The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

/tmp/mysqlsock suddenly missing

Discussion in 'General Discussion' started by jamesbond, Jul 25, 2003.

  1. jamesbond

    jamesbond Well-Known Member

    Joined:
    Oct 9, 2002
    Messages:
    738
    Likes Received:
    1
    Trophy Points:
    18
    This morning I noticed none of my php sites were able to connect to mysql, and when I went into /tmp I noticed the mysql.sock link was missing.
    I recreated it and everything started working again.

    Nothing has been updated on the server in the last day, how can the link suddenly disappear?
    How can I trace back what caused the link to disappear, and how can I prevent this from happening.

    cPanel.net Support Ticket Number:
     
  2. ciphervendor

    ciphervendor Well-Known Member

    Joined:
    Aug 26, 2002
    Messages:
    1,052
    Likes Received:
    0
    Trophy Points:
    36
    Check your mysql error log, perhaps mysql failed last night, ran out of disk space, etc. etc.

    cPanel.net Support Ticket Number:
     
  3. jamesbond

    jamesbond Well-Known Member

    Joined:
    Oct 9, 2002
    Messages:
    738
    Likes Received:
    1
    Trophy Points:
    18
    I went through the logs, for mysql I only have the hostname.err log file, which didn't mention anything of an interrupted service.
    MySQL server itself has been up all the time.

    /var/log/messages mentions nothing unusual

    /tmp is on a seperate partition mounted with noexec and nosuid and has 99% free space
    The rest of the partitions all have plenty of space as well.

    Oh well, I guess it's not that important to find the cause of the missing mysql.sock link, as long as it doesn't happen too often :)

    cPanel.net Support Ticket Number:
     
  4. jamesbond

    jamesbond Well-Known Member

    Joined:
    Oct 9, 2002
    Messages:
    738
    Likes Received:
    1
    Trophy Points:
    18
    This morning mysql.sock was missing again.

    I have no idea why this happens...It happened twice now in 10 days, around the same time at night.

    1. mysql has not failed, neither has any other service
    2. /var/lib/mysql/hostname.err log shows nothing.
    3. none of the partitions on the harddisk are even close to being full.
    4. I checked the MRTG graphs, which showed no high peaks.
    5. log files in /usr/local/cpanel/logs/ show nothing, no activity at the time of the disappearance of /tmp/mysql.sock
    6. /var/log/messages shows nothing

    Still there is something that is deleting /tmp/mysql.sock... :(

    cPanel.net Support Ticket Number:
     
  5. euselect

    euselect Well-Known Member

    Joined:
    Aug 3, 2003
    Messages:
    51
    Likes Received:
    0
    Trophy Points:
    6
    Do you know what tme this normally happens ?

    If its 4am check whats in your cron.daily.
    In fact , check your cronlogs to see if its something be fired up from cron

    I have an entry in cron.daily called tmpwatch, cleans old files ... from /tmp

    Cheers

    Neil

    cPanel.net Support Ticket Number:
     
  6. jamesbond

    jamesbond Well-Known Member

    Joined:
    Oct 9, 2002
    Messages:
    738
    Likes Received:
    1
    Trophy Points:
    18
    I was just looking for cronjobs running and I think you hit the nail on the head.

    It runs at 4 AM, and the errors in the apache logs start appearing a while after 4 AM in both cases.

    cPanel.net Support Ticket Number:
     
  7. euselect

    euselect Well-Known Member

    Joined:
    Aug 3, 2003
    Messages:
    51
    Likes Received:
    0
    Trophy Points:
    6
    Thats kind of good then.
    Shouldnt be too hard to track down after that.

    Good luck

    neil

    cPanel.net Support Ticket Number:
     
  8. jamesbond

    jamesbond Well-Known Member

    Joined:
    Oct 9, 2002
    Messages:
    738
    Likes Received:
    1
    Trophy Points:
    18
    Easier said than done :)

    The cron might run daily but mysql.sock gets deleted on random days and not very frequent either (twice so far).

    It could be one of the other cpanel cronjobs as well.

    I submitted a support ticket for this, hopefully they can find out why this happens.

    cPanel.net Support Ticket Number:
     
  9. euselect

    euselect Well-Known Member

    Joined:
    Aug 3, 2003
    Messages:
    51
    Likes Received:
    0
    Trophy Points:
    6
    I would take a look at tmpwatch . After all its all about cleaning up tmp

    Neil

    cPanel.net Support Ticket Number:
     
  10. jamesbond

    jamesbond Well-Known Member

    Joined:
    Oct 9, 2002
    Messages:
    738
    Likes Received:
    1
    Trophy Points:
    18
    Yes I assume it is caused by tmpwatch, but i still can't figure out why it decides to remove mysql.sock once in a while.

    I did look at :
    /etc/cron.daily/tmpwatch
    /usr/sbin/tmpwatch
    /var/log/cron

    Does tmpwatch create logs?

    cPanel.net Support Ticket Number:
     
  11. euselect

    euselect Well-Known Member

    Joined:
    Aug 3, 2003
    Messages:
    51
    Likes Received:
    0
    Trophy Points:
    6
    This is how tmpwatch is fired up on my systems:

    root@localhost [~]# cat /etc/cron.daily/tmpwatch
    /usr/sbin/tmpwatch 240 /tmp
    /usr/sbin/tmpwatch 720 /var/tmp
    for d in /var/{cache/man,catman}/{cat?,X11R6/cat?,local/cat?}; do
    if [ -d "$d" ]; then
    /usr/sbin/tmpwatch -f 720 $d
    fi
    done

    ---

    I assume the argument is minutes since accesed or similar
    As a work around you could touch /tmp/mysql.sock daily , to make sure it doesnt get removed.

