i need information about this option 'Check /etc/cron.daily/logrotate for /tmp noexec workaround', there are in the server check, of the csf test, someone can explain to me about this function? should do it?
the actually state is 'warning'.
I recently purchased a new dedicated server, since I have had this server (8 days) I have being receiving the following email:
Quote:
/etc/cron.daily/logrotate:
error: error accessing /var/log/httpd: No such file or directory
error: httpd:1 glob failed for /var/log/httpd/*log
A couple weeks ago, I encountered a big server crash on my VPS that caused me a lot of downtime. I'm currently trying to figure out a solution to keep a current "clone" of all of my server accounts on a second server. That way, if I ever encounter another crash, I'll be able to simply change DNS information to have all accounts "live" using the backup server.
I appreciate any input, advice, suggestions, criticism, etc. Here's what I have in mind...
1. I currently have all of my websites hosted on Server #1. (We'll call it that for the sake of avoiding confusion.)
2. I have an automatic nightly backup setup via cPanel / WHM that backs up all accounts from Server #1 to Server #2 via FTP. (Server #2 is in a totally different data center, with a different provider.)
3. The nightly backup packages all of the accounts as "cPanel Full Backups." So, they're compressed, and as such, they don't work as "live, functioning websites" on Server #2.
The only way to make them "live and functional" on Server #2 would be to use cPanel to "restore" the backups.
4. So, what I'd like to do is setup a CRON job that would automatically "Restore" the backups each morning on Server #2. That way, Server #2 would always have a functional version of all my accounts, that is less than a day old. Then, if Server #1 ever crashed, I'd just have to change DNS information to point to Server #2, and all of the websites would be live again, without having to physically restore all of the backups using cPanel.
I don't know a ton about CRON. However, as I understand it, CRON couldn't actually make cPanel restore the backups. However, I'm assuming that when you use cPanel's "Restore" function, it just goes through a series of processes. So, it seems logical to me that, if you knew what those processes were, you could write a CRON job to automate the process every morning.
Did that make sense?
If so, is it possible?
Do you guys have any input, criticism, etc?
If it's doable, can you make any suggestions that would help me make this happen?
Finally, if you think you have the expertise to make this happen, I'd be interested in chatting with you via Private Message. I'd be willing to pay to have this done.(Note to Moderators: I'm not sure if my last comment is allowed or not ... if not, please feel free to remove it. I'm far more interested in the discussion of this process than trying to solicit help in making it happen.)
I encountered a big server crash on my VPS that caused me a lot of downtime. I'm currently trying to figure out a solution to keep a current "clone" of all of my server accounts on a second server. That way, if I ever encounter another crash, I'll be able to simply change DNS information to have all accounts "live" using the backup server.
I appreciate any input, advice, suggestions, criticism, etc. Here's what I have in mind...
1. I currently have all of my websites hosted on Server #1. (We'll call it that for the sake of avoiding confusion.)
2. I have an automatic nightly backup setup via cPanel / WHM that backs up all accounts from Server #1 to Server #2 via FTP. (Server #2 is in a totally different data center, with a different provider.)
3. The nightly backup packages all of the accounts as "cPanel Full Backups." So, they're compressed, and as such, they don't work as "live, functioning websites" on Server #2. The only way to make them "live and functional" on Server #2 would be to use cPanel to "restore" the backups.
4. So, what I'd like to do is setup a CRON job that would automatically "Restore" the backups each morning on Server #2. That way, Server #2 would always have a functional version of all my accounts, that is less than a day old. Then, if Server #1 ever crashed, I'd just have to change DNS information to point to Server #2, and all of the websites would be live again, without having to physically restore all of the backups using cPanel.
I don't know a ton about CRON. However, as I understand it, CRON couldn't actually make cPanel restore the backups. However, I'm assuming that when you use cPanel's "Restore" function, it just goes through a series of processes. So, it seems logical to me that, if you knew what those processes were, you could write a CRON job to automate the process every morning.
Did that make sense?
If so, is it possible?
Do you guys have any input, criticism, etc?
If it's doable, can you make any suggestions that would help me make this happen?
Finally, if you think you have the expertise to make this happen, I'd be interested in chatting with you via Private Message. I'd be willing to pay a reasonable sum for some help with this.
Is there any way to create a cron to backup mysql data daily ( or weekly )? I mean an "auto script" to run this command daily
mysqldump -u usernam -p password dataname > file.sql
I get these emails every day, sometimes less warnings, but today there are plenty again:
Subject: Cron <root@plesk01> /opt/psa/admin/bin/php -c '/opt/psa/admin/conf/php.ini' -dauto_prepend_file=sdk.php '/opt/psa/admin/plib/modules/servershield/scripts/aggregate-stats.php'
Code:
PHP Notice: Undefined property: stdClass::$response; File: /opt/psa/admin/plib/modules/servershield/scripts/aggregate-stats.php, Line: 21
PHP Notice: Trying to get property of non-object; File: /opt/psa/admin/plib/modules/servershield/scripts/aggregate-stats.php, Line: 21
[Code] .....
