Hello,

Community support for Plesk, CPanel, WebMin and others with insight from two of the founders of Plesk. Ask for help here! No question is too simple or complicated. :-)
jeff54
Forum User
Forum User
Posts: 5
Joined: Sun Mar 03, 2013 2:44 pm
Location: Amersfoort, NL

Hello,

Unread post by jeff54 »

Hello,

I'm not so sure if this is the right place to be with my question, so please tell it to me if it is..

I'm getting the following in my logs but can't find out what it is. Does anyone on this forum knows what it is? The IP adres is one I know. It's an SMS-alert server that guards my server.

Kind regards

Roy

Code: Select all

[Sun Mar 03 19:26:11 2013] [warn] [client 80.69.67.10] mod_fcgid: stderr: PHP Notice: Unknown: 1. h->opened_path=[/var/www/vhosts/demo.net/httpdocs/index.php] h->filename=[/var/www/vhosts/demo.net/httpdocs/index.php] 
[Sun Mar 03 19:26:11 2013] [warn] [client 80.69.67.10] mod_fcgid: stderr: in Unknown on line 0 
[Sun Mar 03 19:26:11 2013] [warn] [client 80.69.67.10] mod_fcgid: stderr: PHP Notice: Unknown: apc_cache_find [590900] 
[Sun Mar 03 19:26:11 2013] [warn] [client 80.69.67.10] mod_fcgid: stderr: in Unknown on line 0 
[Sun Mar 03 19:26:11 2013] [warn] [client 80.69.67.10] mod_fcgid: stderr: PHP Notice: Unknown: 2. h->opened_path=[/var/www/vhosts/demo.net/httpdocs/index.php] h->filename=[/var/www/vhosts/demo.net/httpdocs/index.php] 
[Sun Mar 03 19:26:11 2013] [warn] [client 80.69.67.10] mod_fcgid: stderr: in Unknown on line 0 
[Sun Mar 03 19:26:11 2013] [warn] [client 80.69.67.10] mod_fcgid: stderr: PHP Notice: Unknown: apc_cache_make_file_entry: entry->data.file.filename is [/var/www/vhosts/demo.net/httpdocs/index.php] 
[Sun Mar 03 19:26:11 2013] [warn] [client 80.69.67.10] mod_fcgid: stderr: in Unknown on line 0 
[Sun Mar 03 19:26:11 2013] [warn] [client 80.69.67.10] mod_fcgid: stderr: PHP Notice: Unknown: Inserting [/var/www/vhosts/demo.net/httpdocs/index.php] 
[Sun Mar 03 19:26:11 2013] [warn] [client 80.69.67.10] mod_fcgid: stderr: in Unknown on line 0 
[Sun Mar 03 19:26:11 2013] [error] [client 80.69.67.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/httpd/modsecurity-crs/base_rules/modsecurity_crs_60_correlation.conf"] [line "37"] [id "981204"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 7, SQLi=, XSS=): Request Missing a User Agent Header"] [hostname "demo.net"] [uri "/index.php"] [unique_id "UTOVwn8AAAEAACUVH@4AAAAC"] 
User avatar
mikeshinn
Atomicorp Staff - Site Admin
Atomicorp Staff - Site Admin
Posts: 4149
Joined: Thu Feb 07, 2008 7:49 pm
Location: Chantilly, VA

Re: Hello,

Unread post by mikeshinn »

Sun Mar 03 19:26:11 2013] [warn] [client 80.69.67.10] mod_fcgid: stderr: PHP Notice: Unknown: 1. h->opened_path=[/var/www/vhosts/demo.net/httpdocs/index.php] h->filename=[/var/www/vhosts/demo.net/httpdocs/index.php]
[Sun Mar 03 19:26:11 2013] [warn] [client 80.69.67.10] mod_fcgid: stderr: in Unknown on line 0
[Sun Mar 03 19:26:11 2013] [warn] [client 80.69.67.10] mod_fcgid: stderr: PHP Notice: Unknown: apc_cache_find [590900]
[Sun Mar 03 19:26:11 2013] [warn] [client 80.69.67.10] mod_fcgid: stderr: in Unknown on line 0
[Sun Mar 03 19:26:11 2013] [warn] [client 80.69.67.10] mod_fcgid: stderr: PHP Notice: Unknown: 2. h->opened_path=[/var/www/vhosts/demo.net/httpdocs/index.php] h->filename=[/var/www/vhosts/demo.net/httpdocs/index.php]
[Sun Mar 03 19:26:11 2013] [warn] [client 80.69.67.10] mod_fcgid: stderr: in Unknown on line 0
[Sun Mar 03 19:26:11 2013] [warn] [client 80.69.67.10] mod_fcgid: stderr: PHP Notice: Unknown: apc_cache_make_file_entry: entry->data.file.filename is [/var/www/vhosts/demo.net/httpdocs/index.php]
[Sun Mar 03 19:26:11 2013] [warn] [client 80.69.67.10] mod_fcgid: stderr: in Unknown on line 0
[Sun Mar 03 19:26:11 2013] [warn] [client 80.69.67.10] mod_fcgid: stderr: PHP Notice: Unknown: Inserting [/var/www/vhosts/demo.net/httpdocs/index.php]
[Sun Mar 03 19:26:11 2013] [warn] [client 80.69.67.10] mod_fcgid: stderr: in Unknown on line 0
Those are APC errors, some software does not work with APC. Have you tried disabling APC to see if thats the cause?

Bad builds of APC can also cause this, as can modules that dont support APC. Does APC otherwise work with any other applications you are running under fastcgi?
[Sun Mar 03 19:26:11 2013] [error] [client 80.69.67.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/httpd/modsecurity-crs/base_rules/modsecurity_crs_60_correlation.conf"] [line "37"] [id "981204"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 7, SQLi=, XSS=): Request Missing a User Agent Header"] [hostname "demo.net"] [uri "/index.php"] [unique_id "UTOVwn8AAAEAACUVH@4AAAAC"]
Those are someones modsecurity rules, and that one is apparently triggering because the request is not being sent with a User Agent header.
jeff54
Forum User
Forum User
Posts: 5
Joined: Sun Mar 03, 2013 2:44 pm
Location: Amersfoort, NL

Re: Hello,

Unread post by jeff54 »

Thank you for your suggestion (analyse). I wil try it this week. I will let you know what happend!

Kind regards

Roy
jeff54
Forum User
Forum User
Posts: 5
Joined: Sun Mar 03, 2013 2:44 pm
Location: Amersfoort, NL

Re: Hello,

Unread post by jeff54 »

APC appeared to be conflicting with suexec. So for the time being I have removed APC. No errors are appearing right now.

Thank you very much for your help.

Kind regards

Roy
Post Reply