    Neil

    cPanel.net Support Ticket Number:
     
  12. jamesbond

    jamesbond Well-Known Member

    Joined:
    Oct 9, 2002
    Messages:
    738
    Likes Received:
    1
    Trophy Points:
    18
    Indeed it seems that mysql.sock gets deleted if the access date is older than X minutes or hours. I'm not sure what the '240' stands for.

    My tmpwatch is identical.
    I'm running a cronjob for the time being.

    Doing a search on this forum and google shows I'm not the only one with disappearing mysql.sock symlinks.
     
    #12 jamesbond, Aug 5, 2003
    Last edited: Aug 5, 2003
  13. euselect

    euselect Well-Known Member

    Joined:
    Aug 3, 2003
    Messages:
    51
    Likes Received:
    0
    Trophy Points:
    6
    Hi

    I am using RedHat7.3 , without cpanel and my file is in /var/lib/mysql/mysql.sock

    On my test cpanel server /tmp/mysql.sock is a link to /var/lib/mysql/mysql.sock=

    I find it odd theres a = on the end , maybe some one knows what that is ?

    Cpanel server:

    root@localhost [/scripts/chkrootkit-0.41]# ls -l /var/lib/mysql/mysql.sock
    srwxrwxrwx 1 mysql mysql 0 Aug 5 19:56 /var/lib/mysql/mysql.sock=
    root@localhost [/scripts/chkrootkit-0.41]# ls -l /tmp/mysql.sock
    lrwxrwxrwx 1 root root 25 Aug 4 03:52 /tmp/mysql.sock -> /var/lib/mysql/mysql.sock=


    I suggest checking /var/lib/mysql/mysql.sock and /tmp/mysql.sock to see if theres a link or its a real file . tmpwatch shouldnt remove links ...

    Neil

    cPanel.net Support Ticket Number:
     
  14. jamesbond

    jamesbond Well-Known Member

    Joined:
    Oct 9, 2002
    Messages:
    738
    Likes Received:
    1
    Trophy Points:
    18
    Yes on CPanel servers /tmp/mysql.sock is a link to /var/lib/mysql/mysql.sock

    Don't know what the '=' is for (maybe because it is linked?) , but it's the way it is supposed to be :)

    cPanel.net Support Ticket Number:
     
  15. jamesbond

    jamesbond Well-Known Member

    Joined:
    Oct 9, 2002
    Messages:
    738
    Likes Received:
    1
    Trophy Points:
    18
    I have narrowed it down.

    the 240 stands for 240 hours.

    If the mysql.sock last accessed date is older than 240 hours then the symlink gets deleted.
    240 hours=10 days, which is exactly the period between the first and second time my mysql.sock symlink has been deleted.

    The server has been running without a problem over 10 months, until 10 days ago.

    I'm trying to think what causes the last accessed date not to update.
    I have /tmp mounted with the noexec and nosuid flag, but that shouldn't interfere with that I think.

    cPanel.net Support Ticket Number:
     
  16. jamesbond

    jamesbond Well-Known Member

    Joined:
    Oct 9, 2002
    Messages:
    738
    Likes Received:
    1
    Trophy Points:
    18
    Found the cause! :)


    From /etc/fstab

    LABEL=/tmp /tmp ext2 nosuid,nodev,noexec,noatime 1 2

    Attention:
    All people who used the partition securing outlined here:

    http://www.admin0.info/security/3partition.html

    You have to remove the noatime flag, otherwise your mysql.sock symlink will be deleted after 240 hours.
     
    #16 jamesbond, Aug 5, 2003
    Last edited: Aug 5, 2003
  17. Gliebster

    Gliebster Active Member

    Joined:
    Jul 17, 2002
    Messages:
    25
    Likes Received:
    0
    Trophy Points:
    1
    Thanks for the solution. This just happened to me.
     
  18. anand

    anand Well-Known Member

    Joined:
    Nov 11, 2002
    Messages:
    1,435
    Likes Received:
    1
    Trophy Points:
    38
    Location:
    India
    cPanel Access Level:
    DataCenter Provider
    Thx for sharing the info. I believe admin0 should update his site accordingly so other users don't get into this trouble.
     
  19. jamesbond

    jamesbond Well-Known Member

    Joined:
    Oct 9, 2002
    Messages:
    738
    Likes Received:
    1
    Trophy Points:
    18
    My post was from August :)
    He did update his tutorial and replaced this section with the howto found on the EV1servers forum.

    Another tip. Don't use the mod_security set up he posted on his site. It's too strict. Using that configuration file will result in several different issues.
     
  20. anand

    anand Well-Known Member

    Joined:
    Nov 11, 2002
    Messages:
    1,435
    Likes Received:
    1
    Trophy Points:
    38
    Location:
    India
    cPanel Access Level:
    DataCenter Provider
    I guess i made a fool of myself :p

    Well don't understand how i got mangled up with this and never didn't c the date on the post. My apologies for that. And thx for the tip on mod_security, i was planning to put it on a test bed on a box of mine. Would reconsider now ;)
     
Loading...

Share This Page