suphp deleted

[uadm]

Not sure if this is cloud linux issue or not, but the fact is that our system is cloud linux.

The problem: /opt/suphp/sbin/suphp is deleted. We reinstalled it from /home/cpeasyapache/src/suphp-0 however are a few weeks it's gone again.

We can't find what is causing the file to be deleted.

Anyone else seen this?

 

[Jcats]

How did you become aware of the issue?

Are you able to see when the problem started, it will most likely show in Apache error log

# grep suphp /usr/local/apache/logs/error_log

I would try and find when the problem started to see if you can link it to maybe an issue with cPanel update for example, you can see if it occurs around the time the cron runs.

 

[uadm]

We get aware of the issue when the sites start to return internal server error.

There's no consistancy in the error start. Once it startd at 23:15, once it started at 09:44.
We checked the crons on the server. Nothing there to even come close to /opt

 

[cPanelMichael]

Hello

Is the file regenerated if you rebuild Apache/PHP via EasyApache?

Thank you.

 

[uadm]

basically, yes. However we didn't run the entire easyapache process but only make install in /home/cpeasyapache/src/suphp-0 which by it self generated the file.

 

[cPanelMichael]

I'm not aware of any processes that would remove the /opt/suphp/sbin/suphp file from a system. The following tutorial may help you track down what's removing the file:

http://www.cyberciti.biz/tips/linux-audit-files-to-see-who-made-changes-to-a-file.html

Thank you.

 

[dario2]

Did you ever find out what caused suphp to be deleted? I've just had that happen to me. Your solution with the quick make install was genious, thanks!

That's the first time it's ever happened on one of my servers. It's also my first CentOS 7 server with Cpanel, just sayin'...

Does the Linux audit system track file deletions? It seems to only track reads, writes, appends and executions, not file removal though...

Thanks!

 

[cPanelMichael]

You could audit the directory itself as suggested on this URL:

Re: Who is deleting the file

Thank you.