Output filter: Failed to read bucket (rc 70007)

Customer support forums for the modsecurity rules feed. There is no such thing as a bad question here as long as it pertains to using the real time modsecurity rules feed. Newbies feel free to get help getting started or asking questions that may be obvious.
Sergio
Forum User
Forum User
Posts: 99
Joined: Sat Jan 17, 2009 2:19 pm

Output filter: Failed to read bucket (rc 70007)

Unread post by Sergio »

I am seeing in my logs the following errors triggered by modsec "Output filter: Failed to read bucket (rc 70007): The timeout specified has expired", what is this?

As far as I have know, my customer reported this after he finished using his mail list, the email were delivered but he received a 406 error page.

Regards,
Sergio.
scott
Atomicorp Staff - Site Admin
Atomicorp Staff - Site Admin
Posts: 8355
Joined: Wed Dec 31, 1969 8:00 pm
Location: earth
Contact:

Re: Output filter: Failed to read bucket (rc 70007)

Unread post by scott »

Sounds like a library problem to me. Id bounce this off of the cpanel folks.
mrsant
Forum User
Forum User
Posts: 17
Joined: Thu Jun 21, 2012 5:07 am
Location: UK

Re: Output filter: Failed to read bucket (rc 70007)

Unread post by mrsant »

I can guess what cPanel are going to say. Sorry to resurrect this thread, but I'm seeing this as well

--0afe783d-H--
Message: Output filter: Failed to read bucket (rc 70007): The timeout specified has expired
Stopwatch: 1404665969547273 393116380 (- - -)
Stopwatch2: 1404665969547273 393116380; combined=13012, p1=33, p2=12917, p3=27, p4=0, p5=34, sr=0, sw=1, l=0, gc=0
Producer: ModSecurity for Apache/2.7.5 (http://www.modsecurity.org/).
Server: Apache
Engine-Mode: "ENABLED"

Before i go chasing cpanel or spiderlabs, can Atomic Corp at least confirm that this message is generated, initially, from Modsec or Apache? Every mention I see of "Failed to read bucket" appears to be modsec related. Thanks.
User avatar
mikeshinn
Atomicorp Staff - Site Admin
Atomicorp Staff - Site Admin
Posts: 4149
Joined: Thu Feb 07, 2008 7:49 pm
Location: Chantilly, VA

Re: Output filter: Failed to read bucket (rc 70007)

Unread post by mikeshinn »

First thing you need to do is upgrade modsecurity, you're using a really old version with many known bugs and vulnerabilities. You want to be using at least 2.7.7.
mrsant
Forum User
Forum User
Posts: 17
Joined: Thu Jun 21, 2012 5:07 am
Location: UK

Re: Output filter: Failed to read bucket (rc 70007)

Unread post by mrsant »

First thing you need to do
:twisted:

LOL, we would if cPanel hadn't enforced ModSec 2.8...

I found the problem... a customer was uploading images that were 9999 pixels tall into wordpress - the ensuing memory usage by GD trying to resize them was causing PHP to hit the max, (and or the execution time limit) - and I guess this caused the apache response to fail, which modsec's output filter to grumble.
User avatar
mikeshinn
Atomicorp Staff - Site Admin
Atomicorp Staff - Site Admin
Posts: 4149
Joined: Thu Feb 07, 2008 7:49 pm
Location: Chantilly, VA

Re: Output filter: Failed to read bucket (rc 70007)

Unread post by mikeshinn »

Just install aum, that will ensure you're modsecurity is both automatically updated to both a bugfree version of modsecurity, and the most up to date version for the rules you are using. cpanel doesnt do that.

https://www.atomicorp.com/wiki/index.php/Aum
kaleem
New Forum User
New Forum User
Posts: 1
Joined: Thu Oct 16, 2014 2:13 am
Location: fsd

Re: Output filter: Failed to read bucket (rc 70007)

Unread post by kaleem »

I found the problem... a customer was uploading images that were 9999 pixels tall into wordpress - the ensuing memory usage by GD trying to resize them was causing PHP to hit the max, (and or the execution time limit) - and I guess this caused the apache response to fail, which modsec's output filter to grumble.





_____________
http://www.vceexam.com/extension/vce-exam-suite.html
Post Reply