Hi all,
Currently having an issue with HTTPD, it has said all of the following, dependent where I look.
"httpd dead but subsys locked"
[root@echo ~]# service httpd status
httpd is stopped
[root@echo ~]# service httpd start
Starting httpd: httpd: Syntax error on line 272 of /etc/apache2/conf/httpd.conf: Syntax error on line 32 of /etc/apache2/conf.d/modsec2.conf: Syntax error on line 27 of /etc/apache2/conf.d/modsec/modsec2.cpanel.conf: Could not open configuration file /etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/00_Init_Initialization.conf: No such file or directory
[FAILED]
[root@echo ~]#
[root@echo ~]# /scripts/rebuildhttpdconf
c^H
Initial configuration generation failed with the following message:
The “/usr/sbin/httpd -DSSL -t -f /etc/apache2/conf/httpd.conf.work.81f18d5f.cfgcheck -C Include "/etc/apache2/conf.modules.d/*.conf"” command (process 22141) reported error number 1 when it ended.
httpd: Syntax error on line 273 of /etc/apache2/conf/httpd.conf.work.81f18d5f.cfgcheck: Syntax error on line 32 of /etc/apache2/conf.d/modsec2.conf: Syntax error on line 27 of /etc/apache2/conf.d/modsec/modsec2.cpanel.conf: Could not open configuration file /etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/00_Init_Initialization.conf: No such file or directory
Rebuilding configuration without any local modifications.
Failed to generate a syntactically correct Apache configuration.
Bad configuration file located at /etc/apache2/conf/httpd.conf.work.81f18d5f
Error:
The “/usr/sbin/httpd -DSSL -t -f /etc/apache2/conf/httpd.conf.work.81f18d5f.cfgcheck -C Include "/etc/apache2/conf.modules.d/*.conf"” command (process 22149) reported error number 1 when it ended.
httpd: Syntax error on line 273 of /etc/apache2/conf/httpd.conf.work.81f18d5f.cfgcheck: Syntax error on line 32 of /etc/apache2/conf.d/modsec2.conf: Syntax error on line 27 of /etc/apache2/conf.d/modsec/modsec2.cpanel.conf: Could not open configuration file /etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/00_Init_Initialization.conf: No such file or directory
I have checked and deleted locks in the following files/folders:
/var/run/*.pid and /var/lock/subsys/*
Has anyone got any ideas to help me with this?
Thanks
Jack
Currently having an issue with HTTPD, it has said all of the following, dependent where I look.
"httpd dead but subsys locked"
[root@echo ~]# service httpd status
httpd is stopped
[root@echo ~]# service httpd start
Starting httpd: httpd: Syntax error on line 272 of /etc/apache2/conf/httpd.conf: Syntax error on line 32 of /etc/apache2/conf.d/modsec2.conf: Syntax error on line 27 of /etc/apache2/conf.d/modsec/modsec2.cpanel.conf: Could not open configuration file /etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/00_Init_Initialization.conf: No such file or directory
[FAILED]
[root@echo ~]#
[root@echo ~]# /scripts/rebuildhttpdconf
c^H
Initial configuration generation failed with the following message:
The “/usr/sbin/httpd -DSSL -t -f /etc/apache2/conf/httpd.conf.work.81f18d5f.cfgcheck -C Include "/etc/apache2/conf.modules.d/*.conf"” command (process 22141) reported error number 1 when it ended.
httpd: Syntax error on line 273 of /etc/apache2/conf/httpd.conf.work.81f18d5f.cfgcheck: Syntax error on line 32 of /etc/apache2/conf.d/modsec2.conf: Syntax error on line 27 of /etc/apache2/conf.d/modsec/modsec2.cpanel.conf: Could not open configuration file /etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/00_Init_Initialization.conf: No such file or directory
Rebuilding configuration without any local modifications.
Failed to generate a syntactically correct Apache configuration.
