Skip to main content

csf is being restarted, try again in a moment

A Hartonian
Hello, I've recently updated cPanel to the latest version after the exim bug, since then my CSF is acting up and restarting after every 5 to 15 minutes and this goes on constantly. Probably it wasn't a solution to my issue but I uninstalled CSF and installed it again. But the issue still persists. Every time it restarts in CSF interface shows "Firewall Status: Enabled but Stopped [Start]" Note that when the csf is in this state, the users on the server experience interruption. Mostly err_connection_refused. This is the lfd log: Jun 19 23:21:18 avocado lfd[1051252]: csf startup completed Jun 19 23:21:18 avocado lfd[1058844]: csf is currently restarting - command [/usr/sbin/exim -bpc] skipped on line 3416 Jun 19 23:24:18 avocado lfd[1066476]: *User Processing* PID:1066364 Kill:0 User:someuser VM:850(MB) EXE:/opt/alt/php73/usr/bin/lsphp CMD:lsphp Jun 19 23:26:18 avocado lfd[1051252]: csf is currently restarting - command [/sbin/iptables --wait -L LOCALINPUT -n] skipped on line 3096 Jun 19 23:26:18 avocado lfd[1051252]: iptables appears to have been flushed - running *csf startup*... Jun 19 23:26:18 avocado lfd[1051252]: csf is currently restarting - command [/usr/sbin/csf -sf] skipped on line 3105 Jun 19 23:26:19 avocado lfd[1051252]: *Error*: csf output: Error: csf is being restarted, try again in a moment: Resource temporarily unavailable at /usr/sbin/csf line 176. Jun 19 23:26:19 avocado lfd[1051252]: csf startup completed Jun 19 23:26:19 avocado lfd[1070812]: csf is currently restarting - command [/usr/sbin/exim -bpc] skipped on line 3416 Jun 19 23:27:19 avocado lfd[1071771]: *Suspicious Process* PID:1070027 PPID:1069990 User:nobody Uptime:83 secs EXE:/usr/local/lsws/bin/lshttpd.5.3.8 CMD:litespeed (lshttpd - #02) Jun 19 23:31:19 avocado lfd[1051252]: csf is currently restarting - command [/sbin/iptables --wait -L LOCALINPUT -n] skipped on line 3096 Jun 19 23:31:19 avocado lfd[1078762]: csf is currently restarting - command [/usr/sbin/exim -bpc] skipped on line 3416 Jun 19 23:46:20 avocado lfd[1051252]: csf is currently restarting - command [/sbin/iptables --wait -L LOCALINPUT -n] skipped on line 3096 Jun 19 23:46:20 avocado lfd[1111439]: csf is currently restarting - command [/usr/sbin/exim -bpc] skipped on line 3416 Jun 19 23:56:22 avocado lfd[1051252]: csf is currently restarting - command [/sbin/iptables --wait -L LOCALINPUT -n] skipped on line 3096 Jun 19 23:56:22 avocado lfd[1051252]: iptables appears to have been flushed - running *csf startup*... Jun 19 23:56:22 avocado lfd[1051252]: csf is currently restarting - command [/usr/sbin/csf -sf] skipped on line 3105 Jun 19 23:56:22 avocado lfd[1051252]: *Error*: csf output: Error: csf is being restarted, try again in a moment: Resource temporarily unavailable at /usr/sbin/csf line 176. Jun 19 23:56:22 avocado lfd[1051252]: csf startup completed Jun 19 23:56:22 avocado lfd[1131929]: csf is currently restarting - command [/usr/sbin/exim -bpc] skipped on line 3416 Jun 19 23:57:22 avocado lfd[1134434]: *User Processing* PID:1134368 Kill:0 User:someuseer VM:850(MB) EXE:/opt/alt/php73/usr/bin/lsphp CMD:lsphp Jun 20 00:00:02 avocado lfd[1051252]: Main Process: TERM Jun 20 00:00:02 avocado lfd[1051252]: daemon stopped Jun 20 00:00:02 avocado lfd[1139282]: daemon started on avocado.7ho.st - csf v12.12 (cPanel) Jun 20 00:00:02 avocado lfd[1139282]: csf is currently restarting - command [/usr/bin/systemctl is-active firewalld] skipped on line 260 Jun 20 00:00:02 avocado lfd[1139282]: LF_APACHE_ERRPORT: Set to [2] Jun 20 00:00:02 avocado lfd[1139282]: Restricting syslog/rsyslog socket acccess to group [mysyslog]... Jun 20 00:00:02 avocado lfd[1139282]: EasyApache4, using /etc/apache2/logs/error_log instead of /usr/local/apache/logs/error_log (Web Server) Jun 20 00:00:02 avocado lfd[1139282]: EasyApache4, using /etc/apache2/logs/error_log instead of /usr/local/apache/logs/error_log {ModSecurity} Jun 20 00:00:02 avocado lfd[1139282]: CSF Tracking... Jun 20 00:00:02 avocado lfd[1139282]: csf is currently restarting - command [/sbin/iptables --wait -L LOCALINPUT -n] skipped on line 3096 Jun 20 00:00:02 avocado lfd[1139282]: iptables appears to have been flushed - running *csf startup*... Jun 20 00:00:02 avocado lfd[1139282]: csf is currently restarting - command [/usr/sbin/csf -sf] skipped on line 3105 Jun 20 00:00:03 avocado lfd[1139282]: *Error*: csf output: Error: csf is being restarted, try again in a moment: Resource temporarily unavailable at /usr/sbin/csf line 176. Jun 20 00:00:03 avocado lfd[1139282]: csf startup completed Jun 20 00:00:03 avocado lfd[1139282]: IPv6 Enabled... Jun 20 00:00:03 avocado lfd[1139282]: LOAD Tracking... Jun 20 00:00:03 avocado lfd[1139282]: Country Code Lookups... Jun 20 00:00:03 avocado lfd[1139282]: System Integrity Tracking... Jun 20 00:00:03 avocado lfd[1139282]: Exploit Tracking... Jun 20 00:00:03 avocado lfd[1139372]: csf is currently restarting - command [/usr/bin/md5sum --check /var/lib/csf/csf.tempint] skipped on line 6944 Jun 20 00:00:03 avocado lfd[1139282]: Directory Watching... Jun 20 00:00:03 avocado lfd[1139282]: Email Script Tracking...
Did anyone experience this problem? The thing is I have 4 bare metal and 3 of them are experiencing the exact same problem. The config for all is the same with Litespeed web server.

