1. Please take a little time for this simple survey! Thank you for participating!
    Dismiss Notice
  2. Dear Pleskians, please read this carefully! New attachments and other rules Thank you!
    Dismiss Notice
  3. Dear Pleskians, I really hope that you will share your opinion in this Special topic for chatter about Plesk in the Clouds. Thank you!
    Dismiss Notice

Plesk Panel - error - backend died

Discussion in 'Plesk 11.x for Linux' started by MislavO, Jan 17, 2013.

  1. MislavO

    MislavO Regular Pleskian

    16
    85%
    Joined:
    Jul 20, 2012
    Messages:
    271
    Likes Received:
    1
    Location:
    Croatia
    Hello, I've noticed since 4pm today that I'm running following problem with my Plesk Panel:
    - plesk panel itself is not accessible (maybe from time to time) - I'm getting 500 - Internal Server Error

    I've found that:
    # /var/log/sw-cp-server/error_log

    is full of following errors:
    I've found on forum that this could be brute-force attack on the panel, but as described here:
    http://kb.parallels.com/en/8119

    but there is no such error in logs. Also, i'm not able to find any /var/log/secure file on my server, it doesn't exist. This file is mentioned here:
    http://forum.parallels.com/showthread.php?t=208198

    Load on server is normal, like 1-2 max. Memory is also fine.

    I've also tried:
    http://forum.parallels.com/showthread.php?t=112676
    http://forum.parallels.com/showthread.php?t=112880
    - changing apc.shm_size and other apc values has no effect
    - /usr/bin/sw-engine-cgi -c /usr/local/psa/admin/conf/php.ini -d auto_prepend_file=auth.php3 -u psaadm (no errors)

    Running Plesk 11.0.9, MU #31.
    Debian GNU/Linux 6.0.6 (squeeze)

    I can't also do a upgrade, i get email and when i click on the link this is shown:
    But that is not my problem atm. MU #31 is already active few weeks and this problem occurred TODAY.

    Please note: ALL WEBSITES on the server are working just fine, they load in less then a second, so this
    problem I'm facing is only related to plesk panel it self.
     
  2. IgorG

    IgorG Forums Analyst Staff Member

    49
    24%
    Joined:
    Oct 27, 2009
    Messages:
    24,543
    Likes Received:
    1,238
    Location:
    Novosibirsk, Russia
    BTW, instead of /var/log/secure Debian uses /var/log/auth.log
     
  3. MislavO

    MislavO Regular Pleskian

    16
    85%
    Joined:
    Jul 20, 2012
    Messages:
    271
    Likes Received:
    1
    Location:
    Croatia
    Yeah....Meanwhile, i figure that out by googling and i didn't find any symptoms like "ssl handshake" in logs, but interesting is that i have 500 records in 10-15min, i'm not sure is this normal or not.

    Records like that...(talking about /var/log/auth.log )
     
  4. IgorG

    IgorG Forums Analyst Staff Member

    49
    24%
    Joined:
    Oct 27, 2009
    Messages:
    24,543
    Likes Received:
    1,238
    Location:
    Novosibirsk, Russia
  5. MislavO

    MislavO Regular Pleskian

    16
    85%
    Joined:
    Jul 20, 2012
    Messages:
    271
    Likes Received:
    1
    Location:
    Croatia
    Thanks for the link, articles:

    http://kb.parallels.com/en/114058
    - there is no PPSB or WPB in my Plesk (not using them - disabled)

    http://kb.parallels.com/en/9755
    - i can access Licence Management
    # sysctl -w kernel.yama.ptrace_scope=0
    error: "kernel.yama.ptrace_scope" is an unknown key

    http://kb.parallels.com/en/1571
    - there is no tomcat app

    http://kb.parallels.com/en/114382
    - no such errors in logs

    http://kb.parallels.com/113418
    http://kb.parallels.com/113466
    - no such errors in logs - i've tried to set min-procs already before to 1, but no affect, I've found that here:
    http://forum.parallels.com/showthread.php?t=112676

    http://kb.parallels.com/8683
    - backup files are not downloading

    http://kb.parallels.com/en/5977
    - I'm running Linux with MySQL
     
  6. MislavO

    MislavO Regular Pleskian

    16
    85%
    Joined:
    Jul 20, 2012
    Messages:
    271
    Likes Received:
    1
    Location:
    Croatia
    # /var/log/auth.log

    EVERY second is this in logs....
     
    Last edited: Jan 18, 2013
  7. MislavO

    MislavO Regular Pleskian

    16
    85%
    Joined:
    Jul 20, 2012
    Messages:
    271
    Likes Received:
    1
    Location:
    Croatia
    Problem is now fixed, Parallels Support solved my problem.

    Problem was with "sw-cp-server" package. They tried to manually reinstall it, but they were getting errror:
    Plesk is now up and running!
     
  8. HarryBleckert

    HarryBleckert Basic Pleskian

    14
    35%
    Joined:
    Aug 8, 2011
    Messages:
    28
    Likes Received:
    0
    I got the very same problem after auto-upgrading to 11.0.9 Update #36. Installed OS is Ubuntu 10.04.4 LTS.

    How did Parallels Support fix the problem ???
     
  9. MislavO

    MislavO Regular Pleskian

    16
    85%
    Joined:
    Jul 20, 2012
    Messages:
    271
    Likes Received:
    1
    Location:
    Croatia
    As i quoted above, they reinstalled the package.

    Whole quote from email:
    Just incase i suggest you to contact them.
     
  10. IgorG

    IgorG Forums Analyst Staff Member

    49
    24%
    Joined:
    Oct 27, 2009
    Messages:
    24,543
    Likes Received:
    1,238
    Location:
    Novosibirsk, Russia
    I can say only that MU#36 has absolutely nothing concerning sw-cp-server. Therefore upgrade to MU#36 can't be a reason of problems with sw-cp-server. As I see in your support ticket #1589560 that problem under support investigation now.
     
  11. HarryBleckert

    HarryBleckert Basic Pleskian

    14
    35%
    Joined:
    Aug 8, 2011
    Messages:
    28
    Likes Received:
    0
    Plesk support was very responsive and helpful. After extensive log reviews they figured the problem was cause by bruteforce attacks.
    I could not verify bruteforce attacks after reviewing logs again. And fail2ban plus firewall did not show alarming numbers. Apache was always responsive, server load was low.

    However, in between log reviews, the problem was gone, panel became responsive again and sw-engine-cgi stopped to open hundreds of instaces and eating RAM (but no CPU usage).

    I am still nervous because I don´t know what caused the problem.
     
  12. IgorG

    IgorG Forums Analyst Staff Member

    49
    24%
    Joined:
    Oct 27, 2009
    Messages:
    24,543
    Likes Received:
    1,238
    Location:
    Novosibirsk, Russia
Loading...