segfault at 0 ip errors

[migandroid]

CentOS v7.9.2009 kvm [server]

Since 3 days ago i have this warning messages every hour.

06:00:27 server kernel: splitlogs[1301]: segfault at 0 ip 000xxxxx0 sp 00007ffe232f6650 error 4 in libc-2.17.so[2ba8fd9aa000+1c4000]
06:17:08 server kernel: splitlogs[2412]: segfault at 0 ip 0000xxxxxxx sp 00007ffd83865f30 error 4 in libc-2.17.so[2af6103b4000+1c4000]
06:33:49 server kernel: splitlogs[3099]: segfault at 0 ip 0000xxxxxxx sp 00007ffc75418920 error 4 in libc-2.17.so[2ae843a03000+1c4000]
06:50:31 server kernel: splitlogs[3904]: segfault at 0 ip 0000xxxxxxx sp 00007ffd4e74e890 error 4 in libc-2.17.so[2aebd1f55000+1c4000]

Any recommendations?

 

[cPRex]

Hey there! This is a hunch, but I'm wondering if the firewall is actually related to the issue. Can you run this command and see if there is any output?

iptables -nL --line-numbers | grep "127.0.0"

If localhost loopback connections are blocked, this can cause an issue with the Apache service.

 

[migandroid]

Hey there! This is a hunch, but I'm wondering if the firewall is actually related to the issue. Can you run this command and see if there is any output?

iptables -nL --line-numbers | grep "127.0.0"

If localhost loopback connections are blocked, this can cause an issue with the Apache service.

Thanks for your support but returns nothing.


Regards

 

[migandroid]

The first time that error started to appear.

/usr/local/cpanel/logs/error_log:
[2022-02-10 03:18:17 +0000]: “/usr/local/cpanel/scripts/restartsrv_httpd ” called by (27503 - /usr/local/cpanel/3rdparty/bin/perl /etc/yum/universal-hooks/multi_pkgs/posttrans/ea-__WILDCARD__/500-restartsrv_httpd --pkg_list=/root/tmp/tmpwSuAua)
[2022-02-10 03:18:17 +0000]: “/usr/local/cpanel/scripts/restartsrv_apache_php_fpm --graceful” called by (27504 - /usr/local/cpanel/scripts/restartsrv_httpd)
[2022-02-10 03:18:17 +0000]: “/usr/local/cpanel/scripts/restartsrv_apache_php_fpm --graceful” called by (27504 - /usr/local/cpanel/scripts/restartsrv_httpd)
There are no changes to the Security Advisor state that require notification.

/var/log/lfd.log:
Feb 10 03:00:17 server lfd[26614]: *User Processing* PID:502 Kill:0 User:rpc Time:1617926 EXE:/usr/sbin/rpcbind CMD:/sbin/rpcbind -w


/var/log/messages:
Feb 10 03:18:03  systemd: Time has been changed
Feb 10 03:18:14  yum[27439]: Updated: ea-apache24-config-1.0-184.188.1.cpanel.noarch
Feb 10 03:18:14  yum[27439]: Updated: ea-apache24-config-runtime-1.0-184.188.1.cpanel.noarch
Feb 10 03:18:14  yum[27439]: Updated: ea-cpanel-tools-1.0-53.55.1.cpanel.x86_64
Feb 10 03:21:19  chronyd[538]: Source xxxxxx replaced with xxxxx
Feb 10 03:31:30  chronyd[538]: Selected source xxxxxxx
Feb 10 03:39:02  systemd: Started ImunifyAV.
Feb 10 03:39:03  imunify-service: Starting migrations
Feb 10 03:39:03  imunify-service: There is nothing to migrate
Feb 10 03:39:41 kernel: splitlogs[27525]: segfault at 0 ip 0000xxxxxxxxx sp 00007ffd395cb670 error 4 in libc-2.17.so[2afafc1f3000+1c4000]

 

[migandroid]

Started after this 3 updates, i dont know if is related.

Feb 10 03:18:14  yum[27439]: Updated: ea-apache24-config-1.0-184.188.1.cpanel.noarch
Feb 10 03:18:14  yum[27439]: Updated: ea-apache24-config-runtime-1.0-184.188.1.cpanel.noarch
Feb 10 03:18:14  yum[27439]: Updated: ea-cpanel-tools-1.0-53.55.1.cpanel.x86_64

 

[cPRex]

Are things working well after the updates? If not, it would be best to put in a ticket at this point so we can see the issue directly on the machine.

 

[migandroid]

Everything works ok, just this persisted error in logs after that update.

 

[cPRex]

Do you have piped logging enabled on the system? If so, that can help reduce the number of graceful restarts you experience.

 

[migandroid]

After check cpanel / raw /index.html

domain.com-ssl_log-Feb-2022 dont have any data after 2022-02-10 03:18:12 so its a confirmation that is related with the last 3 updates

[2022-02-10 03:18:17 +0000]: “/usr/local/cpanel/scripts/restartsrv_httpd ” called by (27503 - /usr/local/cpanel/3rdparty/bin/perl /etc/yum/universal-hooks/multi_pkgs/posttrans/ea-__WILDCARD__/500-restartsrv_httpd --pkg_list=/root/tmp/tmpwSuAua)
[2022-02-10 03:18:17 +0000]: “/usr/local/cpanel/scripts/restartsrv_apache_php_fpm --graceful” called by (27504 - /usr/local/cpanel/scripts/restartsrv_httpd)
[2022-02-10 03:18:17 +0000]: “/usr/local/cpanel/scripts/restartsrv_apache_php_fpm --graceful” called by (27504 - /usr/local/cpanel/scripts/restartsrv_httpd)

I never used before piped login.

 

[migandroid]

And the file in /var/log/apache2/domlogs/domain/domain.com-ssl_log have 0kb.

 

[cPRex]

Could you submit a ticket to our team so we can check that directly on the system?

 

[migandroid]

Ok the team cpanel fixef this.
/etc/apache2/conf.d/includes/pre_virtualhost_global.conf

#LogFormat "%a %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined

/etc/apache2/conf.d/includes/pre_main_global.conf

<IfModule remoteip_module>
RemoteIPHeader X-Forwarded-For
</IfModule>
<IfModule log_config_module>
LogFormat "%{Referer}i -> %U" referer
LogFormat "%{User-agent}i" agent
LogFormat "%a %l %u %t \"%r\" %>s %b" common
LogFormat "%a %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
CustomLog logs/access_log combined
</IfModule>