The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

etc/cron.hourly/modsecparse.pl:DBI connect('modsec:localhost','modsec',...) Errors

Discussion in 'Security' started by betoranaldi, Mar 3, 2014.

  1. betoranaldi

    betoranaldi Well-Known Member

    Joined:
    Dec 5, 2007
    Messages:
    105
    Likes Received:
    0
    Trophy Points:
    16
    Ever since 1am last night I am receiving the following error hourly.

    Code:
    /etc/cron.hourly/modsecparse.pl: 
    
    DBI connect('modsec:localhost','modsec',...) failed: Can't connect to local MySQL server through socket '/tmp/mysql.sock' (2) at /etc/cron.hourly/modsecparse.pl line 19 
    Unable to connect to mysql database at /etc/cron.hourly/modsecparse.pl line 19.
    I'm puzzled on this one. Nothing has changed on the server and I didn't see anything suspicious before the error started to appear.

    Anyone know how to correct it?
     
  2. Infopro

    Infopro cPanel Sr. Product Evangelist
    Staff Member

    Joined:
    May 20, 2003
    Messages:
    14,474
    Likes Received:
    202
    Trophy Points:
    63
    Location:
    Pennsylvania
    cPanel Access Level:
    Root Administrator
    Twitter:
  3. betoranaldi

    betoranaldi Well-Known Member

    Joined:
    Dec 5, 2007
    Messages:
    105
    Likes Received:
    0
    Trophy Points:
    16
    Re: All of a sudden...etc/cron.hourly/modsecparse.pl:DBI connect('modsec:localhost','modsec',...) fa

    Thanks Infopro.

    I tried the easy apache route without success. (removed mod_sec and then installed it again.) I also ran the upcp script without any luck.

    I just ran /scripts/restartsrv_mysql so we will see if that works and I will report back.

    Code:
    root@s1 [~]# find /usr/local/apache -regex ".*modsec.*\|.*mod_security.*" | sort
    /usr/local/apache/conf/modsec2.conf
    /usr/local/apache/conf/modsec2.conf.cpbackup1
    /usr/local/apache/conf/modsec2.conf.cpbackup2
    /usr/local/apache/conf/modsec2.conf.cpbackup3
    /usr/local/apache/conf/modsec2.conf.cpbackup4
    /usr/local/apache/conf/modsec2.conf.cpbackup5
    /usr/local/apache/conf/modsec2.conf.cpbackup6
    /usr/local/apache/conf/modsec2.conf.cpbackup7
    /usr/local/apache/conf/modsec2.conf.cpbackup8
    /usr/local/apache/conf/modsec2.conf.cpbackup9
    /usr/local/apache/conf/modsec2.conf,v
    /usr/local/apache/conf/modsec2.user.conf
    /usr/local/apache/conf/modsec2.user.conf.default
    /usr/local/apache/conf/modsec2.user.conf.none
    /usr/local/apache/conf/modsec2.whitelist.conf
    /usr/local/apache/logs/modsec_audit.log
    /usr/local/apache/logs/modsec_debug_log
    /usr/local/apache/modules/mod_security2.so
    
    root@s1 [~]# /usr/local/apache/bin/httpd -l | grep "unique_id"
      mod_unique_id.c
    
    root@s1 [~]# /usr/local/apache/bin/httpd -M | egrep "sec|unique_id"
    AH00112: Warning: DocumentRoot [/home/user/public_html/sandbox] does not exist
     unique_id_module (static)
     security2_module (shared)
     
  4. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    30,854
    Likes Received:
    675
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
    Re: All of a sudden...etc/cron.hourly/modsecparse.pl:DBI connect('modsec:localhost','modsec',...) fa

    Hello :)

    Try reproducing the error by running the cron job manually:

    Code:
    /etc/cron.hourly/modsecparse.pl
    If it fails, make sure the password used on the "my $dbpassword" line in /etc/cron.hourly/modsecparse.pl matches the "modsec" password in MySQL. Here is an example of how to change the "modsec" MySQL password if necessary:

    Code:
    mysql mysql
    mysql > update user set Password=password('PASSWORDHERE') where User='modsec';
    mysql> flush privileges;
    mysql> quit;
    Thank you.
     
  5. jsnape

    jsnape Well-Known Member

    Joined:
    Mar 11, 2002
    Messages:
    174
    Likes Received:
    0
    Trophy Points:
    16
    Re: All of a sudden...etc/cron.hourly/modsecparse.pl:DBI connect('modsec:localhost','modsec',...) fa

    Same thing here on a newly installed system and I've gone through all of these steps and still get:

    The mod_security plugin could not connect to the database. Please verify that MySQL is running. Error: Access denied for user 'modsec'@'localhost' (using password: YES)

    I can run /etc/cron.hourly/modsecparse.pl and it doesn't throw any errors. The only thing different on this server is that its running centos 6.5 64 bit

    Linux 2.6.32-042stab084.26 #1 SMP Mon Feb 17 21:00:14 MSK 2014 x86_64 x86_64 x86_64 GNU/Linux

    EDIT:
    Nevermind, fixed it. I didn't notice errors in the apache build. "localhost did not have any working mirrors. Please check your internet connection or dns server. at..."


    /etc/hosts was screwed up (had localhost on the same line as the public IP).
     
    #5 jsnape, Mar 15, 2014
    Last edited: Mar 15, 2014
  6. cPanelPeter

    cPanelPeter Technical Analyst III
    Staff Member

    Joined:
    Sep 23, 2013
    Messages:
    569
    Likes Received:
    15
    Trophy Points:
    18
    cPanel Access Level:
    Root Administrator
    Twitter:
    Re: All of a sudden...etc/cron.hourly/modsecparse.pl:DBI connect('modsec:localhost','modsec',...) fa

    Hello,

    Please feel free to open a support ticket using the link in my signature. Once done, please post the ticket number in this thread so we can update it accordingly.
     