They started showing up when I upgraded to Plesk 12 and activated the server shield extension. The server is an Ubuntu 12.04 LTS.
i find on the certain time,
the mysql of server will run a lot of query,
and the io and load will become very high,
after the time point,
all the io and load with be smoth,
so,i wonder if any Cron job has been add (by certain account) to run something,
I bought a certificate for www.mydomain.com and I'm using the .key+.csr on DirectAdmin (to [url])
If I want to use this same .key+.csr combination to [url], would I have any problem?
I have an ssl issued from my domain company and i have hosting in another company.
I have created an CSR with my hosting, submitted to mine domain company so i can have the ssl, and installed in my hosting company.
But now i want to change mine hosting because the hosting company doesn't accept chained certificates..
So if i change mine hosting i could mantain mine old ssl ? or what does i need to do?
I have read about addon domains but I have still one doubt regarding same. Suppose I have buy two domains which have no any relationship with each other like one is of my family (viralshah3112andfamily.com) and one is for my uncle's business site (xyz.com) . Now if I host them in one account as addon domain, both will have different identity? Means both will have different URL like xyz.com and viralshah3112andfamily.com. Is it so?
View 8 Replies View RelatedThis is our logrotate definition for Apache's logs folder:
Code:
/var/log/httpd/*log {
rotate 5
missingok
notifempty
size=100M
sharedscripts
postrotate
/bin/kill -HUP `cat /var/run/httpd.pid 2>/dev/null` 2> /dev/null || true
endscript
}
Yet, while it does truncate logs in five, we seem to have fairly different sizes: 182M, 168M, 968M (!)... It seems to be ignoring "size=100M",
is it possible to disable log rotate? I can't seem to find the cron under my weeklys or dailys nor monthlys unless it's named "mad-db" but is there a way to make it say yearly? or just disable it all together? I say this because the script I use has a function already to clear the logs and when log rotate runs it kills all processes going by the script
View 8 Replies View RelatedIn /etc/logrotate.conf
I have the following:
Quote:
daily
rotate 7
create
compress
include /etc/logrotate.d
/var/log/wtmp {
monthly
create 0664 root utmp
rotate 4
}
How can I keep my logs until the 18th of every month?
Would:
monthly
rotate 18
i have a little issue with the domlogs folder.
I should empty this files but i don't know if it is possible to do without reboot Apache.
a) how can i setup logrotate to rotate domlogs?
And if it is possible:
b) how can i setup logrotate to rotate domlogs without restart apache?
I have already setup whm-> tweak settings to delete old domain's access logs after stats run and the whm is setup to generate statistics every 20 hours.
But every day the site is slowly because the domlogs are too big.
how to rename access logs according to Week Number?
I notice that 1&1 do this, producing a file like "access.log.31.gz".
I'd like the access log to be in this format: access_log_[domain-name]_[Week-Number].gz, or if domain-name is not possible: access_log_[Week-Number].gz
Here's my current logrotate script for access_log:
Code:
/home/default/muro.co.uk/user/logfiles/access_log {
missingok
rotate 8
weekly
postrotate
/bin/kill -USR1 `cat /var/run/httpd.pid`
endscript
}
I want to create logrotate in logrotate.d for modsecurity log.
I find following code, but it don't works.
Code:
/var/log/modsec_audit.log {
rotate 7
compress
missingok
notifempty
sharedscripts
postrotate
/sbin/service httpd reload > /dev/null 2>/dev/null || true
endscript
}
Plesk 12 on Centos 6.5
I added the following to my /etc/logrotate.conf
/var/log/modsec_audit.log {
missingok
daily
rotate 4
compress
}
I'm not exactly sure if the above is the correct syntax, but the result was that two days later my current modsec_audit.log was Gzipped and a new modsec_audit.log was created.
The problem is that nothing was logged to this new file.
From the Plesk 12 control panel I turned off mod security and then turned it back on again and hey presto, the new logfile started to log events.
This leaves the problem of why nothing was recorded when the file was created.
im planning on designing a webservice, it will have a lot of data, spread in many tables.
The problem is that there will be tables created constantly (around 5 each day..)
All tables/data will be accessed equally, so I dont know how to set up the system, to create multiple databases, and balance the number of tables equally on each database, or create less databases and have a lot of tables on each one.
Which one has more efficiency?
I would like to know how to check load via ssh and check files causing load?