Bad configuration file located at /etc/apache2/conf/httpd.conf.work.81f18d5f
Error:
The “/usr/sbin/httpd -DSSL -t -f /etc/apache2/conf/httpd.conf.work.81f18d5f.cfgcheck -C Include "/etc/apache2/conf.modules.d/*.conf"” command (process 22149) reported error number 1 when it ended.
httpd: Syntax error on line 273 of /etc/apache2/conf/httpd.conf.work.81f18d5f.cfgcheck: Syntax error on line 32 of /etc/apache2/conf.d/modsec2.conf: Syntax error on line 27 of /etc/apache2/conf.d/modsec/modsec2.cpanel.conf: Could not open configuration file /etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/00_Init_Initialization.conf: No such file or directory
Code:
Apache Restart Output: Apache could not be started due to an error: The “/usr/local/cpanel/scripts/restartsrv_httpd --start” command (process 18457) reported error number 255 when it ended. Waiting for “httpd” to start ……………failed. Cpanel::Exception::Services::StartError Service Status Service Error (XID hncwt2) The “httpd” service failed to start. Startup Log httpd: Syntax error on line 272 of /etc/apache2/conf/httpd.conf: Syntax error on line 32 of /etc/apache2/conf.d/modsec2.conf: Syntax error on line 27 of /etc/apache2/conf.d/modsec/modsec2.cpanel.conf: Could not open configuration file /etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/00_Init_Initialization.conf: No such file or directory Log Messages httpd: Syntax error on line 272 of /etc/apache2/conf/httpd.conf: Syntax error on line 32 of /etc/apache2/conf.d/modsec2.conf: Syntax error on line 27 of /etc/apache2/conf.d/modsec/modsec2.cpanel.conf: Could not open configuration file /etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/00_Init_Initialization.conf: No such file or directory [Thu Jul 30 08:07:25.126800 2020] [:error] [pid 30145] [client 34.240.11.213:43652] [client 34.240.11.213] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "122"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.SP=removed.net"] [uri "/wp-config.php"] [unique_id "XyJxrTQmKVHsaYTAlyWQdwAAAAk"] [Thu Jul 30 07:44:01.907530 2020] [:error] [pid 21144] [client 150.129.8.32:51470] [client 150.129.8.32] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "122"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "IRP=removed.com"] [uri "/wp-config.phporiginal"] [unique_id "XyJsMca2yaRMc9oRqTsbrgAAAAM"], referer: IRP=removed.com [Thu Jul 30 07:43:54.753558 2020] [:error] [pid 20237] [client 5.39.74.106:52974] [client 5.39.74.106] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "122"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "IRP=removed.com"] [uri "/wp-config.php-original"] [unique_id "XyJsKroj2Sb4isEZAsMmIQAAAAs"], referer: IRP=removed.com [Thu Jul 30 07:43:47.134027 2020] [:error] [pid 23208] [client 185.213.155.169:19386] [client 185.213.155.169] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "122"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "IRP=removed.com"] [uri "/wp-config.php_original"] [unique_id "XyJsI-vA6Y8n53Ivax-xbwAAAAY"], referer: IRP=removed.com [Thu Jul 30 07:43:45.679010 2020] [:error] [pid 30145] [client 5.39.74.106:51904] [client 5.39.74.106] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "122"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "IRP=removed.uk"] [uri "/wp-config.phporiginal"] [unique_id "XyJsITQmKVHsaYTAlyWQbwAAAAk"], referer: IRP=removed.uk [Thu Jul 30 07:43:42.955401 2020] [:error] [pid 20930] [client 150.129.8.23:36036] [client 150.129.8.23] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "122"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "IRP=removed.uk"] [uri "/wp-config.php-original"] [unique_id "XyJsHp5oHq2kkmMGm@vPcgAAAAI"], referer: IRP=removed.uk [Thu Jul 30 07:43:30.122491 2020] [:error] [pid 20239] [client 150.129.8.26:39926] [client 150.129.8.26] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "122"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "IRP=removed.uk"] [uri "/wp-config.php_original"] [unique_id "XyJsEoMhPuB3XKVe3wQuGAAAAAE"], referer: IRP=removed.uk [Thu Jul 30 