Show Posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.


Messages - Starburst

Pages: 1 ... 3 4 [5] 6 7 ... 95
61
CentOS 9 Problems / Logrotate not triggering
« on: April 17, 2025, 08:57:19 PM »
AlmaLinux 9.5
CWP 0.9.8.1201

Config is located at: /etc/logrotate.d/httpd
Quote
/usr/local/apache/domlogs/*.log {
    missingok
    notifempty
    sharedscripts
    daily
    rotate 7
    postrotate
        /bin/systemctl reload httpd.service > /var/log/httpd-rotate.log 2>&1 || true
    endscript
    compress
}

But is not getting triggered automatically each night.
Trigger's manually without error.

When you check:
Code: [Select]
systemctl status logrotate
Quote
logrotate[811675]: error: failed to rename /usr/local/apache/domlogs/domain.com.log to /usr/local/apache/domlogs/domain.com.log-20250417: Read-only file
Only problem, is that file doesn't exit. Let alone be read only.

The other quirk is when you manually run it, it doesn't assign the date, just log.1.gz, log.2.gz, etc.

62
Information / Re: Goaccess stopped working
« on: April 16, 2025, 08:51:22 PM »
Have you checked to see if your log files haven't ballooned in size to be too large to process? Are you using logrotate to keep them a manageable size?

I posted update instructions in another thread, but here it is again:
Also, can goaccess be updated?  server version is 1.2 from 2017.  Latest is 1.9
Nothing prevents you from updating if you so desire. Remove CWP's GoAccess and install prerequisite (MaxMind GeoIP library):
Code: [Select]
yum -y remove goaccess
yum install libmaxminddb-devel.x86_64
Download and compile GoAccess, install to replace the current 1.2 version:
Code: [Select]
cd /usr/local/src
wget https://tar.goaccess.io/goaccess-1.9.3.tar.gz
tar -xzvf goaccess-1.9.3.tar.gz
cd goaccess-1.9.3/
./configure --prefix= --enable-debug --enable-utf8 --enable-geoip=mmdb --with-getline --with-openssl
make
make install

Just tried this on AL9, they must have GoAccess somewhere else.

Removed the package that was from EPEL.

And then installed GoAccess 1.9.4, but the graphs are still showing 1.9.3.

Weird.

But that is besides the logrotate issue.

63
Information / Re: Goaccess stopped working
« on: April 16, 2025, 08:22:25 PM »
What do your /etc/goaccess/goaccess.conf look like?

Just looked at the before and all the lines aren't active (have # in front)

64
Information / Re: Goaccess stopped working
« on: April 16, 2025, 08:06:16 PM »
Already in there, here is our logrotate.conf, which is the default one created by CWP.

Quote
# see "man logrotate" for details

# global options do not affect preceding include directives

# rotate log files weekly
weekly

# keep 4 weeks worth of backlogs
rotate 4

# create new (empty) log files after rotating old ones
create

# use date as a suffix of the rotated file
dateext

# uncomment this if you want your log files compressed
#compress

# packages drop log rotation information into this directory
include /etc/logrotate.d

# system-specific logs may be also be configured here.

Just noticed the rotate didn't run last night like it should have either, but did the previous night.

65
CentOS-WebPanel GUI / Re: Email ids and forwards
« on: April 15, 2025, 11:17:10 AM »
If you want mail to save to the email address and also be forwarded, you have to set that thru RoundCube.

It can't be done via the control panel.

66
I agree with what @overseer @natino posted.

CWP's licensing server is somewhere in France I think.

Clear out your csf.deny temporarily, and then run sh /scripts/update_cwp

If it comes back, then you know something is blocked.

67
Information / Re: Goaccess stopped working
« on: April 15, 2025, 11:07:16 AM »
@overseer

Look like it is working, but it's doing filenames like:

elrepo.nl.ssimn.org.log.1.gz
elrepo.nl.ssimn.org.log.2.gz


What am I missing that it not assigning the date?

Thanks

68
Information / Re: Goaccess stopped working
« on: April 14, 2025, 03:13:43 AM »
Well it did something weird on AL9, says it ran, but the report for 2025-04-13 is missing, and all the logs have been reset that are in /usr/local/apache/domlogs/

Do have:
domain.com.error.log
domain.com.log
domain.bytes

But nothing showing a date afterwards showing it rotated.

69
Information / Re: Goaccess stopped working
« on: April 13, 2025, 01:17:30 PM »
FYI

AL9 has:
 goaccess                    x86_64                    1.9.3-2.el9                    @epel                    1.4 M

Just created the http conf, will let you know how it goes.

70
Updates / Re: Server updates don't seem to be happening
« on: April 10, 2025, 09:35:19 PM »
0.9.8.1201 came out on 2025-03-26

72
Mod_Security / OWASP CRS 4.13.0 Just Release
« on: March 31, 2025, 04:44:56 PM »
FYI - The OWASP CRS ruleset 4.13.0 was just released about an hour ago.

https://github.com/coreruleset/coreruleset/releases/tag/v4.13.0

73
Apache / Re: How to stop malicious scans
« on: March 31, 2025, 01:25:51 AM »
OK, it's done.
Let me know if anyone find any bugs, it is kinda late.

https://starburst.help/security/modsecuirty/custom-modules-modsecurity/bad-bots-module-for-modsecurity/

74
Apache / Re: How to stop malicious scans
« on: March 31, 2025, 12:32:12 AM »
I'm going to post a article on how to do this with ModSecurity.

It should block all bad bots and website scrappers.

75
It was a generic post, saying migration is working.

Make sure you have port 2304 open incoming & outgoing.

If that doesn't work, and I hate saying this ever, disable CSF on both servers and try to connect.

If it connects, you have an issue with one of the firewalls.

Pages: 1 ... 3 4 [5] 6 7 ... 95