csf is being restarted, try again in a moment

[A Hartonian]

Hello,

I've recently updated cPanel to the latest version after the exim bug, since then my CSF is acting up and restarting after every 5 to 15 minutes and this goes on constantly. Probably it wasn't a solution to my issue but I uninstalled CSF and installed it again. But the issue still persists.

Every time it restarts in CSF interface shows "Firewall Status: Enabled but Stopped [Start]"

Note that when the csf is in this state, the users on the server experience interruption. Mostly err_connection_refused.

This is the lfd log:

Jun 19 23:21:18 avocado lfd[1051252]: csf startup completed
Jun 19 23:21:18 avocado lfd[1058844]: csf is currently restarting - command [/usr/sbin/exim -bpc] skipped on line 3416
Jun 19 23:24:18 avocado lfd[1066476]: *User Processing* PID:1066364 Kill:0 User:someuser VM:850(MB) EXE:/opt/alt/php73/usr/bin/lsphp CMD:lsphp                                 
Jun 19 23:26:18 avocado lfd[1051252]: csf is currently restarting - command [/sbin/iptables --wait -L LOCALINPUT -n] skipped on line 3096
Jun 19 23:26:18 avocado lfd[1051252]: iptables appears to have been flushed - running *csf startup*...
Jun 19 23:26:18 avocado lfd[1051252]: csf is currently restarting - command [/usr/sbin/csf -sf] skipped on line 3105
Jun 19 23:26:19 avocado lfd[1051252]: *Error*: csf output: Error: csf is being restarted, try again in a moment: Resource temporarily unavailable at /usr/sbin/csf line 176.

Jun 19 23:26:19 avocado lfd[1051252]: csf startup completed
Jun 19 23:26:19 avocado lfd[1070812]: csf is currently restarting - command [/usr/sbin/exim -bpc] skipped on line 3416
Jun 19 23:27:19 avocado lfd[1071771]: *Suspicious Process* PID:1070027 PPID:1069990 User:nobody Uptime:83 secs EXE:/usr/local/lsws/bin/lshttpd.5.3.8 CMD:litespeed (lshttpd - #02)
Jun 19 23:31:19 avocado lfd[1051252]: csf is currently restarting - command [/sbin/iptables --wait -L LOCALINPUT -n] skipped on line 3096
Jun 19 23:31:19 avocado lfd[1078762]: csf is currently restarting - command [/usr/sbin/exim -bpc] skipped on line 3416
Jun 19 23:46:20 avocado lfd[1051252]: csf is currently restarting - command [/sbin/iptables --wait -L LOCALINPUT -n] skipped on line 3096
Jun 19 23:46:20 avocado lfd[1111439]: csf is currently restarting - command [/usr/sbin/exim -bpc] skipped on line 3416
Jun 19 23:56:22 avocado lfd[1051252]: csf is currently restarting - command [/sbin/iptables --wait -L LOCALINPUT -n] skipped on line 3096
Jun 19 23:56:22 avocado lfd[1051252]: iptables appears to have been flushed - running *csf startup*...
Jun 19 23:56:22 avocado lfd[1051252]: csf is currently restarting - command [/usr/sbin/csf -sf] skipped on line 3105
Jun 19 23:56:22 avocado lfd[1051252]: *Error*: csf output: Error: csf is being restarted, try again in a moment: Resource temporarily unavailable at /usr/sbin/csf line 176.