I want the ssh codes for 2 different set of control panels, one with cpanel+whm and other with kloxo+hypervm
and I would also know how to check the files causing the load, such as some files could have been interrupted while processing, so they could be causing load some times, so I want to stop such processes if any are running on the vps on my friends accounts
I want to set up my server (a linux dedicated server) to automatically create daily backups of the pop3, mysql, & webfiles. I want it to go to a server which i have purchased with the exact same specifications.
I am not very good at unix command line/scripting. So what I need is for someone to help me define the backup strategy, select the scripts, and tell me of how to make sure backup server is secure.
I am running a dedicated server.
My apache crashes daily and I am investigating the cause of it.
I have found this strange message in my apache error_log....
Our website is receiving a daily attack from a french network called Neuf Cegetel. The IP is different each day but the network is always the same. The attack is daily and during several hours.
The website does not use ajax (the request is an ajax request) and there is no URL /0_0?_=... But the attacker use a random URL similar to this /0_0?_=1238873869634. Since the URL is always different the page is not cached so it is compressed by mod_deflate and therefore the attack is more harmful. The User-Agent and the cookies changes quite a lot but it is always an ajax request. Taking in account that it is the only ajax request in the server that would be the easily way to stop it. But it seems that when we try to stop the attack, the attacker try another way, what makes me think that the attack is voluntary (not a virus nor something like that).
Since it seems that the attacker can be easily found it (we are a Spanish website and the attacker comes always from the same French network), should we report this? If it were a virus in a remote server, the solution maybe is just to contact the abuse department of the network but if it is voluntary I think that we should discover who is behind the attack since it might be a company that want to bother us, a competitor or something like that. What do you think?
This is a very small copy of the logs containing a few examples:
Code:
4087 ReqStart c XX.XXX.42.189 52592 517548693
4087 RxRequest c GET
4087 RxURL c /0_0?_=1238873869634
4087 RxProtocol c HTTP/1.1
4087 RxHeader c x-requested-with: XMLHttpRequest
4087 RxHeader c Accept-Language: fr
4087 RxHeader c Referer: http://thewebsite.com/
4087 RxHeader c Accept: application/xml, text/xml, */*
4087 RxHeader c x-requested-handler: ajax
4087 RxHeader c UA-CPU: x86
4087 RxHeader c Accept-Encoding: gzip, deflate
4087 RxHeader c User-Agent: Mozilla/4.0 (compatible; MSIE 7.0;
Windows NT 6.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET
CLR 3.5.30729; .NET CLR 3.0.30618; FDM; OfficeLiveConnector.1.3;
OfficeLivePatch.0.0)
4087 RxHeader c Host: thewebsite.com
4087 RxHeader c Connection: Keep-Alive
4087 RxHeader c Cookie:
__utma=9819446.1354119376.1238785835.1238785835.1238865537.2;
__utmz=9819446.1238865537.2.2.utmccn=(organic)|utmcsr=msn|utmctr=thewebsite|utmcmd=organic;
__utmc=9819446; /=
4087 VCL_call c recv lookup
4087 VCL_call c hash hash
4087 VCL_call c miss fetch
4087 Backend c 3052 default default
4087 ObjProtocol c HTTP/1.1
4087 ObjStatus c 404
4087 ObjResponse c Not Found
4087 ObjHeader c Date: Sat, 04 Apr 2009 19:37:47 GMT
4087 ObjHeader c Server: Apache/2.2.3 (CentOS)
4087 ObjHeader c Vary: Accept-Encoding
4087 ObjHeader c Content-Encoding: gzip
4087 ObjHeader c Content-Type: text/html; charset=iso-8859-1
4087 TTL c 517548693 RFC 120 1238873867 0 0 0 0
4087 VCL_call c fetch
4087 TTL c 517548693 VCL 3600 1238873868
4087 VCL_return c deliver
4087 Length c 235
4087 VCL_call c deliver deliver
4087 TxProtocol c HTTP/1.1
4087 TxStatus c 404
4087 TxResponse c Not Found
4087 TxHeader c Server: Apache/2.2.3 (CentOS)
4087 TxHeader c Vary: Accept-Encoding
4087 TxHeader c Content-Encoding: gzip
4087 TxHeader c Content-Type: text/html; charset=iso-8859-1
4087 TxHeader c Content-Length: 235
4087 TxHeader c cache-control: max-age = 300
4087 TxHeader c Date: Sat, 04 Apr 2009 19:37:47 GMT
4087 TxHeader c X-Varnish: 517548693
4087 TxHeader c Via: 1.1 varnish
4087 TxHeader c Connection: keep-alive
4087 TxHeader c age: 0
4087 ReqEnd c 517548693 1238873867.757586718
1238873867.758437872 0.936849117 0.000804424 0.000046730
customer of HostV's VPS hosting, and for the past 3 days, at almost exactly 01:20 GMT, CPU load jumps from an average of about 0.10 to 2.5+, stays there for over an hour, then drops back down.
