Error: /proc must be mounted

[kontiki]

Hi,

Just noticed the ASL log is full of:

Error: /proc must be mounted

And some:

/var/asl/lib/firewall/tcp_ecn: line 11: /proc/sys/net/ipv4/tcp_ecn: Permission denied

Any idea why would this be happening?

Many thanks,

Francois

[scott]

Sure, starting with the basics is /proc mounted?

Follow up question, Is this a namespace/or container type virtual machine?

[kontiki]

Hi,

It's an OpenVZ VPS.

/proc is mounted.

Sure enough, the logs do not show any "Error: /proc must be mounted" past the last apache graceful restart shown, tonight. I gather this restart was initiated by ASL?

The problem lasted between 2 graceful restart, from the 25 to the 26, and has now ceased.

The container was not restarted, and no manual configuration was done.

Thanks for your help.

[faris]

Code: Select all

/var/asl/lib/firewall/tcp_ecn: line 11: /proc/sys/net/ipv4/tcp_ecn: Permission denied

This is normal in a VZ Container. There are other common firewall-related things you'll see as well, depending on which options you select in the ASL Firewall configuration.

There's nothing to worry about as such - the ASL firewall is trying to do something that VZ does not permit/support, which generates this error.

The /proc thing will almost certainly also be a VZ thing. Where are you seeing these/which logs exactly?

[kontiki]

Thanks for your reply.

Here is the full ASL notification, containing the pertaining log:

Code: Select all

OSSEC HIDS Notification.
2015 Mar 25 16:03:13

Received From: server->/var/log/tortixd/asl_error_log
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Error: /proc must be mounted

 --END OF NOTIFICATION

The fact that that log message stopped for good after an Apache restart, also shown in the same log, is probably more than a coincidence, though I cannot explain why.

Anyways, thanks for your help.