• Please be aware: Kaspersky Anti-Virus has been deprecated
    With the upgrade to Plesk Obsidian 18.0.64, "Kaspersky Anti-Virus for Servers" will be automatically removed from the servers it is installed on. We recommend that you migrate to Sophos Anti-Virus for Servers.
  • The Horde webmail has been deprecated. Its complete removal is scheduled for April 2025. For details and recommended actions, see the Feature and Deprecation Plan.
  • We’re working on enhancing the Monitoring feature in Plesk, and we could really use your expertise! If you’re open to sharing your experiences with server and website monitoring or providing feedback, we’d love to have a one-hour online meeting with you.

Resolved Httpd not starting

mulderj

mulderj

New Pleskian
Hello Guys,


I have a problem with my hosting server wich is running Plesk 17.
When I started the server apache wasn't running at all.
So I logged in with ssh and did "sudo service httpd start" after that I did "sudo service httpd status".
I got the following log:
Code: 
Sep 19 15:53:29 SERVERNAME systemd[1]: Starting The Apache HTTP Server...
Sep 19 15:53:30 SERVERNAME httpd[2976]: AH00526: Syntax error on line 64 of /etc/httpd/conf/plesk.conf.d/server.conf:
Sep 19 15:53:30 SERVERNAME httpd[2976]: ModSecurity: Failed to open the audit log file: /var/log/modsec_audit.log
Sep 19 15:53:30 SERVERNAME systemd[1]: httpd.service: main process exited, code=exited, status=1/FAILURE
Sep 19 15:53:30 SERVERNAME kill[2978]: kill: cannot find process ""
Sep 19 15:53:30 SERVERNAME systemd[1]: httpd.service: control process exited, code=exited status=1
Sep 19 15:53:30 SERVERNAME systemd[1]: Failed to start The Apache HTTP Server.
Sep 19 15:53:30 SERVERNAME systemd[1]: Unit httpd.service entered failed state.
Sep 19 15:53:30 SERVERNAME systemd[1]: httpd.service failed.

Line 64 of the server.conf contains this:
Code: 
SecAuditLog "/var/log/modsec_audit.log"

in this block of config:
Code: 
<IfModule mod_security2.c>
        SecRuleEngine On
        SecRequestBodyAccess Off
        SecResponseBodyAccess Off
        SecAuditEngine RelevantOnly
        SecAuditLog "/var/log/modsec_audit.log"
        SecAuditLogType serial
</IfModule>

The permissions of this file are:
Code: 
-rw-r-----. 1 root root 36194 Sep  1 10:41 /var/log/modsec_audit.log

I cannot find the issue here.
I tried to change te user to apache so the permissions would be this:
Code: 
-rw-r-----. 1 apache root 36194 Sep  1 10:41 /var/log/modsec_audit.log

This didn't work and the server wouldnt boot :(
Anyone any ideas?
 
Last edited:
I have the "web application firewall" turned off, so I don't have that file.
For you I turned it on (front page of Plesk interface) and now I have that file...
upload_2017-9-19_17-44-4.png


Code: 
-rw-r----- 1 root root 0 Sep 19 17:41 /var/log/modsec_audit.log

Why don't you turn it off and check what's happening and turn it on again afterwards....
 
Hello mr-wolf,

I rolled back a backup of my server, I'm running it on debian 7.
There are a few updates that I ran before the issue started.
I think that there are some packages that broke it so i will wait with the update.
Even now I "fixed" this I want to know what te problem could have been so I can update my server.
Also that permissions seem to be right than.

Thx for the reply.

Jesse Mulder
 
Hi jesse_mulder,

jesse_mulder said:
There are a few updates that I ran before the issue started
Click to expand...
Sorry, these are too less informations to give a decent answer to your issue. Pls. consider to inform us about possible issues/errors/problems and pls. add as well corresponding log - files, as we can't guess such things and the possibilities are way to huge, as we could direct you into the right direction. :)

jesse_mulder said:
I think that there are some packages that broke it so i will wait with the update.
Click to expand...
Sorry, again too less informations to give you a decent answer to your assumptions. :(

jesse_mulder said:
Even now I "fixed" this I want to know what te problem could have been so I can update my server
Click to expand...
We are as well interested in getting informations from you, before we suggest ( possible ) work-arounds / solutions / ... to ( possible ) issues/errors/problems. At the moment, we could only guess. :(
 
Okay what information do you need? all the problem log files ar not there because I rolled back a backup. But I can give you this:

upload_2017-9-19_18-41-27.png
 
Hi jesse_mulder,

jesse_mulder said:
Okay what information do you need?
Click to expand...
To start, it is always wise to provide ALL necessary informations as for example:

YOUR current used operating system
YOUR current used Plesk version ( incl. #MU )​

Afterwards, you would continue with the desired goal which you are trying to achieve and you would further continue with related log - file entries from "/var/log", if you experience issues/errors/problems. ( I hope that you understand, that we can't try to investigate non-existent issues/errors/problems, as the possibilities are way too huge on linux servers to guess possibilities ).


