P0f fails every few days on DNSONLY server

jimhermann

• November 05, 2024 06:36
• Edited

Folks, I run four DNSONLY CPanel servers. Every few days, three servers P0f fails and must be restarted.

Service Check Raw Output (XID txfbnu) The “p0f” service is down. The subprocess “/usr/local/cpanel/scripts/restartsrv_p0f” reported error number 255 when it ended. Startup Log Nov 01 03:59:28 ns1.uuserver.net p0f[1751915]: [+] Listening on API socket '/var/cpanel/userhomes/cpanelconnecttrack/p0f.socket' (max 20 clients). Nov 01 03:59:28 ns1.uuserver.net p0f[1751915]: [+] Privileges dropped: uid 988, gid 985, root '/var/cpanel/userhomes/cpanelconnecttrack'. Nov 01 03:59:28 ns1.uuserver.net p0f[1751915]: [+] Daemon process created, PID 1751916 (stderr kept as-is). Nov 01 03:59:28 ns1.uuserver.net p0f[1751915]: Good luck, you're on your own now! Nov 01 03:59:28 ns1.uuserver.net systemd[1]: Started p0f passive fingerprinter. Nov 05 03:50:16 ns1.uuserver.net systemd[1]: Stopping p0f passive fingerprinter... Nov 05 03:50:16 ns1.uuserver.net p0f[1751916]: [!] WARNING: User-initiated shutdown. Nov 05 03:50:16 ns1.uuserver.net systemd[1]: p0f.service: Deactivated successfully. Nov 05 03:50:16 ns1.uuserver.net systemd[1]: Stopped p0f passive fingerprinter. Nov 05 03:50:16 ns1.uuserver.net systemd[1]: p0f.service: Consumed 11min 31.791s CPU time.

All four servers use AlmaLinux 9.4 What do I need to do? Jim

• 

  cPRex Jurassic Moderator

  • November 05, 2024 14:45

  Hey there!  Many people aren't sure what this tool does, so I'm including a brief description below:

  "The Passive OS Fingerprinting daemon reports the visitor's operating system and other information for email notifications. This information helps you quickly identify visitors that trigger events that cause alerts."

  Personally, I don't see a need for this tool, especially on a DNSOnly machine, but it would be a good idea to check the traffic/logs on the system to ensure you aren't getting malicious traffic that is causing this service to fail.

  If you decide to disable this tool, you can do that through WHM >> Service Manager.

  0

Please sign in to leave a comment.