Resolved FTP not writing any content to file, what can it be?

[mb_martijn]

We have a bit of an odd problem. Maybe someone here can point us to what this might be.
We have a same problem on 3 server. All 3 have Plesk Onyx v17.8.11 and run on CentOS 7.
With about the same setup. We use these for Apache and nginx proxy. Mainly WordPress websites and a couple of php sites.

When we upload a file (either a new file or edit of excisting file), we get no FTP errors, but the file on the server is 0 B in size, completely empty.
We tested it with php, html, css, png, jpg, pdf files. most of the files are all well below 200kb.
See attached image from the filebrowser. -> all these files have been uploaded with the same ftp-client. the last, test.php is empty - but is should have about 270 lines of mixed html/php code.

The problem occurs on multiple subscriptions. None of the tested subscriptions in anywere near its max usage. There is no ftp usage limit on the tested users.

All servers have at least 30Gb free space. One of them is fairly new and only has like 3 live domains and 100+ Gb free. The others are used for hosting 80-120 domains.

The problem goes away for 5 mins/couple of days after a server restart.

The problem is only with certain FTP clients/modules -> like the Adobe Dreamweaver cc and Atom remote ftp package. On for example FileZilla, there were no problems. This was tested with the exact same ftp credentials.

The FTP log on the server shows that the files are not being modified. But no errors.

The problem seem to be recent. As in the last 2-3 weeks I've encountered this on all 3 servers a couple of times.

My colleague who rarely uses his Dreamweaver had this problem once around mid januari. But I did a lot of work on the domains on that specific server for the last 2-3 years, using both Dreamweaver and Atom. Without any of these issues.
I also use the same programs to FTP to a couple of CP and DirectAdmin servers, without any problems.

We updated all the Plesk updates, the kernal is up-to-date and so is apache.

Is there anything we can try / look at to determine the problem.
The odd thing is that it is not with all ftp clients, but a server restart also solves the problem for a limited time.
Via a couple of Google searches the only pointed to a free space issues, but all server have enough space and it also happens with files only a couple of KB in size.

Kind regards,

Martijn

 

[Monty]

Just a wild guess: Is your server properly configured for passive FTP transfers? Is the "nf_conntack_ftp" module loaded in your iptables configuration?
Check this:
(Plesk for Linux) Configuring Passive FTP Mode
How to configure the passive ports range for ProFTPd on a server behind a firewall

Also, check your FTP logs for more details.
You could add the following to your proftpd configuration to have more detailed logs:
ExtendedLog /var/log/ftp.log ALL default

 

[Bitpalast]

We've seen similar situations with random customers. It rarely occurs, and normally the customer's computer was infected when we deeply checked it, e.g. in Windows "protected mode" and with a suitable 2nd opinion software like HitmanPro. It's never been a server side issue. It could be in some cases, but as you are experiencing it across several servers, it is more likely a client side issue.

 

[mb_martijn]

Hi,

Just a wild guess: Is your server properly configured for passive FTP transfers? Is the "nf_conntack_ftp" module loaded in your iptables configuration?
Check this:
(Plesk for Linux) Configuring Passive FTP Mode
How to configure the passive ports range for ProFTPd on a server behind a firewall

Also, check your FTP logs for more details.
You could add the following to your proftpd configuration to have more detailed logs:
ExtendedLog /var/log/ftp.log ALL default

Will check to see with detailed logs if anything pops up. As for passive mode, we had problems with that in the past, but in those cases we could not even connect. As said we do get connection, the programs also report successful uploads, if you upload a new file a new file is created on the server, just empty. And excisting files will also turn into empty files.

We've seen similar situations with random customers. It rarely occurs, and normally the customer's computer was infected when we deeply checked it, e.g. in Windows "protected mode" and with a suitable 2nd opinion software like HitmanPro. It's never been a server side issue. It could be in some cases, but as you are experiencing it across several servers, it is more likely a client side issue.

But the weird thing is that FileZilla does work, on the same system.
But will see if I can do a couple of tests from another system.

Thank you both for your suggestions, will look into those.

 

[DieterWerner]

Hi,
Will check to see with detailed logs if anything pops up.

You should check the number of free/used inodes too

 

[mb_martijn]

You should check the number of free/used inodes too

Sorry, I see I forgot to mention that. We checked this as well, we have more then enough free.

 

[mb_martijn]

We have found the problem.

We've seen similar situations with random customers. It rarely occurs, and normally the customer's computer was infected when we deeply checked it, e.g. in Windows "protected mode" and with a suitable 2nd opinion software like HitmanPro. It's never been a server side issue. It could be in some cases, but as you are experiencing it across several servers, it is more likely a client side issue.

After testing on another system (W10pro), without any problems, so we started to focus on my system a Mac with Mojave, My collegae who rarely uses it, but also had the problem back in januari also uses a Mac with Mojave.

About 6 weeks ago we installed Bitdefenders Endpoint security for Mac on my system. Something my collegae already had on his system for some time.
I didn't connect the dots as I didnt use any ftp a couple of weeks after that instal. But this was the only thing I could think of that recently changed on my system and that was different prior to the start of my problems.

I tested it right before uninstalling, still having the problem, then after I uninstalled the Endpoint security, the problem was gone.

So indeed the problem was local. Thanks for pointing this out.

I've contacted Bitdefender for further assistance in resolving this.