New httpd patch bad?

Gilbert Sebenste sebenste at weather3.admin.niu.edu
Sun May 16 18:23:14 UTC 2004


Hello Alexander,

Thanks for replying! Now...

> > worked fine. I have 3 webervers all running the same setup. But this 
> > morning, at 4:03 AM local time, it stopped. A check of the httpd logs 
> > shows:
> > 
> > [Sun May 16 04:03:33 2004] [notice] seg fault or similar nasty error 
> > detected in the parent process
> 
> That is shortly after the daily httpd restart each morning at about ~
> 04:02 AM.

Yes.
 
> Are there no more helpful log entries in /var/log/httpd/error_log.1 (.1
> because on sunday morning it logrotates) or ssl_error_log[.1] or
> ssl_request_log[.1]?

No, I checked the current logs and previous logs. Nothing suspicious.
 
> > OK, that's obviously not good. Well, what happened? Anything in any other 
> > logs that would indicate a problem? Well, syslog restarted at that time. 
> > Then, I get this automagically generated nastygram into my emailbox:
> 
> Check the other log files in /var/log/httpd/, especially the .1 files
> which are the ones used just until the sunday logrotate.

Yes, I did, no other problem to note.
 
> > Subject: Cron <root at machine> run-parts /etc/cron.daily
> > 
> > /etc/cron.daily/00webalizer:
> > 
> > Error: Skipping oversized log record
> 
> Just a typical (normal)webalizer error message, if it finds in the
> access_log entries which are caused by attackers who use overlong
> pattern access to try out vulnerabilities. Often those are just methods
> to attack vulnerable IIS hosts and not Apache(2). See the access_log.1
> for that entries.

Ahhh, that's what is doing it. OK, good to know. Thanks. Anyone else 
having this problem?

I should note that I have two other boxes running the same thing, Apache 
2.049, and they did NOT crash. But they are on machines that were upgraded 
from RH-9 to FC-1. The machine that is crashing httpd is a machine built 
from scratch using FC-1, and they do NOT use mod_ssl. Should I just 
uninstall mod_ssl on the machine that is crashing?

*******************************************************************************
Gilbert Sebenste                                                     ********
(My opinions only!)                                                  ******
Staff Meteorologist, Northern Illinois University                      ****
E-mail: gilbert at niu.edu                                               ***
web: http://weather.admin.niu.edu                                      **
Work phone: 815-753-5492                                                *
*******************************************************************************





More information about the fedora-list mailing list