"Small" random restarts

[MrIver]

Hi Lauren and all others,

Sooo... we have a problem.

Our server seems to be restarting randomly all the time.

Everytime it happens we get the following error from Litespeed:

LiteSpeed Web server [host] on [host] restarts automatically to fix run away extapp group Errors

So first question:

1. Munin shows a restart, but is this only a LiteSpeed server restart? We have not gotten any alerts from the server, only munin and "uptime" command, shows a restart. So maybe Munin is reflecting litespeed and not nessesary the physical server?

Leading up to this one user has been limited in CPU and we have got 20+ admin email with the above error on that user:

Executable:



/opt/cpanel/ea-php72/root/usr/bin/lsphp.cagefs





Command Line (often faked in exploits):



lsphp:/home/user/public_html/index.php





Network connections by the process (if any):



tcp: our.server.ip:57666 -> our.server.ip:3306





Files open by the process (if any):



/dev/null

/var/log/apache2/stderr.log

/var/log/apache2/stderr.log

/tmp/.ZendSem.5K3G8w (deleted)

/dev/null

/var/cpanel/php/sessions/ea-php72/sess_26e230aff8e7aa52fc5bf645b90fbc75

In LiteSpeed Web Console i Have found a External App setting (extapp) called External Application Abort, where i can set LiteSpeed to abort proccesses.

So question 2.

2. Do you think this will limit the user and solve the problem? The user has previously state that he is running "Xenu scraper" on the site from time to time on his (very large) site, but should this be enough to restart Litespeed?

Thanks!

 

[MrIver]

Hmm ok, since the option is unset, "Enable Abort for All Requests" is the default, so i guess this wont do any differnce...

Any ideas to prevent these "automatic to run away extapp group Errors"

 

[cPanelLauren]

Hello @MrIver

Some further information is needed in order for me to help you:

Munin shows a restart, but is this only a LiteSpeed server restart? We have not gotten any alerts from the server, only munin and "uptime" command, shows a restart. So maybe Munin is reflecting litespeed and not nessesary the physical server?

What does munin say exactly? A screenshot would be helpful in this instance.

• What is the title of the LFD email you're receiving? (if you left anything out of the email it's important to include it as well just remove domain names/IP's)

Do you think this will limit the user and solve the problem? The user has previously state that he is running "Xenu scraper" on the site from time to time on his (very large) site, but should this be enough to restart Litespeed?

If you're the administrator of the server you can see what is consuming resources. You can get an idea of this at WHM>>Server Status>>Daily Process Log. In this instance though I'd look at the apache error logs first to find out the cause of the restarts (on cPanel LSWS logs to apache logs). You can find them at /etc/apache2/logs/error_log

 

[MrIver]

Hi Lauren,

Thanks again for your help.

It turns out that our server is randomly restarting thus making litespeed restart as well.

So right now we are monitoring the kernel to see what is going on. We have read alot about the issue, and it seems to be related to the exact server model that we use.

So as of now, i dont think not further investigation is needed on this issue, as it will probably be resolved when we get the random-restart issue resolved.

Thanks!

 

[cPanelLauren]

Hello,


Thanks for the update!