07:43:20.322395 2020] [:error] [pid 20235] [client 54.36.108.162:33103] [client 54.36.108.162] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "122"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "IRP=removed.com"] [uri "/wp-config.php_orig"] [unique_id "XyJsCPJJ9jUwLpKbPGbiAwAAAAc"], referer: IRP=removed.com [Thu Jul 30 07:43:19.666390 2020] [:error] [pid 21910] [client 54.36.108.162:40825] [client 54.36.108.162] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "122"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "IRP=removed.uk"] [uri "/wp-config.php.original"] [unique_id "XyJsBz5ViveuO4qVGm0sgwAAAAQ"], referer: IRP=removed.uk [Thu Jul 30 07:43:14.968667 2020] [:error] [pid 21144] [client 54.36.108.162:35515] [client 54.36.108.162] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "122"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "IRP=removed.com"] [uri "/wp-config.php.orig"] [unique_id "XyJsAsa2yaRMc9oRqTsbrQAAAAM"], referer: IRP=removed.com [Thu Jul 30 07:43:14.900010 2020] [:error] [pid 20237] [client 54.36.108.162:33785] [client 54.36.108.162] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "122"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "IRP=removed.uk"] [uri "/wp-config.php_orig"] [unique_id "XyJsAroj2Sb4isEZAsMmIAAAAAs"], referer: IRP=removed.uk [Thu Jul 30 07:43:12.668180 2020] [:error] [pid 23208] [client 158.69.35.227:36768] [client 158.69.35.227] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "122"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "IRP=removed.com"] [uri "/wp-config.php_"] [unique_id "XyJsAPvA6Y8n53Ivax-xbgAAAAY"], referer: IRP=removed.com [Thu Jul 30 07:43:12.552036 2020] [:error] [pid 30145] [client 158.69.35.227:46571] [client 158.69.35.227] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "122"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "IRP=removed.uk"] [uri "/wp-config.php.orig"] [unique_id "XyJsADQmKVHsaYTAlyWQbgAAAAk"], referer: IRP=removed.uk [Thu Jul 30 07:43:07.510100 2020] [:error] [pid 20930] [client 158.69.35.227:34973] [client 158.69.35.227] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "122"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "IRP=removed.com"] [uri "/wp-config.php~"] [unique_id "XyJr@55oHq2kkmMGm@vPcQAAAAI"], referer: IRP=removed.com [Thu Jul 30 07:43:01.838748 2020] [:error] [pid 22201] [client 150.129.8.27:53218] [client 150.129.8.27] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "122"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "IRP=removed.uk"] [uri "/wp-config.php_"] [unique_id "XyJr9Y2c3Da2T4ORHKhBNQAAAAU"], referer: IRP=removed.uk [Thu Jul 30 07:43:01.126067 2020] [:error] [pid 20235] [client 150.129.8.27:53000] [client 150.129.8.27] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "122"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "IRP=removed.com"] [uri "/wp-config.php.save"] [unique_id "XyJr9fJJ9jUwLpKbPGbiAgAAAAc"], referer: IRP=removed.com [Thu Jul 30 07:42:58.953020 2020] [:error] [pid 21910] [client 51.158.111.157:38928] [client 51.158.111.157] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "122"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "IRP=removed.uk"] [uri "/wp-config.php~"] [unique_id "XyJr8j5ViveuO4qVGm0sggAAAAQ"], referer: IRP=removed.uk [Thu Jul 30 07:42:58.577913 2020] [:error] [pid 21144] [client 51.158.111.157:37916] [client 51.158.111.157] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "122"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "IRP=removed.com"] [uri "/wp-config.php.backup"] [unique_id "XyJr8sa2yaRMc9oRqTsbrAAAAAM"], referer: IRP=removed.com [Thu Jul 30 07:42:55.391439 2020] [:error] [pid 20237] [client 51.158.111.157:37778] [client 51.158.111.157] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "122"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "IRP=removed.uk"] [uri "/wp-config.php.save"] [unique_id "XyJr77oj2Sb4isEZAsMmHwAAAAs"], referer: IRP=removed.uk [Thu Jul 30 07:42:54.006682 2020] [:error] [pid 23208] [client 51.158.111.157:36652] [client 