Comments

5 comments

Date Votes
  • cPanelLauren
    You might want to ensure that you didn't get affected by the Exim compromise prior to updating do the bare metal servers also run exim? Feel free to open a ticket using the link in my signature. Once open please reply with the Ticket ID here so that we can update this thread with the resolution once the ticket is resolved. Thanks!
    0
  • A Hartonian
    I did not get affected by the exim compromise. There was a conflict with a third-party WHM plugin for allowing WHMCS users to remotely unblock their IP address if they got blocked by CSF. It trolled me hard!
    0
  • Kati1509
    Hello, i have the same issue (csf is being restarted, try again in a moment: Resource temporarily unavailable at /usr/sbin/csf line 176) and i try this: # rm /var/lib/csf/csf.lock # csf -x # csf -e But this not work, what can i do?
    0
  • A Hartonian
    Hello, i have the same issue (csf is being restarted, try again in a moment: Resource temporarily unavailable at /usr/sbin/csf line 176) and i try this: # rm /var/lib/csf/csf.lock # csf -x # csf -e But this not work, what can i do?

    Have you recently installed any third-party plugin/addon on the server? in my case I had installed CSF Unblocker for WHMCS a poorly coded third-party plugin that made the CSF restart every 5 minutes continuously. If you haven't installed anything on the server, then save the hassle and uninstall the CSF and install it again. This is probably not the best way to overcome the issue you are facing. To uninstall use: cd /etc/csf sh uninstall.sh
    To install: cd /usr/src rm -fv csf.tgz wget https://download.configserver.com/csf.tgz tar -xzf csf.tgz cd csf sh install.sh
    Remember that your settings in Firewall Configuration will be lost. If you did any modifications you must do it again.
    0
  • cPanelLauren
    Hello, We'd really need more information to go off of, are you running WHMCS like the other poster here? Does the server have enough memory? You can check this by running something like free -m
    or for historical data sar -r
    0

Please sign in to leave a comment.

Didn't find what you were looking for?

New post