Detected PID 1 running outdated executable

David Newall

• May 21, 2018 09:49

Quite recently, cPanel started sending me emails saying "Detected n processes that are running outdated executables". One of the listed PIDs is 1, which is systemd, what used to be init before Centos developers went insane. I understand the message to be saying that the executable was expected to have been restarted within the last 24 hours, but I don't think systemd does that. I'm not even sure that you can restart the process without rebooting the machine. The machine is running CentOS Linux release 7.5.1804 (Core), and cPanel tells me it is version 11.70.0.42. These are the processes that were listed: root 1 0.2 0.1 128144 5820 ? Ss May18 13:05 /usr/lib/systemd/systemd --switched-root --system --deserialize 22 root 663 0.0 0.4 477816 16872 ? Ssl May18 1:19 /usr/sbin/NetworkManager --no-daemon root 1208 0.2 0.0 26776 2572 ? S May18 15:33 cpsrvd (SSL) - dormant mode - accepting connections root 1288 0.0 0.0 130048 2384 ? Ss May18 0:04 dnsadmin - dormant mode root 1296 0.0 0.3 151776 11832 ? S May18 3:31 cPhulkd - processor root 1315 0.0 0.0 130128 2380 ? S May18 0:13 cpdavd - accepting connections on 2077, 2078, 2079, and 2080 (dormant) Is it a bug for PID 1 to be reported as outdated? I thought cPanel restarted all restartable processes regularly, so why would these (other) processes have not been restarted? Thanks.

• 

  cPanelLauren

  • May 21, 2018 19:38

  Hello, cPanel only manages and monitors services listed at WHM>>Service Configuration>>Service Manager services like systemd won't be managed by this. cPanel runs /usr/bin/needs-restarting to get a list of pids that need to be restarted, regardless of whether or not they're managed by cPanel's Tailwatch/chkservd processes. The following is the only way I know of to reload systemd without rebooting the server: systemctl daemon-reexec
  There's a few reasons why a process will show as needs restarting either they aren't being monitored in WHM>>Service Configuration>>Service Manager or the /usr/bin/needs-restarting may have run in between service checks, though cPanel won't restart a running service if it's running normally as well.

  0
• 

  David Newall

  • May 22, 2018 03:13

  Hello Lauren, Thank you for your input. As you said, systemd is not one of the services listed at WHM>>Service Configuration>>Service Manager. Your hint, /usr/bin/needs-restarting, enabled me to discover that systemd was included in the list of outdated processes because libgcc-4.8.5-28.el7_5.1.x86_64 had been updated. I restarted the machine and anticipate that the email will cease (at least, cease to include pid 1!) Thank you for directing me to a good place to learn more about what is happening. For the benefit of anybody who is interested in learning how I discovered exactly why each process was included in the list: --- /usr/bin/needs-restarting 2018-04-11 14:16:19.000000000 +1000 +++ /tmp/y 2018-05-22 13:07:19.000000000 +1000 @@ -173,6 +173,7 @@ for pid in return_running_pids(uid=myuid): try: pid_start = utils.get_process_time(int(pid), boot_time)['start_time'> + print 'start time of', pid, 'is', pid_start except (OSError, IOError), e: continue found_match = False @@ -185,6 +186,7 @@ # if the file is in a pkg which has been updated since we started the pid - then it needs to be restarted for pkg in my.rpmdb.searchFiles(just_fn): if float(pkg.installtime) > float(pid_start): + print 'pid', pid, 'needs restarting because', just_fn, 'in package', pkg, 'was installed', (pkg.installtime-pid_start), 'seconds after process started.' needing_restart.add(pid) found_match = True continue Regards, David

  0
• 

  cPanelLauren

  • May 22, 2018 12:47

  Hi David, I'm really happy that my response helped and you were able to get some further information and alleviate your concerns. Thank you for sharing as well. Thanks!

  0

Please sign in to leave a comment.