51.158.111.157] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "122"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "IRP=removed.com"] [uri "/wp-config.php.bak"] [unique_id "XyJr7vvA6Y8n53Ivax-xbQAAAAY"], referer: IRP=removed.com [Thu Jul 30 07:42:52.515631 2020] [:error] [pid 20238] [client 46.165.245.154:60068] [client 46.165.245.154] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "122"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "IRP=removed.uk"] [uri "/wp-config.php.backup"] [unique_id "XyJr7KBYqGfUT2ddSKwZigAAAAA"], referer: IRP=removed.uk [Thu Jul 30 07:42:49.075497 2020] [:error] [pid 30145] [client 185.220.101.13:6290] [client 185.220.101.13] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "122"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "IRP=removed.com"] [uri "/wp-config.php.old"] [unique_id "XyJr6TQmKVHsaYTAlyWQbQAAAAk"], referer: IRP=removed.com [Thu Jul 30 07:42:44.638032 2020] [:error] [pid 20930] [client 185.220.102.4:44607] [client 185.220.102.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "122"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "IRP=removed.uk"] [uri "/wp-config.php.bak"] [unique_id "XyJr5J5oHq2kkmMGm@vPcAAAAAI"], referer: IRP=removed.uk [Thu Jul 30 07:42:39.001594 2020] [:error] [pid 20235] [client 195.206.105.217:46332] [client 195.206.105.217] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "122"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "IRP=removed.com"] [uri "/wp-config.php.new"] [unique_id "XyJr3-JJ9jUwLpKbPGbiAQAAAAc"], referer: IRP=removed.com [Thu Jul 30 07:42:35.127493 2020] [:error] [pid 20239] [client 195.206.105.217:45814] [client 195.206.105.217] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "122"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "IRP=removed.uk"] [uri "/wp-config.php.old"] [unique_id "XyJr24MhPuB3XKVe3wQuFgAAAAE"], referer: IRP=removed.uk [Thu Jul 30 07:42:33.389982 2020] [:error] [pid 21910] [client 195.206.105.217:44488] [client 195.206.105.217] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.bak" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "122"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "IRP=removed.com"] [uri "/wp-config.bak"] [unique_id "XyJr2T5ViveuO4qVGm0sgQAAAAQ"], referer: IRP=removed.com [Thu Jul 30 07:42:32.978667 2020] [:error] [pid 21144] [client 195.206.105.217:44082] [client 195.206.105.217] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "122"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "IRP=removed.uk"] [uri "/wp-config.php.new"] [unique_id "XyJr2Ma2yaRMc9oRqTsbqwAAAAM"], referer: IRP=removed.uk [Thu Jul 30 07:42:31.478105 2020] [:error] [pid 23208] [client 195.206.105.217:39640] [client 195.206.105.217] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.bak" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "122"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "IRP=removed.uk"] [uri "/wp-config.bak"] [unique_id "XyJr1-vA6Y8n53Ivax-xbAAAAAY"], referer: IRP=removed.uk [Thu Jul 30 07:42:25.994238 2020] [:error] [pid 30145] [client 185.220.101.1:5300] [client 185.220.101.1] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "122"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "IRP=removed.uk"] [uri "/wp-config.php.disabled"] [unique_id "XyJr0TQmKVHsaYTAlyWQbAAAAAk"], referer: IRP=removed.uk [Thu Jul 30 07:42:22.267953 2020] [:error] [pid 20930] [client 150.129.8.19:56024] [client 150.129.8.19] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "122"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "IRP=removed.uk"] [uri "/wp-config.php.swp"] [unique_id "XyJrzp5oHq2kkmMGm@vPbwAAAAI"], referer: IRP=removed.uk [Thu Jul 30 07:42:21.159446 2020] [:error] [pid 20235] [client 150.129.8.19:58530] [client 150.129.8.19] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "122"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "IRP=removed.com"] [uri "/wp-config.php.disabled"] [unique_id "XyJrzfJJ9jUwLpKbPGbiAAAAAAc"], referer: IRP=removed.com [Thu Jul 30 07:42:19.729262 2020] [:error] [pid 