etc/cron.hourly/modsecparse.pl:DBI connect('modsec:localhost','modsec',...) Errors

betoranaldi

Well-Known Member
Dec 5, 2007
105
0
66
Ever since 1am last night I am receiving the following error hourly.

Code:
/etc/cron.hourly/modsecparse.pl: 

DBI connect('modsec:localhost','modsec',...) failed: Can't connect to local MySQL server through socket '/tmp/mysql.sock' (2) at /etc/cron.hourly/modsecparse.pl line 19 
Unable to connect to mysql database at /etc/cron.hourly/modsecparse.pl line 19.
I'm puzzled on this one. Nothing has changed on the server and I didn't see anything suspicious before the error started to appear.

Anyone know how to correct it?
 

betoranaldi

Well-Known Member
Dec 5, 2007
105
0
66
Re: All of a sudden...etc/cron.hourly/modsecparse.pl:DBI connect('modsec:localhost','modsec',...) fa

Thanks Infopro.

I tried the easy apache route without success. (removed mod_sec and then installed it again.) I also ran the upcp script without any luck.

I just ran /scripts/restartsrv_mysql so we will see if that works and I will report back.

Code:
[email protected] [~]# find /usr/local/apache -regex ".*modsec.*\|.*mod_security.*" | sort
/usr/local/apache/conf/modsec2.conf
/usr/local/apache/conf/modsec2.conf.cpbackup1
/usr/local/apache/conf/modsec2.conf.cpbackup2
/usr/local/apache/conf/modsec2.conf.cpbackup3
/usr/local/apache/conf/modsec2.conf.cpbackup4
/usr/local/apache/conf/modsec2.conf.cpbackup5
/usr/local/apache/conf/modsec2.conf.cpbackup6
/usr/local/apache/conf/modsec2.conf.cpbackup7
/usr/local/apache/conf/modsec2.conf.cpbackup8
/usr/local/apache/conf/modsec2.conf.cpbackup9
/usr/local/apache/conf/modsec2.conf,v
/usr/local/apache/conf/modsec2.user.conf
/usr/local/apache/conf/modsec2.user.conf.default
/usr/local/apache/conf/modsec2.user.conf.none
/usr/local/apache/conf/modsec2.whitelist.conf
/usr/local/apache/logs/modsec_audit.log
/usr/local/apache/logs/modsec_debug_log
/usr/local/apache/modules/mod_security2.so

[email protected] [~]# /usr/local/apache/bin/httpd -l | grep "unique_id"
  mod_unique_id.c

[email protected] [~]# /usr/local/apache/bin/httpd -M | egrep "sec|unique_id"
AH00112: Warning: DocumentRoot [/home/user/public_html/sandbox] does not exist
 unique_id_module (static)
 security2_module (shared)
 

cPanelMichael

Technical Support Community Manager
Staff member
Apr 11, 2011
47,911
2,233
363
cPanel Access Level
DataCenter Provider
Twitter
Re: All of a sudden...etc/cron.hourly/modsecparse.pl:DBI connect('modsec:localhost','modsec',...) fa

Hello :)

Try reproducing the error by running the cron job manually:

Code:
/etc/cron.hourly/modsecparse.pl
If it fails, make sure the password used on the "my $dbpassword" line in /etc/cron.hourly/modsecparse.pl matches the "modsec" password in MySQL. Here is an example of how to change the "modsec" MySQL password if necessary:

Code:
mysql mysql
mysql > update user set Password=password('PASSWORDHERE') where User='modsec';
mysql> flush privileges;
mysql> quit;
Thank you.
 

jsnape

Well-Known Member
Mar 11, 2002
174
0
316
Re: All of a sudden...etc/cron.hourly/modsecparse.pl:DBI connect('modsec:localhost','modsec',...) fa

Same thing here on a newly installed system and I've gone through all of these steps and still get:

The mod_security plugin could not connect to the database. Please verify that MySQL is running. Error: Access denied for user 'modsec'@'localhost' (using password: YES)

I can run /etc/cron.hourly/modsecparse.pl and it doesn't throw any errors. The only thing different on this server is that its running centos 6.5 64 bit

Linux 2.6.32-042stab084.26 #1 SMP Mon Feb 17 21:00:14 MSK 2014 x86_64 x86_64 x86_64 GNU/Linux

EDIT:
Nevermind, fixed it. I didn't notice errors in the apache build. "localhost did not have any working mirrors. Please check your internet connection or dns server. at..."


