suphp deleted

uadm

• September 30, 2015 03:44

Not sure if this is cloud linux issue or not, but the fact is that our system is cloud linux. The problem: /opt/suphp/sbin/suphp is deleted. We reinstalled it from /home/cpeasyapache/src/suphp-0 however are a few weeks it's gone again. We can't find what is causing the file to be deleted. Anyone else seen this?

• 

  Jcats

  • September 30, 2015 15:43

  How did you become aware of the issue? Are you able to see when the problem started, it will most likely show in Apache error log
  # grep suphp /usr/local/apache/logs/error_log
  I would try and find when the problem started to see if you can link it to maybe an issue with cPanel update for example, you can see if it occurs around the time the cron runs.

  0
• 

  uadm

  • September 30, 2015 19:48

  We get aware of the issue when the sites start to return internal server error. There's no consistancy in the error start. Once it startd at 23:15, once it started at 09:44. We checked the crons on the server. Nothing there to even come close to /opt

  0
• 

  cPanelMichael

  • October 05, 2015 14:56

  Hello :) Is the file regenerated if you rebuild Apache/PHP via EasyApache? Thank you.

  0
• 

  uadm

  • October 05, 2015 14:58

  basically, yes. However we didn't run the entire easyapache process but only make install in /home/cpeasyapache/src/suphp-0 which by it self generated the file.

  0
• 

  cPanelMichael

  • October 07, 2015 16:54

  I'm not aware of any processes that would remove the /opt/suphp/sbin/suphp file from a system. The following tutorial may help you track down what's removing the file:

  0
• 

  dario2

  • November 25, 2015 12:17

  Did you ever find out what caused suphp to be deleted? I've just had that happen to me. Your solution with the quick make install was genious, thanks! That's the first time it's ever happened on one of my servers. It's also my first CentOS 7 server with Cpanel, just sayin'... Does the Linux audit system track file deletions? It seems to only track reads, writes, appends and executions, not file removal though... Thanks!

  0
• 

  cPanelMichael

  • December 10, 2015 17:45

  You could audit the directory itself as suggested on this URL: Re: Who is deleting the file Thank you.

  0

Please sign in to leave a comment.