20239] [client 150.129.8.19:56166] [client 150.129.8.19] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "122"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "IRP=removed.com"] [uri "/wp-config.php.swp"] [unique_id "XyJry4MhPuB3XKVe3wQuFQAAAAE"], referer: IRP=removed.com [Thu Jul 30 07:42:17.271036 2020] [:error] [pid 21910] [client 150.129.8.19:54146] [client 150.129.8.19] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "122"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "IRP=removed.com"] [uri "/wp-config.php.1"] [unique_id "XyJryT5ViveuO4qVGm0sgAAAAAQ"], referer: IRP=removed.com [Thu Jul 30 07:42:17.129486 2020] [:error] [pid 21144] [client 150.129.8.19:53910] [client 150.129.8.19] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "122"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "IRP=removed.uk"] [uri "/wp-config.php.1"] [unique_id "XyJryca2yaRMc9oRqTsbqgAAAAM"], referer: IRP=removed.uk [Thu Jul 30 07:42:14.618726 2020] [:error] [pid 23208] [client 150.129.8.19:53096] [client 150.129.8.19] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "122"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "IRP=removed.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "XyJrxvvA6Y8n53Ivax-xawAAAAY"], referer: IRP=removed.com [Thu Jul 30 07:42:14.277468 2020] [:error] [pid 30145] [client 150.129.8.19:52862] [client 150.129.8.19] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "122"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "IRP=removed.uk"] [uri "/wp-admin/admin-ajax.php"] [unique_id "XyJrxjQmKVHsaYTAlyWQawAAAAk"], referer: IRP=removed.uk [Thu Jul 30 07:32:47.285078 2020] [:error] [pid 21144] [client 35.182.130.82:48916] [client 35.182.130.82] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "122"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.thetaylorgroup.co.uk"] [uri "/.env"] [unique_id "XyJpj8a2yaRMc9oRqTsboQAAAAM"] [Thu Jul 30 07:19:24.099747 2020] [:error] [pid 21144] [client 46.229.168.152:51488] [client 46.229.168.152] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||blog.SP=removed.eu|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "blog.SP=removed.eu"] [uri "/textpattern/lang/el.ini"] [unique_id "XyJmbMa2yaRMc9oRqTsblgAAAAM"] [Thu Jul 30 06:52:16.908710 2020] [:error] [pid 30145] [client 114.119.167.246:59876] [client 114.119.167.246] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||blog.SP=removed.eu|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "blog.SP=removed.eu"] [uri "/textpattern/lang/ru.ini"] [unique_id "XyJgEDQmKVHsaYTAlyWQSAAAAAk"] [Thu Jul 30 06:31:39.605948 2020] [:error] [pid 20235] [client 46.229.168.137:19742] [client 46.229.168.137] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||blog.SP=removed.eu|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "blog.SP=removed.eu"] [uri "/textpattern-4.7.3/textpattern/setup/lang/ja.ini"] [unique_id "XyJbO-JJ9jUwLpKbPGbhywAAAAc"] [Thu Jul 30 06:20:23.594045 2020] [:error] [pid 21144] [client 114.119.166.48:47538] [client 114.119.166.48] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||blog.SP=removed.eu|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "blog.SP=removed.eu"] [uri "/textpattern/lang/en-gb.ini"] [unique_id "XyJYl8a2yaRMc9oRqTsbcwAAAAM"] [Thu Jul 30 05:46:05.916554 2020] [:error] [pid 20237] [client 46.229.168.144:14922] [client 46.229.168.144] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||blog.SP=removed.eu|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "blog.SP=removed.eu"] [uri "/textpattern-4.7.3/textpattern/lang/sr.ini"] [unique_id "XyJQjboj2Sb4isEZAsMlvgAAAAs"] [Thu Jul 30 05:31:36.609072 2020] [:error] [pid 20235] [client 46.229.168.143:35554] [client 46.229.168.143] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||blog.SP=removed.eu|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "blog.SP=removed.eu"] [uri "/textpattern-4.7.3/textpattern/setup/lang/en-gb.ini"] [unique_id "XyJNKPJJ9jUwLpKbPGbhtwAAAAc"] [Thu Jul 30 05:08:14.269825 2020] [:error] [pid 20239] [client 