Litespeed Crashing maybe due to cPGuard rules update?: Page 2 - Enhance Control Panel

Litespeed Crashing maybe due to cPGuard rules update?

opsshield

MediaServe Ok noted....just to make this clear the update in cPGuard is not to fix the Seg fault ( of course it is out of our hands ) but to reduce the number of restarts. Feel free to contact us if there is anything that we can fix.

MarkD

MediaServe Well, it's been nearly 24 hours now since we switched back to 6.0 and we have not had a single crash today.

I think I will leave it on the current version until Monday and then take a judement call on what to do next.

MediaServe

MarkD I'm still on 6.2 build 6 and after restarting cPGuard with 5.01 I've seen no autorestarts at all! So it must have been the mod_security config itself causing the problem and was adjusted. @opsshield do you have details of the delta of the changes so I can make sure whatever it was is avoided?

opsshield

MediaServe We used to send hourly WAF health check requests and force a web server restart if it is not blocking the test attack. Since that approach is not good in Enhance ( causes false alarms intermittently ) we have turned it off for Enhance systems. So that will stop intermittent web server restart due to hourly WAF health checks.

SharedGrid

We have experience the crashing today for the first time, for a period of 2 hours where Litespeed was constantly restarting and suddenly ran as normal again. It has been 2 hours since the last Litespeed restart.

Same log file entries seen (signal=11) and syslog showing segfaults. There was nothing in logs for 40 minutes prior to the first crash.

I seem to have gotten 2 core files out of it though, so I'm currently trying to submit a ticket to Litespeed support but it seems to be taking foooorrrreever to actually submit.

We're running Litespeed 6.2 build 6 and cPGuard 5.01.

Nick

Have one server with 6.2 that has crashed twice. First on Sunday and the second time was today.

twest

Nick do you have cpguard on it?

Nick

Yes I do, but I’m considering turning it off now to see if that helps.

SharedGrid

Litespeed advised to upgrade to build 7 and see if it fixes the issue. I wonder if every time it's reported, they will just increase the build number.

Nick

Just updated from 6.2 build 0 to 6.2 build 7. No issues so far.

Adam

@opsshield I've seen a lot of errors in various customer logs loading rules from this URL:

https://rules.malware.expert/download.php?rules=generic&extra=cpgrbl,cpgrecaptcha,webshell,scanner

I don't know if it's related.

opsshield

Adam Is it Litespeed or Nginx? We are facing another set of issues with Nginx where a latest update broke SecRemoteRules...Again another issue with Web Server or OS package update.

opsshield

We pushed some more updates to avoid such errors in web server due to such cases. We will continue our investigation to improve the remote rule loading in the future.

mike

@Adam not enhance only plesk also 🙂 seems to be fixed.

opsshield

Yes, we have identified a better way to handle such cases and to avoid causing errors in secremoterules though we have limited options to do it. But we hope that the new changes will help to stop such unexpected conditions while loading secremoterules on web servers. All platforms were affected because it's not control panel specific but web server specific.

mike

opsshield rebuilding webservers config removed the error

SharedGrid

Somehow I missed the release but also haven't seen anyone else mention it either. Litespeed 6.2.1 was released, one of the bug fixes was "Address a crash related to SecRemoteRules handling.".

Andreas

I missed this post too. I have been having issues like this, but I am running apache and running cPGuard as well
I have had to restart apache docker a few times these last few weeks.

« Previous Page Next Page »