Jun 19 23:56:22 avocado lfd[1051252]: csf startup completed
Jun 19 23:56:22 avocado lfd[1131929]: csf is currently restarting - command [/usr/sbin/exim -bpc] skipped on line 3416
Jun 19 23:57:22 avocado lfd[1134434]: *User Processing* PID:1134368 Kill:0 User:someuseer VM:850(MB) EXE:/opt/alt/php73/usr/bin/lsphp CMD:lsphp                                 
Jun 20 00:00:02 avocado lfd[1051252]: Main Process: TERM
Jun 20 00:00:02 avocado lfd[1051252]: daemon stopped
Jun 20 00:00:02 avocado lfd[1139282]: daemon started on avocado.7ho.st - csf v12.12 (cPanel)
Jun 20 00:00:02 avocado lfd[1139282]: csf is currently restarting - command [/usr/bin/systemctl is-active firewalld] skipped on line 260
Jun 20 00:00:02 avocado lfd[1139282]: LF_APACHE_ERRPORT: Set to [2]
Jun 20 00:00:02 avocado lfd[1139282]: Restricting syslog/rsyslog socket acccess to group [mysyslog]...
Jun 20 00:00:02 avocado lfd[1139282]: EasyApache4, using /etc/apache2/logs/error_log instead of /usr/local/apache/logs/error_log (Web Server)
Jun 20 00:00:02 avocado lfd[1139282]: EasyApache4, using /etc/apache2/logs/error_log instead of /usr/local/apache/logs/error_log {ModSecurity}
Jun 20 00:00:02 avocado lfd[1139282]: CSF Tracking...
Jun 20 00:00:02 avocado lfd[1139282]: csf is currently restarting - command [/sbin/iptables --wait -L LOCALINPUT -n] skipped on line 3096
Jun 20 00:00:02 avocado lfd[1139282]: iptables appears to have been flushed - running *csf startup*...
Jun 20 00:00:02 avocado lfd[1139282]: csf is currently restarting - command [/usr/sbin/csf -sf] skipped on line 3105
Jun 20 00:00:03 avocado lfd[1139282]: *Error*: csf output: Error: csf is being restarted, try again in a moment: Resource temporarily unavailable at /usr/sbin/csf line 176.

Jun 20 00:00:03 avocado lfd[1139282]: csf startup completed
Jun 20 00:00:03 avocado lfd[1139282]: IPv6 Enabled...
Jun 20 00:00:03 avocado lfd[1139282]: LOAD Tracking...
Jun 20 00:00:03 avocado lfd[1139282]: Country Code Lookups...
Jun 20 00:00:03 avocado lfd[1139282]: System Integrity Tracking...
Jun 20 00:00:03 avocado lfd[1139282]: Exploit Tracking...
Jun 20 00:00:03 avocado lfd[1139372]: csf is currently restarting - command [/usr/bin/md5sum --check /var/lib/csf/csf.tempint] skipped on line 6944
Jun 20 00:00:03 avocado lfd[1139282]: Directory Watching...
Jun 20 00:00:03 avocado lfd[1139282]: Email Script Tracking...

Did anyone experience this problem?
The thing is I have 4 bare metal and 3 of them are experiencing the exact same problem.

The config for all is the same with Litespeed web server.

 

[cPanelLauren]

You might want to ensure that you didn't get affected by the Exim compromise prior to updating do the bare metal servers also run exim?
Feel free to open a ticket using the link in my signature. Once open please reply with the Ticket ID here so that we can update this thread with the resolution once the ticket is resolved.


Thanks!

 

[A Hartonian]

I did not get affected by the exim compromise.
There was a conflict with a third-party WHM plugin for allowing WHMCS users to remotely unblock their IP address if they got blocked by CSF.

It trolled me hard!

 

[Kati1509]

Hello, i have the same issue (csf is being restarted, try again in a moment: Resource temporarily unavailable at /usr/sbin/csf line 176) and i try this:

# rm /var/lib/csf/csf.lock
# csf -x
# csf -e

But this not work, what can i do?

 

[A Hartonian]

Hello, i have the same issue (csf is being restarted, try again in a moment: Resource temporarily unavailable at /usr/sbin/csf line 176) and i try this:

# rm /var/lib/csf/csf.lock
# csf -x
# csf -e

But this not work, what can i do?

Have you recently installed any third-party plugin/addon on the server? in my case I had installed CSF Unblocker for WHMCS a poorly coded third-party plugin that made the CSF restart every 5 minutes continuously.

If you haven't installed anything on the server, then save the hassle and uninstall the CSF and install it again. This is probably not the best way to overcome the issue you are facing.

To uninstall use:

cd /etc/csf
sh uninstall.sh

To install:

cd /usr/src
rm -fv csf.tgz
wget https://download.configserver.com/csf.tgz
tar -xzf csf.tgz
cd csf
sh install.sh

Remember that your settings in Firewall Configuration will be lost. If you did any modifications you must do it again.

 

[cPanelLauren]

Hello,


We'd really need more information to go off of, are you running WHMCS like the other poster here? Does the server have enough memory? You can check this by running something like

free -m

or for historical data sar -r