Please whitelist cPanel in your adblocker so that you’re able to see our version release promotions, thanks!

The Community Forums

Interact with an entire community of cPanel & WHM users!

csf is being restarted, try again in a moment

Discussion in 'Security' started by Arta Seyedzadeh, Jun 19, 2019.

  1. Arta Seyedzadeh

    Arta Seyedzadeh Member

    Joined:
    May 22, 2018
    Messages:
    5
    Likes Received:
    1
    Trophy Points:
    3
    Location:
    Oman
    cPanel Access Level:
    DataCenter Provider
    Hello,

    I've recently updated cPanel to the latest version after the exim bug, since then my CSF is acting up and restarting after every 5 to 15 minutes and this goes on constantly. Probably it wasn't a solution to my issue but I uninstalled CSF and installed it again. But the issue still persists.

    Every time it restarts in CSF interface shows "Firewall Status: Enabled but Stopped [Start]"

    Note that when the csf is in this state, the users on the server experience interruption. Mostly err_connection_refused.

    This is the lfd log:
    Code:
    Jun 19 23:21:18 avocado lfd[1051252]: csf startup completed
    Jun 19 23:21:18 avocado lfd[1058844]: csf is currently restarting - command [/usr/sbin/exim -bpc] skipped on line 3416
    Jun 19 23:24:18 avocado lfd[1066476]: *User Processing* PID:1066364 Kill:0 User:someuser VM:850(MB) EXE:/opt/alt/php73/usr/bin/lsphp CMD:lsphp                                 
    Jun 19 23:26:18 avocado lfd[1051252]: csf is currently restarting - command [/sbin/iptables --wait -L LOCALINPUT -n] skipped on line 3096
    Jun 19 23:26:18 avocado lfd[1051252]: iptables appears to have been flushed - running *csf startup*...
    Jun 19 23:26:18 avocado lfd[1051252]: csf is currently restarting - command [/usr/sbin/csf -sf] skipped on line 3105
    Jun 19 23:26:19 avocado lfd[1051252]: *Error*: csf output: Error: csf is being restarted, try again in a moment: Resource temporarily unavailable at /usr/sbin/csf line 176.
    
    Jun 19 23:26:19 avocado lfd[1051252]: csf startup completed
    Jun 19 23:26:19 avocado lfd[1070812]: csf is currently restarting - command [/usr/sbin/exim -bpc] skipped on line 3416
    Jun 19 23:27:19 avocado lfd[1071771]: *Suspicious Process* PID:1070027 PPID:1069990 User:nobody Uptime:83 secs EXE:/usr/local/lsws/bin/lshttpd.5.3.8 CMD:litespeed (lshttpd - #02)
    Jun 19 23:31:19 avocado lfd[1051252]: csf is currently restarting - command [/sbin/iptables --wait -L LOCALINPUT -n] skipped on line 3096
    Jun 19 23:31:19 avocado lfd[1078762]: csf is currently restarting - command [/usr/sbin/exim -bpc] skipped on line 3416
    Jun 19 23:46:20 avocado lfd[1051252]: csf is currently restarting - command [/sbin/iptables --wait -L LOCALINPUT -n] skipped on line 3096
    Jun 19 23:46:20 avocado lfd[1111439]: csf is currently restarting - command [/usr/sbin/exim -bpc] skipped on line 3416
    Jun 19 23:56:22 avocado lfd[1051252]: csf is currently restarting - command [/sbin/iptables --wait -L LOCALINPUT -n] skipped on line 3096
    Jun 19 23:56:22 avocado lfd[1051252]: iptables appears to have been flushed - running *csf startup*...
    Jun 19 23:56:22 avocado lfd[1051252]: csf is currently restarting - command [/usr/sbin/csf -sf] skipped on line 3105
    Jun 19 23:56:22 avocado lfd[1051252]: *Error*: csf output: Error: csf is being restarted, try again in a moment: Resource temporarily unavailable at /usr/sbin/csf line 176.
    