Additional informations:
Pls. consider as well to read => Question - Plesk Onyx & CentOS 7.4 compatible? , if you desire to upgrade to CentOS 7.4. :)
 
So this is the OS and version of plesk currently running.
upload_2017-9-19_19-2-21.png
It is a personal server but with multiple websites from friends, so I cannot be out of the air for verry long...
If its needed I understand, but I want to know more before I break it again...

Hope you understand my situation.
 
Hi jesse_mulder,

your "yum" - package - manager ( not shipped by Plesk! ), has several options to update/upgrade only partial packages.
As this is out of the scope of Plesk and it's products, you might consider to read the official man - pages => yum(8) - Linux manual page for further informations. :)
 
UFHH01 said:
Hi jesse_mulder,

your "yum" - package - manager ( not shipped by Plesk! ), has several options to update/upgrade only partial packages.
As this is out of the scope of Plesk and it's products, you might consider to read the official man - pages => yum(8) - Linux manual page for further informations. :)
Click to expand...

I know how this works, but when I update a package one of the 12 apache/httpd wont start and gives the following error:
Code: 
Sep 19 15:53:30 SERVERNAME httpd[2976]: AH00526: Syntax error on line 64 of /etc/httpd/conf/plesk.conf.d/server.conf:
Sep 19 15:53:30 SERVERNAME httpd[2976]: ModSecurity: Failed to open the audit log file: /var/log/modsec_audit.log

So my question is how do I fix this problem. And as far as I can see is this plesk related...
 
Last edited:
Hi jesse_mulder,

like @mr-wolf already stated, the turn-off, a de and re-install of the extension, or even the change to another rule should solve your issue here. In addition, pls. consider to have a closer look at the depending log - files, in oder to investigate ( possible ) issues/errors/problems, which ( mostly ) point you directly to the root cause. :)
 
@UFHH01 I tried to disable and enable it but when I try to enable it again it doesn't come back online (The setting stays disabled). Also with it disabled the domains are unreachable.
I cant find more logging than this:
upload_2017-9-19_22-18-15.png
 
Hi jesse_mulder,

after DISabling, the automatic process is to re-create the webserver - configuration files. Pls. consider to use for example:
Code: 
plesk repair web -y -v
... if you experience issues/errors/problems with orphaned/obsolete webserver configuration files.

Pls. make sure, that your apache ( and/or nginx ) services work as expected, after you disabled ModSecurity.


Only if the above has been successfull, you would re-enable ModSecurity, which again should process the re-creation of new webserver - configuration files.
If you then experience, that "/var/log/modsec_audit.log" can't be opened, as stated within your error - message, the next step is to investigate WHY this happens:
  • Is the log "modsec_audit.log" existent?
  • Which permissions does the file have ?
    Code: 
    ls -lah /var/log | grep mod
  • Is there a "SELinux policy" that interferes with the correct run of your apache service? Please check "/var/log/messages" for ( possible ) issues/errors/problems.
  • What loggind entries did you investigate at "/var/log/modsec_audit.log" and "/var/log/apache2/error.log" ?
  • Did you consider to FULLY remove ModSecurity ( including possible leftovers ) and to RE-install afterwards?
 
Found the bad package:
upload_2017-9-19_22-52-56.png
Does this clear something up for you?