  7. GoWilkes

    GoWilkes Well-Known Member

    Joined:
    Sep 26, 2006
    Messages:
    367
    Likes Received:
    1
    Trophy Points:
    18
    cPanel Access Level:
    Root Administrator
    Re: All of a sudden...etc/cron.hourly/modsecparse.pl:DBI connect('modsec:localhost','modsec',...) fa

    FYI, I began receiving this same error today, too. I'm using WHM 11.42.0 (build 23).

    I was able to run modsecparse.pl via SSH with no errors. Based on jsnape's post, I checked /etc/hosts, and found that there is a setting in there that refers back to my old server's IP, so I suspect that this is the error.

    I only mention it because these errors all began around the same time. There may be a bug in this cPanel release related to it.
     
  8. petru

    petru Active Member

    Joined:
    Jul 12, 2013
    Messages:
    33
    Likes Received:
    0
    Trophy Points:
    6
    cPanel Access Level:
    Root Administrator
    Re: All of a sudden...etc/cron.hourly/modsecparse.pl:DBI connect('modsec:localhost','modsec',...) fa

    Same here GoWilkes,

    Just started getting this too on the latest update to 11.42.0 (build 23)
    Must be a bug in the latest release.
     
  9. omamees

    omamees Registered

    Joined:
    Jul 31, 2007
    Messages:
    3
    Likes Received:
    0
    Trophy Points:
    1
    Re: All of a sudden...etc/cron.hourly/modsecparse.pl:DBI connect('modsec:localhost','modsec',...) fa

    Today i have the same problem and can't find any solution for this! request id 4747115
    /etc/cron.hourly/modsecparse.pl:

    DBI connect('modsec:localhost','modsec',...) failed: Can't connect to local MySQL server through socket '/tmp/mysql.sock' (2) at /etc/cron.hourly/modsecparse.pl line 20
    Unable to connect to mysql database at /etc/cron.hourly/modsecparse.pl line 20.
     
  10. petru

    petru Active Member

    Joined:
    Jul 12, 2013
    Messages:
    33
    Likes Received:
    0
    Trophy Points:
    6
    cPanel Access Level:
    Root Administrator
    Re: All of a sudden...etc/cron.hourly/modsecparse.pl:DBI connect('modsec:localhost','modsec',...) fa

    Congrats on your first post in 7 Years Omamees! Haha.

    I've still got the same issue. Still can't figure out how to fix it. Hope someone has a Fix for it soon.
     
  11. pasayev

    pasayev Member

    Joined:
    Oct 15, 2013
    Messages:
    13
    Likes Received:
    0
    Trophy Points:
    1
    cPanel Access Level:
    Root Administrator
    Re: All of a sudden...etc/cron.hourly/modsecparse.pl:DBI connect('modsec:localhost','modsec',...) fa

    I also can't find any solution for it.

    DBI connect('modsec:localhost','modsec',...) failed: Can't connect to local MySQL server through socket '/tmp/mysql.sock' (2) at /etc/cron.hourly/modsecparse.pl line 20
    Unable to connect to mysql database at /etc/cron.hourly/modsecparse.pl line 20.
     
  12. omamees

    omamees Registered

    Joined:
    Jul 31, 2007
    Messages:
    3
    Likes Received:
    0
    Trophy Points:
    1
    Re: All of a sudden...etc/cron.hourly/modsecparse.pl:DBI connect('modsec:localhost','modsec',...) fa

    But line "innodb_force_recovery = 4"
    into etc/my.cnf
    I have removed from /var/lib/mysql
    3 files
    ib_logfile0
    ib_logfile1
    ibdata1
     
  13. Metalmurphy

    Metalmurphy Member

    Joined:
    Feb 3, 2013
    Messages:
    8
    Likes Received:
    0
    Trophy Points:
    1
    cPanel Access Level:
    DataCenter Provider
  14. pasayev

    pasayev Member

    Joined:
    Oct 15, 2013
    Messages:
    13
    Likes Received:
    0
    Trophy Points:
    1
    cPanel Access Level:
    Root Administrator
    Re: All of a sudden...etc/cron.hourly/modsecparse.pl:DBI connect('modsec:localhost','modsec',...) fa

    In WHM click service manager and check enable mysql and mysql monitor boxes and save changes. It should solve problem.
     
  15. domainsvm

    domainsvm Registered

    Joined:
    Oct 7, 2013
    Messages:
    2
    Likes Received:
    0
    Trophy Points:
    1
    cPanel Access Level:
    Root Administrator
    Re: All of a sudden...etc/cron.hourly/modsecparse.pl:DBI connect('modsec:localhost','modsec',...) fa

    This solved the problem for me.
     
  16. petru

    petru Active Member

    Joined:
    Jul 12, 2013
    Messages:
    33
    Likes Received:
    0
    Trophy Points:
    6
    cPanel Access Level:
    Root Administrator
    Re: All of a sudden...etc/cron.hourly/modsecparse.pl:DBI connect('modsec:localhost','modsec',...) fa

    Same here. It stopped the continuous emails but don't think it fixed the issue. But either way I'm not waking up to tons of spam from my own server. Lol
     
  17. maverick23

    maverick23 Well-Known Member

    Joined:
    Feb 23, 2005
    Messages:
    92
    Likes Received:
    0
    Trophy Points:
    6
    cPanel Access Level:
    DataCenter Provider
    Re: All of a sudden...etc/cron.hourly/modsecparse.pl:DBI connect('modsec:localhost','modsec',...) fa

    after resetting the password for mosec user and updating the cron file resolved the issue for me..
     
Loading...

Share This Page