    Jun 19 23:56:22 avocado lfd[1051252]: csf startup completed
    Jun 19 23:56:22 avocado lfd[1131929]: csf is currently restarting - command [/usr/sbin/exim -bpc] skipped on line 3416
    Jun 19 23:57:22 avocado lfd[1134434]: *User Processing* PID:1134368 Kill:0 User:someuseer VM:850(MB) EXE:/opt/alt/php73/usr/bin/lsphp CMD:lsphp                                 
    Jun 20 00:00:02 avocado lfd[1051252]: Main Process: TERM
    Jun 20 00:00:02 avocado lfd[1051252]: daemon stopped
    Jun 20 00:00:02 avocado lfd[1139282]: daemon started on avocado.7ho.st - csf v12.12 (cPanel)
    Jun 20 00:00:02 avocado lfd[1139282]: csf is currently restarting - command [/usr/bin/systemctl is-active firewalld] skipped on line 260
    Jun 20 00:00:02 avocado lfd[1139282]: LF_APACHE_ERRPORT: Set to [2]
    Jun 20 00:00:02 avocado lfd[1139282]: Restricting syslog/rsyslog socket acccess to group [mysyslog]...
    Jun 20 00:00:02 avocado lfd[1139282]: EasyApache4, using /etc/apache2/logs/error_log instead of /usr/local/apache/logs/error_log (Web Server)
    Jun 20 00:00:02 avocado lfd[1139282]: EasyApache4, using /etc/apache2/logs/error_log instead of /usr/local/apache/logs/error_log {ModSecurity}
    Jun 20 00:00:02 avocado lfd[1139282]: CSF Tracking...
    Jun 20 00:00:02 avocado lfd[1139282]: csf is currently restarting - command [/sbin/iptables --wait -L LOCALINPUT -n] skipped on line 3096
    Jun 20 00:00:02 avocado lfd[1139282]: iptables appears to have been flushed - running *csf startup*...
    Jun 20 00:00:02 avocado lfd[1139282]: csf is currently restarting - command [/usr/sbin/csf -sf] skipped on line 3105
    Jun 20 00:00:03 avocado lfd[1139282]: *Error*: csf output: Error: csf is being restarted, try again in a moment: Resource temporarily unavailable at /usr/sbin/csf line 176.
    
    Jun 20 00:00:03 avocado lfd[1139282]: csf startup completed
    Jun 20 00:00:03 avocado lfd[1139282]: IPv6 Enabled...
    Jun 20 00:00:03 avocado lfd[1139282]: LOAD Tracking...
    Jun 20 00:00:03 avocado lfd[1139282]: Country Code Lookups...
    Jun 20 00:00:03 avocado lfd[1139282]: System Integrity Tracking...
    Jun 20 00:00:03 avocado lfd[1139282]: Exploit Tracking...
    Jun 20 00:00:03 avocado lfd[1139372]: csf is currently restarting - command [/usr/bin/md5sum --check /var/lib/csf/csf.tempint] skipped on line 6944
    Jun 20 00:00:03 avocado lfd[1139282]: Directory Watching...
    Jun 20 00:00:03 avocado lfd[1139282]: Email Script Tracking...
    Did anyone experience this problem?
    The thing is I have 4 bare metal and 3 of them are experiencing the exact same problem.

    The config for all is the same with Litespeed web server.
     
  2. cPanelLauren

    cPanelLauren Forums Analyst II Staff Member

    Joined:
    Nov 14, 2017
    Messages:
    6,447
    Likes Received:
    503
    Trophy Points:
    263
    Location:
    Houston
    cPanel Access Level:
    DataCenter Provider
    You might want to ensure that you didn't get affected by the Exim compromise prior to updating do the bare metal servers also run exim?
    Feel free to open a ticket using the link in my signature. Once open please reply with the Ticket ID here so that we can update this thread with the resolution once the ticket is resolved.


    Thanks!
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  3. Arta Seyedzadeh

    Arta Seyedzadeh Member

    Joined:
    May 22, 2018
    Messages:
    5
    Likes Received:
    1
    Trophy Points:
    3
    Location:
    Oman
    cPanel Access Level:
    DataCenter Provider
    I did not get affected by the exim compromise.
    There was a conflict with a third-party WHM plugin for allowing WHMCS users to remotely unblock their IP address if they got blocked by CSF.

    It trolled me hard!
     
    cPanelLauren likes this.
Loading...

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice