Issue error imunify-core duplicate log entry

[pleskuser67553]

Server operating system version

CentOS 7.9

Plesk version and microupdate number

Plesk Obsidian 18.0.78 Update #2 and Plesk Obsidian 18.0.77 Update #4

Hello,

I've been getting these emails for the past few days from several servers:

Subject: Anacron job 'cron.daily' on [hostname redacted]

Body:
/etc/cron.daily/logrotate:

error: imunify-core:22 duplicate log entry for #
error: imunify-core:22 duplicate log entry for #
error: imunify-core:22 duplicate log entry for the
error: imunify-core:22 duplicate log entry for #
error: imunify-core:22 duplicate log entry for to
error: imunify-core:22 duplicate log entry for so
error: imunify-core:22 duplicate log entry for #
error: imunify-core:22 duplicate log entry for to
error: found error in file imunify-core, skipping
error: error opening root: Is a directory

All the affected servers are either:
Plesk Obsidian v18.0.77_build1800260526.09 os_CentOS 7
or
Plesk Obsidian v18.0.78_build1800260526.10 os_CentOS 7
on
CentOS Linux 7.9.2009 (Core)
AMD EPYC-Milan
running
Imunify v8.10.2-1

Some have the disabled and deprecated ImunifyAV v2.13.3-1. However, when I removed ImunifyAV on one server, and also uninstalled and reinstalled Imunify, there was no change to the above issue.

There is one server of the same configuration that appears to be unaffected because it is not sending these errors.

Any pointers on how to resolve would be appreciated, or perhaps it is a bug since is started occurring without my intervention?

PS, I know CentOS 7 is end-of-life and I plan to migrate these servers to AlmaLinux, but presently they continue to be supported with TuxCare ELS updates.

 

[Sebahat.hadzhi]

Could you please double-check what's currently present under /etc/logrotate.d/ and if there are any duplicate files?

ls -la /etc/logrotate.d/

 

[pleskuser67553]

Hello @Sebahat.hadzhi , here is the readout from one affected server:

[root@redacted ~]# ls -la /etc/logrotate.d/
total 96
drwxr-xr-x.   2 root root  4096 Jun  1 12:52 .
drwxr-xr-x. 109 root root  8192 May 31 03:48 ..
-rw-r--r--    1 root root    91 Sep 30  2020 bootlog
-rw-r--r--    1 root root   160 Sep 19  2018 chrony
-rw-r--r--    1 root root   271 Feb 27 14:25 fail2ban
-rw-r--r--    1 root root    93 Apr 28  2021 firewalld
-rw-r--r--    1 root root   202 May 28 03:28 httpd
-rw-r--r--    1 root root  1089 Apr 21 10:38 imunify360-antivirus
-rw-r--r--    1 root root  2037 May 13 23:16 imunify-core
-rw-r--r--    1 root root  1860 Aug  3  2024 mariadb
-rw-r--r--    1 root root   447 May 26 10:26 mod_security
-rw-r-----    1 root named  514 Apr 22 10:11 named
-rw-r--r--    1 root root    94 May 26 08:00 nginx
-rw-r--r--    1 root root   206 May 26 09:42 passenger
-rw-r--r--    1 root root   195 May 26 08:00 plesk
-rw-r--r--    1 root root   221 May  8 21:35 plesk-php82
-rw-r--r--    1 root root   221 May  8 16:07 plesk-php83
-rw-r--r--    1 root root   149 May 22 20:22 sw-cp-server
-rw-r--r--    1 root root   114 Jan  1  1990 sw-engine
-rw-r--r--    1 root root   207 May 28 03:27 syslog
-rw-r--r--    1 root root   100 Mar 16  2021 wpa_supplicant
-rw-r--r--    1 root root     0 Jun  1 12:52 wp-toolkit-action-logs
-rw-r--r--    1 root root   103 Oct  1  2020 yum

Here is a readout from another affected server after I removed the deprecated ImunifyAV and then uninstalled and reinstalled Imunify:

[root@redacted ~]# ls -la /etc/logrotate.d/
total 100
drwxr-xr-x.   2 root root  4096 Jun  1 13:23 .
drwxr-xr-x. 111 root root  8192 May 30 16:32 ..
-rw-r--r--    1 root root    91 Sep 30  2020 bootlog
-rw-r--r--    1 root root   160 Sep 19  2018 chrony
-rw-r--r--    1 root root   271 Feb 27 14:25 fail2ban
-rw-r--r--    1 root root    93 Apr 28  2021 firewalld
-rw-r--r--    1 root root   202 May 27 03:47 httpd
-rw-r--r--    1 root root  1089 Apr 21 10:38 imunify360-antivirus
-rw-r--r--    1 root root  2037 May 13 23:16 imunify-core
-rw-r--r--    1 root root  1860 Aug  5  2024 mariadb
-rw-r--r--    1 root root   447 May 26 10:26 mod_security
-rw-r-----    1 root named  514 Apr 22 10:11 named
-rw-r--r--    1 root root    94 May 26 07:47 nginx
-rw-r--r--    1 root root   206 May 26 09:42 passenger
-rw-r--r--    1 root root   195 May 26 07:47 plesk
-rw-r--r--    1 root root   221 May  7  2024 plesk-php74
-rw-r--r--    1 root root   221 May  8 16:07 plesk-php83
-rw-r--r--    1 root root    68 Sep 30  2020 sa-update
-rw-r--r--    1 root root   149 May 22 20:22 sw-cp-server
-rw-r--r--    1 root root   114 Jan  1  1990 sw-engine
-rw-r--r--    1 root root   207 May 27 03:46 syslog
-rw-r--r--    1 root root   100 Mar 16  2021 wpa_supplicant
-rw-r--r--    1 root root     0 Jun  1 13:23 wp-toolkit-action-logs
-rw-r--r--    1 root root   103 Oct  1  2020 yum

 

[Sebahat.hadzhi]

Thank you. Please make a copy of the imunify-core and place it another directory. For example:

cp /etc/logrotate.d/imunify-core /root/

Then, run the following command to remove the comment lines, which seem to be causing the issue:

sed -i '28,32d' /etc/logrotate.d/imunify-core

 

[pleskuser67553]

Hi @Sebahat.hadzhi Thank you for your help. I have run those commands. I will wait for the overnight cron to run again.

 

[pleskuser67553]

Subject: Anacron job 'cron.daily' on [hostname redacted]

Body:
/etc/cron.daily/logrotate:

error: imunify-core:22 duplicate log entry for #
error: imunify-core:22 duplicate log entry for #
error: imunify-core:22 duplicate log entry for the
error: imunify-core:22 duplicate log entry for #
error: imunify-core:22 duplicate log entry for to
error: imunify-core:22 duplicate log entry for so
error: imunify-core:22 duplicate log entry for #
error: imunify-core:22 duplicate log entry for to
error: found error in file imunify-core, skipping
error: error opening root: Is a directory

Relatedly, I'm struggling to understand how these emails are reaching an unrelated external account when they are being sent To: root@server-hostname From: root@server-hostname. I believe I have not set up any forwarding. I'm gratefully informed of the error of course, but consequently they are being junked because the DKIM signature does not verify. Other admin emails from my servers are DKIM signed as configured, sending to my preferred email address in Plesk Profile and, where set, are obeying the serverwide senderAddress From address in my panel.ini.