Watchdog Errors and Questions

[Andrew_Pa]

Today an email arrives in my mailbox :

Subject: Watchdog weekly report Apr 1, 2012 - Apr 7, 2012

Watchdog was stopped at Apr 9, 2012 01:00 AM.

Security scans number: 1.

Events:
[Apr 2, 2012 01:00 AM] Security scanning report is in the file /usr/local/psa/var/modules/watchdog/report/security_2012-04-02.

I check the module and was stopped. So I enabled again.

Then I went to scan my server for rootkits, backdoors, local exploits and other malicious code. So I use Modules>Watchdog>Security .

But When I push the Start button I get the following error :

Failed to recreate the status file /tmp/rkhunter.state of the rkhunter service: Possible reason is lack of permissions. Delete this file manually and try again.

0: wdcplib.php:490
prepare_rkhunter_state_file()
1: modules.watchdog.security.php:30
plesk__modules__watchdog__security->accessItem(string 'GET', NULL null)
2: UIPointer.php:595
UIPointer->access(string 'GET')
3: plesk.php:45

How Can I fix it?

Also I would like to ask if Watchdog "eating" resources from server. I mean If watchdog is running what happening with the server performance?

Thank you very much.

 

[IgorG]

What sort of output following command:

# stat /tmp

Looks like you have incorrect permissions for /tmp directory.

 

[Andrew_Pa]

Thank you for your answer!

The output of the command is

[root@ tmp]# stat /tmp
File: `/tmp'
Size: 4096 Blocks: 8 IO Block: 4096 directory
Device: 802h/2050d Inode: 141066241 Links: 3
Access: (1777/drwxrwxrwt) Uid: (10014/ pesyp) Gid: ( 505/ psacln)
Access: 2012-04-09 10:36:13.000000000 +0300
Modify: 2012-04-09 10:36:26.000000000 +0300
Change: 2012-04-09 10:36:26.000000000 +0300

As I see, Uid and Gid is not root user... Correct?

 

[IgorG]

You have incorrect owner and group (pesypsacln)
It should be root:root

 

[Andrew_Pa]

OK I changed the Owner

[root@ tmp]# stat /tmp
File: `/tmp'
Size: 4096 Blocks: 8 IO Block: 4096 directory
Device: 802h/2050d Inode: 141066241 Links: 3
Access: (1777/drwxrwxrwt) Uid: ( 0/ root) Gid: ( 0/ root)
Access: 2012-04-09 10:36:13.000000000 +0300
Modify: 2012-04-09 11:04:39.000000000 +0300
Change: 2012-04-09 11:04:39.000000000 +0300

Should I do something else, because I tried once more to start the scan and I get the same problem...

 

[IgorG]

Did you remove file /tmp/rkhunter.state ?

 

[Andrew_Pa]

Everything is fine now!!!! Thank you very much!!!


Also could you please inform me about the resources allocation that need watchdog?

Does it influence the performance of the server?

 

[IgorG]

I think that these resources are negligible and watchdog shouldn't affect server performance.

 

[Andrew_Pa]

Thank you very much for your time and your solution!