18.230.5.43:47322] [client 18.230.5.43] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||chat.SP=removed.eu|F|2"] [data ".conf"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "chat.SP=removed.eu"] [uri "/.conf"] [unique_id "XyJHroMhPuB3XKVe3wQtwwAAAAE"] [Thu Jul 30 04:47:59.738553 2020] [:error] [pid 20930] [client 46.229.168.132:5406] [client 46.229.168.132] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||blog.SP=removed.eu|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "blog.SP=removed.eu"] [uri "/textpattern/lang/da.ini"] [unique_id "XyJC755oHq2kkmMGm@vPFgAAAAI"] [Thu Jul 30 04:21:23.890368 2020] [:error] [pid 20235] [client 46.229.168.150:41728] [client 46.229.168.150] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||blog.SP=removed.eu|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "blog.SP=removed.eu"] [uri "/textpattern-4.7.3/textpattern/setup/lang/et.ini"] [unique_id "XyI8s-JJ9jUwLpKbPGbhoQAAAAc"] [Thu Jul 30 03:29:34.867424 2020] [mpm_prefork:notice] [pid 3392] AH00163: Apache/2.4.43 (cPanel) OpenSSL/1.1.1g mod_bwlimited/1.4 configured -- resuming normal operations [Thu Jul 30 03:29:23.583287 2020] [mpm_prefork:notice] [pid 3392] AH00163: Apache/2.4.43 (cPanel) OpenSSL/1.1.1g mod_bwlimited/1.4 configured -- resuming normal operations httpd has failed. Contact your system administrator if the service does not automagically recover. Log: [Thu Jul 30 07:43:47.134027 2020] [:error] [pid 23208] [client 185.213.155.169:19386] [client 185.213.155.169] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "122"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "IRP=removed.com"] [uri "/wp-config.php_original"] [unique_id "XyJsI-vA6Y8n53Ivax-xbwAAAAY"], referer: IRP=removed.com [Thu Jul 30 07:43:54.753558 2020] [:error] [pid 20237] [client 5.39.74.106:52974] [client 5.39.74.106] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "122"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "IRP=removed.com"] [uri "/wp-config.php-original"] [unique_id "XyJsKroj2Sb4isEZAsMmIQAAAAs"], referer: IRP=removed.com [Thu Jul 30 07:44:01.907530 2020] [:error] [pid 21144] [client 150.129.8.32:51470] [client 150.129.8.32] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "122"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "IRP=removed.com"] [uri "/wp-config.phporiginal"] [unique_id "XyJsMca2yaRMc9oRqTsbrgAAAAM"], referer: IRP=removed.com [Thu Jul 30 07:45:20.513450 2020] [authz_core:error] [pid 21910] [client 46.229.168.137:19638] AH01630: client denied by server configuration: /home/SP=removed/public_html/blog/textpattern/vendors/Textpattern/Password/error_log [Thu Jul 30 07:48:43.210024 2020] [:error] [pid 20238] [client 95.163.255.17:60383] File does not exist: /home/sap/public_html/404.php [Thu Jul 30 07:48:48.341358 2020] [:error] [pid 21144] [client 95.163.255.123:35739] File does not exist: /home/sap/public_html/404.php [Thu Jul 30 07:57:21.199540 2020] [authz_core:error] [pid 20237] [client 46.229.168.153:6528] AH01630: client denied by server configuration: /home/SP=removed/public_html/blog/textpattern/vendors/Textpattern/Type/error_log [Thu Jul 30 08:07:25.126800 2020] [:error] [pid 30145] [client 34.240.11.213:43652] [client 34.240.11.213] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "122"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.SP=removed.net"] [uri "/wp-config.php"] [unique_id "XyJxrTQmKVHsaYTAlyWQdwAAAAk"] [Thu Jul 30 08:10:13.288334 2020] [mpm_prefork:notice] [pid 3392] AH00171: Graceful restart requested, doing restart httpd: Syntax error on line 272 of /etc/apache2/conf/httpd.conf: Syntax error on line 32 of /etc/apache2/conf.d/modsec2.conf: Syntax error on line 27 of /etc/apache2/conf.d/modsec/modsec2.cpanel.conf: Could not open configuration file /etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/00_Init_Initialization.conf: No such file or directoryI have checked and deleted locks in the following files/folders:
/var/run/*.pid and /var/lock/subsys/*
Has anyone got any ideas to help me with this?
Thanks
Jack
