Detected process that is running outdated executables

[PeteS]

Hello,

I periodically get this notification, and have assumed (correctly, apparently) that it's associated with package updates, and *seems to be* self-correcting. But I have a frustration with this...

Scenario:
1- I get a high priority notification, but it *only has a PID* (big help that is)
2- I check Security Advisor, it shows all is well
3- I SSH in and try to PS the PID, it's no longer active
(No matter how soon, a minute or two if possible, that I check, I never see any issue.)
4- I ask myself *why* doesn't it also list the executable information associated with the PID?!

Please advise...

-Pete

 

[cPanelLauren]

Hi @PeteS ,

That notification comes from the Security Advisor but it is literally only grabbing pids and outputting them

The following:

 /usr/bin/needs-restarting

should give you the PID and actual process name that's running when the notification is sent (if the process is still running)

The issue I think you ran into is that it sent the notification and the process had been restarted/stopped by the time you'd checked the Security Advisor

Thanks!

 

[PeteS]

The issue I think you ran into is that it sent the notification and the process had been restarted/stopped by the time you'd checked the Security Advisor

Right! That is exactly the issue, the process no longer exists (and thus /usr/bin/needs-restarting doesn't show me anything either).

Wouldn't it make sense to have cPanel incorporate that into the error message, since it's seeing the issue right then, why not report it in a useful manner?

-Pete

 

[cPanelLauren]

Hi @PeteS

I agree it would make it a lot easier to read if the process name was included. This would be something I would like to see as a feature request at cPanel & WHM Feature Requests all our improvement suggestions and new features should be added there. If you do add it (which I hope you do) let us know the Title here and anyone can log in there and vote for it.


Thanks!

 

[PeteS]

Title: Security Advisor notifications should include process name, not just PID

(in review now)

Please up-vote!

-Pete

 

[cPanelLauren]

Hi @PeteS


Could you also include the link for that? I apologize for not requesting it initially.


Thanks!

 

[PeteS]

Hi @PeteS


Could you also include the link for that? I apologize for not requesting it initially.


Thanks!

It's still on moderation awaiting review. I was going to post a link after it was reviewed because I assumed (wrongly?) that it coulsn't be seen or upvoted until approved.

Here's the link: https://features.cpanel.net/topic/s...ions-should-include-process-name-not-just-pid

-Pete

 

[cPanelLauren]

Hi @PeteS

You're right, but this way it's already here, it should come out of moderation soon


Thanks!

 

[PeteS]

Ok, it's approved.

Please upvote it, y'all!

-Pete

 

[cPanelLauren]

Awesome, thanks for letting us know @PeteS I cast my vote!

 

[PeteS]

Almost 5 years later and no fix for what is "stupid easy." Just pull the proc name along with the PID. No? Hey, even just email me the output of /usr/bin/needs-restarting and I'm happy. Maybe I'll write a script and cron it once a day... then I can get notified for DNSOnly servers also, since this and other relevant things were left out of DNSOnly.

This post was brought to you by the following event tonight...

Detected 12 processes that are running outdated executables: 19363 19419 12650 13610 18190 13554 18134 14576 12706 16958 14632 17014 You must take one of the following actions to ensure the system is up-to-date:
* Restart the listed processes.
* Reboot the server.

The first option is a joke. We don't tell you what the processes are, and the PIDs will likely change before you see this. LOL :D

Love, cPanel

If you agree, up-vote: https://features.cpanel.net/topic/s...ions-should-include-process-name-not-just-pid

 

[cPRex]

I'll bring this one up with the team next week!

 

[PeteS]

I'll bring this one up with the team next week!

Thank you!

Something else I've noticed is that on one server it's showing 5 out of date processes when checked from CLI with /usr/bin/needs-restarting but the nightly update runs aren't sending a notice. I let it run this a day a few days before posting this, just to be sure it wasn't a one-time glitch.

It's runing 108, and onother server I just today updated to 108 DID send notice of its (18) outdated processes, so it looks like it's not a108 bug.

It there an occasion where upcp might no cause those notices to go out?

 

[cPRex]

I can't think of a reason for that to happen. If you have a server in that state it might be worth a ticket so we can replicate.

 

[PeteS]

I can't think of a reason for that to happen. If you have a server in that state it might be worth a ticket so we can replicate.

I can do that. It may be a while before I get to it today, but I'll post the ticket number when I do.

 

[PeteS]

Ticket ID: 94536038

 

[cPRex]

Thanks for that - I'm following along with that ticket now.

 

[cPRex]

Our team confirmed that /usr/local/cpanel/bin/needs-restarting-cpanel isn't showing any output on that machine, so if no services need to be manually restarted we don't send a notification.

 

[PeteS]

Our team confirmed that /usr/local/cpanel/bin/needs-restarting-cpanel isn't showing any output on that machine, so if no services need to be manually restarted we don't send a notification.

Note for others:
There are two scripts mentioned in this thread. The first one was referenced 5 years ago (and still works), and the second is the one shows what cPanel would send notices about (a lesser number of items, in this case, none).

# /usr/bin/needs-restarting
# /usr/local/cpanel/bin/needs-restarting-cpanel

cPanel tech explained it this way: "The reason why the notification isn't sent is because we do not use needs-restarting du to soft restarts like HUPed processes for example. We use the /usr/local/cpanel/bin/needs-restarting-cpanel, and it isn't producing any output that a process needs to be hard restarted. This is why the notification sent doesn't include that a process or daemon needs to be restarted."