Issue dev/urandom file with huge size

[ranjithkr]

Server operating system version

CentOS Linux release 7.9.2009

Plesk version and microupdate number

18.0.64.0

Hi,

I am having a strange issue with my plesk servers. am getting disk usages alerts from my monitoring tools. While checking i see a urandom file with more than 200GB is being created. The path will be like,

/var/www/vhosts/domain.com/dev/urandom

[root@server029 ~]# du -sch /var/www/vhosts/*/dev/*

88K /var/www/vhosts/domain.com/dev/random
200G /var/www/vhosts/domain.com/dev/urandom

This is repeating with most of my plesk servers.

Anyone faced this issue?

 

[AYamshanov]

Hi! Is it a regular file? On my server, it is a special device,

# ls -la /var/www/vhosts/example.org/dev/
total 8
drwxr-xr-x  2 root    root    4096 Dec 11 13:40 .
drwx--x--- 10 admin_9 psaserv 4096 Dec 11 14:23 ..
crw-rw-rw-  3 root    root    1, 3 Mar 31  2023 null
crw-r--r--  3 root    root    1, 8 Mar 31  2023 random
crw-r--r--  3 root    root    1, 9 Mar 31  2023 urandom

# du /var/www/vhosts/example.org/dev/*random
0       /var/www/vhosts/example.org/dev/random
0       /var/www/vhosts/example.org/dev/urandom

 

[ranjithkr]

Hi,

I believe its not a regular file. But not sure why the file size getting increased. Not sure if its something from the acronis backup. But couldn't identify the root cause. Each time when i encounter the issue, i manually delete the file and recreate it with mknod -m 0666 urandom c 1 9

# ls -la
total 8
drwxr-xr-x.   2 root       root    4096 Sep 22  2023 .
drwx--x---.  15 f_0001c7c3 psaserv 4096 Oct 28 01:22 ..
crw-rw-rw-. 919 root       root    1, 3 Mar 16  2022 null
crw-r--r--. 919 root       root    1, 8 Mar 16  2022 random
crw-r--r--. 919 root       root    1, 9 Mar 16  2022 urandom

 

[Vladimir C.]

I found only one case in Plesk internal knowledge base about such behavior and cause was related to functions in some Wordpress plugins on that domain’s doc root which were interacting with the /dev/urandom devices. You mentioned it happens on several servers. Do you see any patterns e.g. it's happen only for specific CMS?

 

[ranjithkr]

I have to check it. That can be possible.

 

[ranjithkr]

Its not just with wordpress, today i got an issue with a joomla based website. So we cant say its because of wordpress plugins.

 

[Vladimir C.]

In such case I would recommend you contact Plesk technical support team as investigation is required to determine cause of the issue.