mod_security logs HUGE and Failed to access DBM file entries

jeffschips

• January 05, 2022 20:25

Hello. I hope everyone is safe and healthy and taking care of themselves and their loved ones. In my /var/log/apache/error_log file as of today the beginning entry is May 18, 2021. When I search for information about trimming this file (if it's okay to do so) I see reports that there should be a Mod_Security Logs
I am seeing lots of errors as follows: [Wed Sep 29 23:00:08.203229 2021] [:error] [pid 13071] [client xx.1xx.xxx.xx:38626] [client xx.xxx.xxx.xx] ModSecurity: collections_remove_stale: Failed to access DBM file 1 [Wed Sep 29 23:00:08.290565 2021] [:error] [pid 11899] [client xx.1xx.xxx.xx:38636] [client xx.xxx.xxxxx] ModSecurity: collection_store: Failed to access DBM file
Thanks in advance. Stay safe please.

• 

  quietFinn

  • January 06, 2022 13:19

  Look in WHM -> Service Configuration -> cPanel Log Rotation Configuration Is error_log in rotation?

  0
• 

  jeffschips

  • January 06, 2022 15:59

  Rotation shows 300mb and supposed to archive but I can't find any files in the reported archive directory. Current error_log shows: 13981215 Jan 6 11:43 error_log I wish linux would make it easy to read what 13981215 is? Bytes? Megabytes? How to read and convert? Thank you.

  0
• 

  jeffschips

  • January 06, 2022 16:02

  SOLVED: ls -l --block-size=M error_log or 14mb. Way below 300mb threshold

  0
• 

  quietFinn

  • January 06, 2022 16:06

  I don't know what you mean by " Current error_log shows ", you can see the size (in root SSH) like this: ls -lah /usr/local/apache/logs/error_log
  Edit: seems you found a solution before I finished posting... Edit2: 13981215 is bytes, option "-h" in ls command means "human-readable"

  0
• 

  jeffschips

  • January 06, 2022 16:10

  It shows size as: 13981215 Jan 6 11:43 error_log My issue was the file was large and possibly not rotating out. However, once I could interpret what 13981215 means when running ls -la error_log (using ls -l --block-size=M error_log and now also lah) I saw that it wasn't large at all in terms of rotating out. So solved. Oh, and the error message "Failed to access DBM file" once examining the logs, seems to be related to non-authorized users trying to access the system, and failing.

  0
• 

  cPanelAnthony

  • January 06, 2022 22:39

  Thank you for posting your solution!

  0

Please sign in to leave a comment.