/etc/hosts was screwed up (had localhost on the same line as the public IP).
 
Last edited:

cPanelPeter

Technical Analyst III
Staff member
Sep 23, 2013
575
20
143
cPanel Access Level
Root Administrator
Twitter
Re: All of a sudden...etc/cron.hourly/modsecparse.pl:DBI connect('modsec:localhost','modsec',...) fa

Hello,

Please feel free to open a support ticket using the link in my signature. Once done, please post the ticket number in this thread so we can update it accordingly.
 

GoWilkes

Well-Known Member
Sep 26, 2006
439
8
168
cPanel Access Level
Root Administrator
Re: All of a sudden...etc/cron.hourly/modsecparse.pl:DBI connect('modsec:localhost','modsec',...) fa

FYI, I began receiving this same error today, too. I'm using WHM 11.42.0 (build 23).

I was able to run modsecparse.pl via SSH with no errors. Based on jsnape's post, I checked /etc/hosts, and found that there is a setting in there that refers back to my old server's IP, so I suspect that this is the error.

I only mention it because these errors all began around the same time. There may be a bug in this cPanel release related to it.
 

petru

Active Member
Jul 12, 2013
38
1
8
cPanel Access Level
Root Administrator
Re: All of a sudden...etc/cron.hourly/modsecparse.pl:DBI connect('modsec:localhost','modsec',...) fa

Same here GoWilkes,

Just started getting this too on the latest update to 11.42.0 (build 23)
Must be a bug in the latest release.
 

omamees

Registered
Jul 31, 2007
3
0
51
Re: All of a sudden...etc/cron.hourly/modsecparse.pl:DBI connect('modsec:localhost','modsec',...) fa

Today i have the same problem and can't find any solution for this! request id 4747115
/etc/cron.hourly/modsecparse.pl:

DBI connect('modsec:localhost','modsec',...) failed: Can't connect to local MySQL server through socket '/tmp/mysql.sock' (2) at /etc/cron.hourly/modsecparse.pl line 20
Unable to connect to mysql database at /etc/cron.hourly/modsecparse.pl line 20.
 

petru

Active Member
Jul 12, 2013
38
1
8
cPanel Access Level
Root Administrator
Re: All of a sudden...etc/cron.hourly/modsecparse.pl:DBI connect('modsec:localhost','modsec',...) fa

Congrats on your first post in 7 Years Omamees! Haha.

I've still got the same issue. Still can't figure out how to fix it. Hope someone has a Fix for it soon.
 

pasayev

Member
Oct 15, 2013
13
0
1
Turkey
cPanel Access Level
Root Administrator
Re: All of a sudden...etc/cron.hourly/modsecparse.pl:DBI connect('modsec:localhost','modsec',...) fa

I also can't find any solution for it.

DBI connect('modsec:localhost','modsec',...) failed: Can't connect to local MySQL server through socket '/tmp/mysql.sock' (2) at /etc/cron.hourly/modsecparse.pl line 20
Unable to connect to mysql database at /etc/cron.hourly/modsecparse.pl line 20.
 

omamees

Registered
Jul 31, 2007
3
0
51
Re: All of a sudden...etc/cron.hourly/modsecparse.pl:DBI connect('modsec:localhost','modsec',...) fa

But line "innodb_force_recovery = 4"
into etc/my.cnf
I have removed from /var/lib/mysql
3 files
ib_logfile0
ib_logfile1
ibdata1
 

pasayev

Member
Oct 15, 2013
13
0
1
Turkey
cPanel Access Level
Root Administrator
Re: All of a sudden...etc/cron.hourly/modsecparse.pl:DBI connect('modsec:localhost','modsec',...) fa

In WHM click service manager and check enable mysql and mysql monitor boxes and save changes. It should solve problem.
 

petru

Active Member
Jul 12, 2013
38
1
8
cPanel Access Level
Root Administrator
Re: All of a sudden...etc/cron.hourly/modsecparse.pl:DBI connect('modsec:localhost','modsec',...) fa

Same here. It stopped the continuous emails but don't think it fixed the issue. But either way I'm not waking up to tons of spam from my own server. Lol
 

maverick23

Well-Known Member
Feb 23, 2005
92
0
156
cPanel Access Level
DataCenter Provider
Re: All of a sudden...etc/cron.hourly/modsecparse.pl:DBI connect('modsec:localhost','modsec',...) fa

after resetting the password for mosec user and updating the cron file resolved the issue for me..