Skip to main content

After EasyApache rebuild Apache dies twice a day

nabuhonodozor
Dear cPanel Gurus, I am using cPanel since many years. Its working flawlessly. Till last 2-3 weeks. I coulnd update Apache through easyApache script because od openssl missing libs (? - 64Bit on 32bit Host). I was required to run some command through terminal/ssh. All worked ok and Ive finally recompiled apache (need to build mysqli module). After that apache crash almost precisely twice a day at 13:10 and 13:20 PM I was trying to find something in logs but I didnt. In chkservd.log I found:
[2014-12-14 13:21:48 +0100] Service check ....[socket connect:-][socket failure threshold:4/3][fail count:2]Restarting httpd.... [notify:failed (load:0.42 0.36 0.29) (memory: used=1867,available=36028797018962100,installed=36028797018963968)]]...
Also I am getting e-mails from cPanel monitor services:
Service: httpd Notification Type: failed Notification: httpd failed @ Sun Dec 14 13:16:47 2014. A restart was attempted automagically. Service Check Method: [socket connect] Reason: Unable to connect to port 80 on 127.0.0.1: Connection refused: Died Number of Restart Attempts: 1 Startup Log: Failed to fetch startup_log for "httpd" because of an error: Log Messages: [Sun Dec 14 13:04:45 2014] [error] [client 66.249.67.103] File does not exist: /usr/local/apache/htdocs/robots.txt [Sun Dec 14 12:59:29 2014] [error] [client 83.28.239.182] ModSecurity: Rule b5ed550 [id "390149">[file "/usr/local/apache/conf/modsec/50_asl_rootkits.conf">[line "113"> - Execution error - PCRE limits exceeded (-8): (null). [hostname "mydomain1.pl"> [uri "/index.php/some-page.html"> [unique_id "VI17oLIgXckAAGiqFPcAAAAU"> [Sun Dec 14 12:53:28 2014] [error] [client 66.249.67.97] ModSecurity: Rule b5ed550 [id "390149">[file "/usr/local/apache/conf/modsec/50_asl_rootkits.conf">[line "113"> - Execution error - PCRE limits exceeded (-8): (null). [hostname "mydomain2.com"> [uri "/index.php"> [unique_id "VI16OLIgXckAAGBqU0QAAAAI"> [Sun Dec 14 12:46:33 2014] [error] [client 94.254.209.175] ModSecurity: Rule b5ed550 [id "390149">[file "/usr/local/apache/conf/modsec/50_asl_rootkits.conf">[line "113"> - Execution error - PCRE limits exceeded (-8): (null). [hostname "mydomian1.pl"> [uri "/index.php/catalog/product/gallery/image/333/id/222/"> [unique_id "VI14mbIgXckAAFxtOy4AAAAD"> [Sun Dec 14 12:46:26 2014] [error] [client 94.254.209.175] ModSecurity: Rule b5ed550 [id "390149">[file "/usr/local/apache/conf/modsec/50_asl_rootkits.conf">[line "113"> - Execution error - PCRE limits exceeded (-8): (null). [hostname "mydomian1.pl"> [uri "/index.php/catalog/product/gallery/image/333/id/222/"> [unique_id "VI14kbIgXckAAGIfbXgAAAAK"> [Sun Dec 14 12:46:11 2014] [error] [client 94.254.209.175] ModSecurity: Rule b5ed550 [id "390149">[file "/usr/local/apache/conf/modsec/50_asl_rootkits.conf">[line "113"> - Execution error - PCRE limits exceeded (-8): (null). [hostname "mydomian1.pl"> [uri "/index.php/catalog/product/gallery/image/444/id/333/"> [unique_id "VI14g7IgXckAAFY3TmYAAAAE"> [Sun Dec 14 12:44:44 2014] [error] [client 216.20.131.111] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?:mo(?:rfeus ****************ing scanner|siac 1)|internet(?:-exprorer| ninja)|s\\\\.t\\\\.a\\\\.l\\\\.k\\\\.e\\\\.r\\\\.|kenjin spider|neuralbot/)" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/conf/modsec/20_asl_useragents.conf"> [line "199"> [id "330082"> [rev "2"> [msg "Atomicorp.com UNSUPPORTED DELAYED Rules: Exploit User Agent"> [severity "CRITICAL"> [hostname "178.32.93.202"> [uri "/user/soapCaller.bs"> [unique_id "VI14LLIgXckAAFxtOxAAAAAD"> Memory Information: Used: 1948MB Available: 36028797018962020MB Installed: 36028797018963968MB Load Information: 0.14 0.21 0.24 Uptime: 106 days, 6 hours, 49 seconds IOStat Information: avg-cpu: %user %nice %system %iowait %steal %idle 1.52 0.13 0.30 31.26 0.01 66.79 Device: tps Blk_read/s Blk_wrtn/s Blk_read Blk_wrtn ChkServd Version: 15.6
If I leave it it restarts after about 5 min. I can also force it to restart though login into WHM admin and klick restart https service. I have VPS with centOs 5. Its openVZ container. 4GB Ram Worked flawlessly for about 3 years. Issues started after forcefully rebuild easyapache. Please help. Kind regards,

Comments

3 comments

Date Votes
  • cPanelPeter cPanel Staff
    Hello, Please open a support ticket using the link in my signature. We would be glad to look at that for you.
    0
  • nabuhonodozor
    Dear cPanelPeter - thank You. Ive just submitted a ticket.
    0
  • cPanelMichael
    ]Dear cPanelPeter - thank You. Ive just submitted a ticket.

    Could you let us know the ticket number so we can update this thread with the outcome? Thank you.
    0

Please sign in to leave a comment.

Didn't find what you were looking for?

New post