Atomicorp

Posted: **Sun Mar 03, 2013 2:51 pm**

Hello,

I'm not so sure if this is the right place to be with my question, so please tell it to me if it is..

I'm getting the following in my logs but can't find out what it is. Does anyone on this forum knows what it is? The IP adres is one I know. It's an SMS-alert server that guards my server.

Kind regards

Roy

Code: Select all

[Sun Mar 03 19:26:11 2013] [warn] [client 80.69.67.10] mod_fcgid: stderr: PHP Notice: Unknown: 1. h->opened_path=[/var/www/vhosts/demo.net/httpdocs/index.php] h->filename=[/var/www/vhosts/demo.net/httpdocs/index.php] 
[Sun Mar 03 19:26:11 2013] [warn] [client 80.69.67.10] mod_fcgid: stderr: in Unknown on line 0 
[Sun Mar 03 19:26:11 2013] [warn] [client 80.69.67.10] mod_fcgid: stderr: PHP Notice: Unknown: apc_cache_find [590900] 
[Sun Mar 03 19:26:11 2013] [warn] [client 80.69.67.10] mod_fcgid: stderr: in Unknown on line 0 
[Sun Mar 03 19:26:11 2013] [warn] [client 80.69.67.10] mod_fcgid: stderr: PHP Notice: Unknown: 2. h->opened_path=[/var/www/vhosts/demo.net/httpdocs/index.php] h->filename=[/var/www/vhosts/demo.net/httpdocs/index.php] 
[Sun Mar 03 19:26:11 2013] [warn] [client 80.69.67.10] mod_fcgid: stderr: in Unknown on line 0 
[Sun Mar 03 19:26:11 2013] [warn] [client 80.69.67.10] mod_fcgid: stderr: PHP Notice: Unknown: apc_cache_make_file_entry: entry->data.file.filename is [/var/www/vhosts/demo.net/httpdocs/index.php] 
[Sun Mar 03 19:26:11 2013] [warn] [client 80.69.67.10] mod_fcgid: stderr: in Unknown on line 0 
[Sun Mar 03 19:26:11 2013] [warn] [client 80.69.67.10] mod_fcgid: stderr: PHP Notice: Unknown: Inserting [/var/www/vhosts/demo.net/httpdocs/index.php] 
[Sun Mar 03 19:26:11 2013] [warn] [client 80.69.67.10] mod_fcgid: stderr: in Unknown on line 0 
[Sun Mar 03 19:26:11 2013] [error] [client 80.69.67.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/httpd/modsecurity-crs/base_rules/modsecurity_crs_60_correlation.conf"] [line "37"] [id "981204"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 7, SQLi=, XSS=): Request Missing a User Agent Header"] [hostname "demo.net"] [uri "/index.php"] [unique_id "UTOVwn8AAAEAACUVH@4AAAAC"]

Posted: **Sun Mar 03, 2013 6:01 pm**

Sun Mar 03 19:26:11 2013] [warn] [client 80.69.67.10] mod_fcgid: stderr: PHP Notice: Unknown: 1. h->opened_path=[/var/www/vhosts/demo.net/httpdocs/index.php] h->filename=[/var/www/vhosts/demo.net/httpdocs/index.php]
[Sun Mar 03 19:26:11 2013] [warn] [client 80.69.67.10] mod_fcgid: stderr: in Unknown on line 0
[Sun Mar 03 19:26:11 2013] [warn] [client 80.69.67.10] mod_fcgid: stderr: PHP Notice: Unknown: apc_cache_find [590900]
[Sun Mar 03 19:26:11 2013] [warn] [client 80.69.67.10] mod_fcgid: stderr: in Unknown on line 0
[Sun Mar 03 19:26:11 2013] [warn] [client 80.69.67.10] mod_fcgid: stderr: PHP Notice: Unknown: 2. h->opened_path=[/var/www/vhosts/demo.net/httpdocs/index.php] h->filename=[/var/www/vhosts/demo.net/httpdocs/index.php]
[Sun Mar 03 19:26:11 2013] [warn] [client 80.69.67.10] mod_fcgid: stderr: in Unknown on line 0
[Sun Mar 03 19:26:11 2013] [warn] [client 80.69.67.10] mod_fcgid: stderr: PHP Notice: Unknown: apc_cache_make_file_entry: entry->data.file.filename is [/var/www/vhosts/demo.net/httpdocs/index.php]
[Sun Mar 03 19:26:11 2013] [warn] [client 80.69.67.10] mod_fcgid: stderr: in Unknown on line 0
[Sun Mar 03 19:26:11 2013] [warn] [client 80.69.67.10] mod_fcgid: stderr: PHP Notice: Unknown: Inserting [/var/www/vhosts/demo.net/httpdocs/index.php]
[Sun Mar 03 19:26:11 2013] [warn] [client 80.69.67.10] mod_fcgid: stderr: in Unknown on line 0

Those are APC errors, some software does not work with APC. Have you tried disabling APC to see if thats the cause?

Bad builds of APC can also cause this, as can modules that dont support APC. Does APC otherwise work with any other applications you are running under fastcgi?

[Sun Mar 03 19:26:11 2013] [error] [client 80.69.67.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/httpd/modsecurity-crs/base_rules/modsecurity_crs_60_correlation.conf"] [line "37"] [id "981204"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 7, SQLi=, XSS=): Request Missing a User Agent Header"] [hostname "demo.net"] [uri "/index.php"] [unique_id "UTOVwn8AAAEAACUVH@4AAAAC"]

Those are someones modsecurity rules, and that one is apparently triggering because the request is not being sent with a User Agent header.

Posted: **Mon Mar 04, 2013 10:55 am**

Thank you for your suggestion (analyse). I wil try it this week. I will let you know what happend!

Kind regards

Roy

Posted: **Wed Mar 06, 2013 8:39 am**

APC appeared to be conflicting with suexec. So for the time being I have removed APC. No errors are appearing right now.

Thank you very much for your help.

Kind regards

Roy

Atomicorp

Hello,

Hello,

Re: Hello,

Re: Hello,

Re: Hello,