval {...} called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/cpanel_lib/x86_64-linux-64int/Template/Document.pm line 161
       Template::Document::process(Template::Document=HASH(0x3c3ebe8), Template::Context=HASH(0x396bb90)) called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/cpanel_lib/x86_64-linux-64int/Template/Context.pm line 357
       eval {...} called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/cpanel_lib/x86_64-linux-64int/Template/Context.pm line 327
       Template::Context::process(Template::Context=HASH(0x396bb90), "_assets/master.html.tt", HASH(0x3b58770), "localize me!") called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/cpanel_lib/x86_64-linux-64int/Template/Context.pm line 415
       Template::Context::include(Template::Context=HASH(0x396bb90), "_assets/master.html.tt", HASH(0x3b58770)) called at /usr/local/cpanel/base/frontend/paper_lantern/clamavconnector/index.html.tt line 27
       eval {...} called at /usr/local/cpanel/base/frontend/paper_lantern/clamavconnector/index.html.tt line 16
       Template::Provider::__ANON__(Template::Context=HASH(0x396bb90)) called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/cpanel_lib/x86_64-linux-64int/Template/Document.pm line 163
       eval {...} called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/cpanel_lib/x86_64-linux-64int/Template/Document.pm line 161
       Template::Document::process(Template::Document=HASH(0x39c75a0), Template::Context=HASH(0x396bb90)) called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/cpanel_lib/x86_64-linux-64int/Template/Context.pm line 357
       eval {...} called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/cpanel_lib/x86_64-linux-64int/Template/Context.pm line 327
       Template::Context::process(Template::Context=HASH(0x396bb90), Template::Document=HASH(0x39c75a0)) called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/cpanel_lib/x86_64-linux-64int/Template/Service.pm line 94
       eval {...} called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/cpanel_lib/x86_64-linux-64int/Template/Service.pm line 91
       Template::Service::process(Template::Service=HASH(0x396b758), "/usr/local/cpanel/base/frontend/paper_lantern/clamavconnector"..., HASH(0x396e498)) called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/cpanel_lib/x86_64-linux-64int/Template.pm line 64
       Template::process(Template=HASH(0x396ea68), "/usr/local/cpanel/base/frontend/paper_lantern/clamavconnector"..., HASH(0x396e498), SCALAR(0x1666d38)) called at /usr/local/cpanel/Cpanel/Template.pm line 501
       Cpanel::Template::process_template("cpanel", HASH(0x396e498), HASH(0x17965d8)) called at cpanel.pl line 1031
       cpanel::cpanel::cptt_exectag("/usr/local/cpanel/base/frontend/paper_lantern/clamavconnector"..., 1) called at cpanel.pl line 4408
    
    They are not filling up the log file with the volume that @bloatedstoat is reporting.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    cPanelLauren likes this.
  5. bloatedstoat

    bloatedstoat Well-Known Member

    Joined:
    Jun 14, 2012
    Messages:
    127
    Likes Received:
    11
    Trophy Points:
    18
    Location:
    Victoria, Australia
    cPanel Access Level:
    Root Administrator
    @rpvw I suspect the volume of errors logged to the error_log is determined by the size of the actual mailboxes in the user's home directory. In my case the account I ran it on has a few mailboxes that are fairly large. So if the scan is looping through each item of mail and logging the errors to the error_log as it skips along then it can quickly get out of hand - which mine did. The error_log was totally infested and unusable.

    @SS-Maddy the post you made appears to have been removed, I received the email notification but the post appears to be missing, that said thank you for your time posting.

    @cPanelLauren Thank you for the information. I have log rotation set up already as you mention, the size for the rotation is set to 300MB and last night the file was rotated out so my reports are back to normal today thankfully.

    I have not made any customisations to the theme, not that I'm aware of, pretty confident on this one.

    I will shortly open a support ticket. Thank you for your help.
     
  6. bloatedstoat

    bloatedstoat Well-Known Member

    Joined:
    Jun 14, 2012
    Messages:
    127
    Likes Received:
    11
    Trophy Points:
    18
    Location:
    Victoria, Australia
    cPanel Access Level:
    Root Administrator
    Support ticket: 9973425
     
  7. SS-Maddy

    SS-Maddy Well-Known Member

    Joined:
    Mar 28, 2009
    Messages:
    115
    Likes Received:
    8
    Trophy Points:
    68
    cPanel Access Level:
    Root Administrator
    Post was removed because the workaround is not at all recommended and was definitely not inline with the QoS of cPanel :) The real issue is the error logs are getting full and that should be fixed. I oversaw it.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  8. bloatedstoat

    bloatedstoat Well-Known Member

    Joined:
    Jun 14, 2012
    Messages:
    127
    Likes Received:
    11
    Trophy Points:
    18
    Location:
    Victoria, Australia
    cPanel Access Level:
    Root Administrator
    For those who might be following this and those that are experiencing the same problem, such as @rpvw , two internal cases have been opened by the support analyst who investigated and replicated the issue described above - and I quote:

    Internal case CPANEL-21904, this first case has to do with how we use the timestamps on a file to check for the time at which a user last performed a virus scan -- this causes some errors to get logged to the cPanel error log unnecessarily.

    Internal case CPANEL-21905, has to do with the virus scanning itself logging a warning regarding uninitialized variables for each message that is not a virus.
     
  9. cPanelLauren

    cPanelLauren Forums Analyst II
    Staff Member

    Joined:
    Nov 14, 2017
    Messages:
    3,204
    Likes Received:
    228
    Trophy Points:
    173
    Location:
    Houston
    cPanel Access Level:
    DataCenter Provider
    Hi @bloatedstoat

    Thank you for opening the ticket and then updating with the outcome. I'm really happy that they were able to get the cases open for this, those errors should never have been occurring. I'm now watching the cases and I'll update here when they're resolved.


    Thanks!
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
Loading...

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice