Page 1 of 1
Error: /proc must be mounted
Posted: Wed Mar 25, 2015 12:20 pm
by kontiki
Hi,
Just noticed the ASL log is full of:
Error: /proc must be mounted
And some:
/var/asl/lib/firewall/tcp_ecn: line 11: /proc/sys/net/ipv4/tcp_ecn: Permission denied
Any idea why would this be happening?
Many thanks,
Francois
Re: Error: /proc must be mounted
Posted: Thu Mar 26, 2015 7:32 am
by scott
Sure, starting with the basics is /proc mounted?
Follow up question, Is this a namespace/or container type virtual machine?
Re: Error: /proc must be mounted
Posted: Thu Mar 26, 2015 8:01 am
by kontiki
Hi,
It's an OpenVZ VPS.
/proc is mounted.
Sure enough, the logs do not show any "Error: /proc must be mounted" past the last apache graceful restart shown, tonight. I gather this restart was initiated by ASL?
The problem lasted between 2 graceful restart, from the 25 to the 26, and has now ceased.
The container was not restarted, and no manual configuration was done.
Thanks for your help.
Re: Error: /proc must be mounted
Posted: Tue Mar 31, 2015 8:06 am
by faris
Code: Select all
/var/asl/lib/firewall/tcp_ecn: line 11: /proc/sys/net/ipv4/tcp_ecn: Permission denied
This is normal in a VZ Container. There are other common firewall-related things you'll see as well, depending on which options you select in the ASL Firewall configuration.
There's nothing to worry about as such - the ASL firewall is trying to do something that VZ does not permit/support, which generates this error.
The /proc thing will almost certainly also be a VZ thing. Where are you seeing these/which logs exactly?
Re: Error: /proc must be mounted
Posted: Tue Mar 31, 2015 9:24 am
by kontiki
Thanks for your reply.
Here is the full ASL notification, containing the pertaining log:
Code: Select all
OSSEC HIDS Notification.
2015 Mar 25 16:03:13
Received From: server->/var/log/tortixd/asl_error_log
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):
Error: /proc must be mounted
--END OF NOTIFICATION
The fact that that log message stopped for good after an Apache restart, also shown in the same log, is probably more than a coincidence, though I cannot explain why.
Anyways, thanks for your help.