During this time, there are NO processes on my virtual server using any significant amount of CPU time, memory, or IO. No cron jobs are running on my server, etc.
Note the output from 'uptime' below (I was monitoring it waiting for the problem to occur, which it did at exactly the time I expected):
00:32:05 up 22:01, 2 users, load average: 0.09, 0.11, 0.08
00:32:07 up 22:01, 2 users, load average: 0.08, 0.11, 0.08
01:09:49 up 22:39, 2 users, load average: 0.06, 0.03, 0.00
01:10:03 up 22:39, 2 users, load average: 0.05, 0.03, 0.00
01:19:26 up 22:48, 2 users, load average: 0.46, 0.16, 0.04
01:20:42 up 22:50, 2 users, load average: 1.53, 0.55, 0.18
01:21:39 up 22:51, 2 users, load average: 1.40, 0.67, 0.24
01:46:04 up 23:15, 2 users, load average: 3.06, 2.02, 1.52
Also note output from 'top', taken when load average was at 3.06 shown on the last line above:
Cpu(s): 0.1% us, 0.0% sy, 0.0% ni, 91.0% id, 9.0% wa, 0.0% hi, 0.0% si
My cpu usage is very low (0.1%) but wait time is at 9.0%, and I've seen this go as high as 70% during these times.
So, basically, there is a problem that exists on the host node somewhere that is causing my site to become effectively unresponsive (page load 20 seconds+ - measured), and it happens every single day at the same time.
So, why am I posting it here instead of logging a trouble ticket? I have logged a trouble ticket, but when I encountered the problem yesterday, despite logging it as "CRITICAL", I had to wait nearly 5 hours for a response, which effectively said not much beyond "we noticed the problem and fixed it and we're monitoring it". So I don't have a lot of faith that today's response will be any better.
I moved to HostV because of similar problems I was encountering with shared hosting, and was assured before signing up that the kind of problem I'm seeing doesn't happen. So now I'm outlaying more than 10 times the cost for almost exactly the same problems and a similarly unhelpful response to it.
By publicly posting the problem, I would hope that someone at HostV will ensure the problem is addressed PROPERLY, rather than bandaided again, and that hopefully we will all be able to see just how good HostV's support CAN be (as evidenced in another similar post).
I await HostV/Cirtex's response.
As shown in the uptime information about, server uptime is 23:15, because I rebooted the virtual server yesterday to see if that helped. It didn't. In fact, it took over 20 minutes for the server to come back up, which is why I'm not going to do it again.
Our VPS is being hit several times a day with hacking attempts. We have been actively monitoring error logs and can see the failed attempts. I was just wondering if there is a better way to track such attempts or another system log that wold provide additional info on these attacks? or maybe some 3rd party logging scripts?
View 13 Replies View RelatedI just had a quick question about backup solutions. What advantage would I have by setting up 2 HD's in a RAID-1 array as opposed to just doing daily automated backups on one of the drives.
The way I see it, if I have automated backups, HD use for that backup drive is limited to say 20 minutes a day. In a RAID-1 array however, both drives are used at the same rate. Wouldn't this provide better life expectancy for the backup drive, granted it is at the expense of having a guaranteed instant replacement for that original drive?
Reason I'm asking is because I'm setting up a Mac Mini for a friend as a web server and he would like to have data backups. The only way to add space is to intall an external hard drive so my options are a bit limited.
i want to run /scripts/cpbackup every day begain with 12:00 AM and i put this line in /tmp/crontab.XXXXwuxGUI File
0 0 * * * /scripts/cpbackup
but the backup didn't work and do the job
I would like to create an exact copy of my live drive on a daily basis via cron. Is there a good mechanism for doing this *without* taking the main drive offline? It seems like the two common backup solutions: dd and rsync both have issues in this area. I don’t think Rsync can create an exact mirror (including partitions) and dd looks like you need to unmount the drive(s) first.
Both drives are of identical size and installed via the ide controller.
I recently got a dedi from Hivelocity, and they installed CSF/LFD. On my previous hosts, I didn't have this, just cPHulk. With this dedi, I'm receiving nearly a dozen daily emails from LFD with IPs that have been blocked for multiple failed logins, mostly with username root, but also sales, staff, admin, system, etc., and a few for port scanning.
Is this normal? I've already disabled direct root login via SSH, and I'm not really worried about anyone actually managing to gain access, I'm just curious about the high number of attempts. On previous hosts, where I actually had active sites and forums, with links posted on other forums that are indexed and nicely ranked by Google, I rarely received any emails from cPBrute at all.