Constant "altered rpms" - check_cpanel_rpms --fix doesn't fix

gorlov

• November 12, 2013 04:57

On one server I constantly keep getting the "Altered RPMs found", and when I run the command: /usr/local/cpanel/scripts/check_cpanel_rpms --fix it goes though, and seems to fix it - but if I run it again a few seconds later, the issue is still the same! I run it.... [root@sec4] ~ >> /usr/local/cpanel/scripts/check_cpanel_rpms --fix [20131112.101204] [20131112.101204] Problems were detected with cPanel-provided files which are RPM controlled. [20131112.101204] If you did not make these changes intentionally, you can correct them by running: [20131112.101204] [20131112.101204] > /usr/local/cpanel/scripts/check_cpanel_rpms --fix [20131112.101204] [20131112.101204] The following files were found to be altered from their original RPM: [20131112.101204] MySQL51-test,5.1.70,1.cp1136 [20131112.101204] [20131112.101204] Removing 1 broken rpms: MySQL51-test [20131112.101207] Downloading [20131112.101207] Hooks system enabled [20131112.101207] Checking for and running RPM::Versions 'pre' hooks for any RPMs about to be installed [20131112.101207] All required 'pre' hooks have been run [20131112.101207] No RPMS need to be uninstalled [20131112.101207] Installing new rpms: MySQL51-test-5.1.70-1.cp1136.x86_64.rpm [20131112.101207] Preparing packages for installation... [20131112.101208] MySQL51-test-5.1.70-1.cp1136 [20131112.101221] Prelinking shared libraries and binaries: /usr/sbin/prelink -av -mR [20131112.101225] Checking for and running RPM::Versions 'post' hooks for any RPMs just installed [20131112.101225] All required 'post' hooks have been run
The a few seconds later, i run it again... [root@sec4] ~ >> /usr/local/cpanel/scripts/check_cpanel_rpms --fix [20131112.101332] [20131112.101332] Problems were detected with cPanel-provided files which are RPM controlled. [20131112.101332] If you did not make these changes intentionally, you can correct them by running: [20131112.101332] [20131112.101332] > /usr/local/cpanel/scripts/check_cpanel_rpms --fix [20131112.101332] [20131112.101332] The following files were found to be altered from their original RPM: [20131112.101332] MySQL51-test,5.1.70,1.cp1136 [20131112.101332] [20131112.101332] Removing 1 broken rpms: MySQL51-test [20131112.101334] Downloading [20131112.101335] Hooks system enabled [20131112.101335] Checking for and running RPM::Versions 'pre' hooks for any RPMs about to be installed [20131112.101335] All required 'pre' hooks have been run [20131112.101335] No RPMS need to be uninstalled [20131112.101335] Installing new rpms: MySQL51-test-5.1.70-1.cp1136.x86_64.rpm [20131112.101335] Preparing packages for installation... [20131112.101335] MySQL51-test-5.1.70-1.cp1136 [20131112.101347] Prelinking shared libraries and binaries: /usr/sbin/prelink -av -mR [20131112.101348] Checking for and running RPM::Versions 'post' hooks for any RPMs just installed [20131112.101348] All required 'post' hooks have been run
And again... [root@sec4] ~ >> /usr/local/cpanel/scripts/check_cpanel_rpms --fix [20131112.103544] [20131112.103544] Problems were detected with cPanel-provided files which are RPM controlled. [20131112.103544] If you did not make these changes intentionally, you can correct them by running: [20131112.103544] [20131112.103544] > /usr/local/cpanel/scripts/check_cpanel_rpms --fix [20131112.103544] [20131112.103544] The following files were found to be altered from their original RPM: [20131112.103544] MySQL51-test,5.1.70,1.cp1136 [20131112.103544] [20131112.103544] Removing 1 broken rpms: MySQL51-test [20131112.103547] Downloading [20131112.103547] Hooks system enabled [20131112.103547] Checking for and running RPM::Versions 'pre' hooks for any RPMs about to be installed [20131112.103547] All required 'pre' hooks have been run [20131112.103547] No RPMS need to be uninstalled [20131112.103547] Installing new rpms: MySQL51-test-5.1.70-1.cp1136.x86_64.rpm [20131112.103547] Preparing packages for installation... [20131112.103548] MySQL51-test-5.1.70-1.cp1136 [20131112.103557] Prelinking shared libraries and binaries: /usr/sbin/prelink -av -mR [20131112.103557] Checking for and running RPM::Versions 'post' hooks for any RPMs just installed [20131112.103557] All required 'post' hooks have been run
After every time, I keep getting the email message that rpms has been altered. Why is this? How can the just downloaded rpm be altered the same second it's downloaded? It happens that the message stops coming, but then after a few days, it's back again. It's always the mysql rpms having the issue. Not always just one, sometimes 2 or 3 different rpms.

• 

  cPanelMichael

  • November 15, 2013 13:32

  Hello :) Do you have any third-party applications that could be altering the RPMs after installation (e.g. pre/post hooks)? If not, feel free to open a support ticket so we can take a closer look: Submit A Ticket You can post the ticket number here so we can update this thread with the outcome. Thank you.

  0

Please sign in to leave a comment.