Also found this:
Code: 
Repairing web server configuration
    Reinstalling SSL/TLS certificates ............................... [OK]
    Applying the default SSL/TLS certificate to all IP addresses .... [OK]
    Repairing server-wide configuration parameters for web servers .. [2017-09-19 22:55:30] ERR [util_exec] proc_close() failed ['/usr/local/psa/admin/bin/httpdmng' '--reconfigure-server'] with exit code [1]
[FAILED]
    - httpdmng failed: [2017-09-19 22:55:30] ERR [util_exec]
      proc_close() failed ['/usr/local/psa/admin/bin/apache-config'
      '-t'] with exit code [1]
      [2017-09-19 22:55:30] ERR [util_exec] proc_close() failed
      ['/usr/local/psa/admin/bin/apache-config' '-t'] with exit code
      [1]
      [2017-09-19 22:55:30] ERR [panel] Apache config
      (15058545290.30444800) generation failed: Template_Exception:
      AH00526: Syntax error on line 64 of
      /etc/httpd/conf/plesk.conf.d/server.conf:
      ModSecurity: Failed to open the audit log file:
      /var/log/modsec_audit.log

      file:
      /usr/local/psa/admin/plib/Template/Writer/Webserver/Abstract.php
      line: 75
      code: 0
      AH00526: Syntax error on line 64 of
      /etc/httpd/conf/plesk.conf.d/server.conf:
      ModSecurity: Failed to open the audit log file:
      /var/log/modsec_audit.log
    Updating the file of sharing passwords and permissions of users
    according to actual information ................................. [OK]
    Repairing web server configuration for all domains. This aspect
    can be used with individual domains ("plesk repair web
    example.com"), and on the server level ("plesk repair web") ..... [2017-09-19 22:55:31] ERR [util_exec] proc_close() failed ['/usr/local/psa/admin/bin/httpdmng' '--reconfigure-all'] with exit code [1]
[FAILED]
    - httpdmng failed: Execution failed.
      Command: httpdmng
      Arguments: Array
      (
          [0] => --reconfigure-server
          [1] => -no-restart
      )

      Details: [2017-09-19 22:55:31] ERR [util_exec] proc_close()
      failed ['/usr/local/psa/admin/bin/apache-config' '-t'] with
      exit code [1]
      [2017-09-19 22:55:31] ERR [util_exec] proc_close() failed
      ['/usr/local/psa/admin/bin/apache-config' '-t'] with exit code
      [1]
      [2017-09-19 22:55:31] ERR [panel] Apache config
      (15058545310.07161000) generation failed: Template_Exception:
      AH00526: Syntax error on line 64 of
      /etc/httpd/conf/plesk.conf.d/server.conf:
      ModSecurity: Failed to open the audit log file:
      /var/log/modsec_audit.log

      file:
      /usr/local/psa/admin/plib/Template/Writer/Webserver/Abstract.php
      line: 75
      code: 0
      AH00526: Syntax error on line 64 of
      /etc/httpd/conf/plesk.conf.d/server.conf:
      ModSecurity: Failed to open the audit log file:
      /var/log/modsec_audit.log

The permissions are as followed:
Code: 
-rw-r-----.  1 root              root    36K Sep  1 10:41 modsec_audit.log
-rw-r-----.  1 root              root     20 Nov  8  2016 modsec_audit.log-20161109.gz
-rw-r-----.  1 root              root     20 Nov  9  2016 modsec_audit.log-20161110.gz
-rw-r-----.  1 root              root     20 Nov 10  2016 modsec_audit.log-20161111.gz
-rw-r-----.  1 root              root     20 Nov 11  2016 modsec_audit.log-20161112.gz
-rw-r-----.  1 root              root     20 Nov 12  2016 modsec_audit.log-20161113.gz
-rw-r-----.  1 root              root     20 Nov 13  2016 modsec_audit.log-20161114.gz
-rw-r-----.  1 root              root     20 Nov 14  2016 modsec_audit.log-20161115.gz
lrwxrwxrwx.  1 root              root     36 Jul 31 03:45 wdcollect.log -> /var/log/plesk/modules/wdcollect.log

After I disabled the modsecurity and did the command you suggested I get a 503 and a bad SSL certificate.
 
Last edited:
Hi jesse_mulder,

pls. consider to follow the recent suggestions ( => #12 ) and pls. don't forget to update your software packages with "yum" to avoid issues/errors/problems.
 
Hi jesse_mulder,

jesse_mulder said:
After I disabled the modsecurity and did the command you suggested I get a 503 and a bad SSL certificate.
Click to expand...
Anything from your logs here?
Do you use nginx as well? If "yes": Did you make sure, that nginx is running?
Which PHP - Handler do you use? If you use "php-fpm", did you make sure, that the corresponding service is active?


I'm sorry, but I can't investigate the SSL issue for you, as you don't provide any informations about your FQDN here.


Additional reminder:
UFHH01 said:
Did you consider to FULLY remove ModSecurity ( including possible leftovers ) and to RE-install afterwards?
Click to expand...

 
Hi jesse_mulder,

jesse_mulder said:
Nope sadly not
Click to expand...
pls. note, that there is not only the serverwide apache - log - location "/var/log/apache2" ( Debian/Ubuntu based systems ) or "/var/log/httpd" ( RHEL/CentOS based systems ), but there are as well (sub)domain specific log - files at => /var/www/vhosts/system/(subdomain.)YOUR-DOMAIN.COM/logs



If you experience a 503 error, there will always be a related log - entry.



jesse_mulder said:
Where can I find this information?
Click to expand...
Each (sub)domain has it's very own PHP - Setting at : => HOME > Domains > (subdomain.)YOUR-DOMAIN.COM > PHP Settings , where you are able to setup the desired PHP - Handler and the desired application to run with your webserver.

If you setup for example the Plesk PHP version 5.6 for a domain and choosed the PHP-FPM application for apache, you could check for example over the command line with a example command:
Code: 
service plesk-php56-fpm status
 
The domain specific log says: (error_log)
Code: 
[Tue Sep 19 23:04:12.290375 2017] [proxy_fcgi:error] [pid 7833:tid 140654525011712] [client *.*.*.*:62444] AH01079: failed to make connection to backend: httpd-UDS
[Tue Sep 19 23:06:39.437585 2017] [proxy:error] [pid 9531:tid 140654533404416] (13)Permission denied: AH02454: FCGI: attempt to connect to Unix domain socket /var/www/vhosts/system/MYDOMAIN/php-fpm.sock (*) failed
[Tue Sep 19 23:06:39.437619 2017] [proxy_fcgi:error] [pid 9531:tid 140654533404416] [client *.*.*.*:62610] AH01079: failed to make connection to backend: httpd-UDS
The access_log and access_ssl_log's are empty

PHP Is running just fine :)

The proxy_error_log says:
Code: 
2016/11/19 11:24:24 [error] 21404#0: *91 peer closed connection in SSL handshake (104: Connection reset by peer) while SSL handshaking to upstream, client: MYIP, server: MYDOMAIN, request: "GET / HTTP/2.0", upstream: "https://SERVERIP:7081/", host: "MYDOMAIN"
2016/11/19 11:24:24 [error] 21404#0: *91 connect() failed (111: Connection refused) while connecting to upstream, client: MYIP, server: MYDOMAIN, request: "GET /favicon.ico HTTP/2.0", upstream: "https://SERVERIP:7081/favicon.ico", host: "MYDOMAIN"
2016/11/19 11:24:24 [error] 21404#0: *91 connect() failed (111: Connection refused) while connecting to upstream, client: MYIP, server: MYDOMAIN, request: "GET /favicon.ico HTTP/2.0", upstream: "https://SERVERIP:7081/favicon.ico", host: "MYDOMAIN"
 
Hi jesse_mulder,

pls. read and follow the suggestions from:


... as Plesk already has a corresponding Knowledge - Base article with your described issue:
jesse_mulder said:
[Tue Sep 19 23:04:12.290375 2017] [proxy_fcgi:error] [pid 7833:tid 140654525011712] [client *.*.*.*:62444] AH01079: failed to make connection to backend: httpd-UDS
[Tue Sep 19 23:06:39.437585 2017] [proxy:error] [pid 9531:tid 140654533404416] (13)Permission denied: AH02454: FCGI: attempt to connect to Unix domain socket /var/www/vhosts/system/MYDOMAIN/php-fpm.sock (*) failed
[Tue Sep 19 23:06:39.437619 2017] [proxy_fcgi:error] [pid 9531:tid 140654533404416] [client *.*.*.*:62610] AH01079: failed to make connection to backend: httpd-UDS
Click to expand...
 
You must log in or register to reply here.

Similar threads

R
Resolved Failed to start Raise network interfaces
Replies
1
Views
542
Retr0
R
K
Issue not starting the following service:maldet.service,php-fpm.service,[email protected]
Replies
0
Views
914
kalombo
K
C
Issue New Configuration not created
Replies
3
Views
763
Peter Debik
P
S
Issue Error changing from litespeed to apache
Replies
2
Views
735
mow
M
D
Question Sendmail behaviour change after 18.0.55 Update 1
Replies
0
Views
821
davidweb
D
Back
Top