{"action":"created","issue":{"url":"https://api.github.com/repos/mrash/psad/issues/22","labels_url":"https://api.github.com/repos/mrash/psad/issues/22/labels{/name}","comments_url":"https://api.github.com/repos/mrash/psad/issues/22/comments","events_url":"https://api.github.com/repos/mrash/psad/issues/22/events","html_url":"https://github.com/mrash/psad/issues/22","id":91946519,"number":22,"title":"whois alarm causing reboots in OpenRC","user":{"login":"itoffshore","id":1141947,"avatar_url":"https://avatars.githubusercontent.com/u/1141947?v=3","gravatar_id":"","url":"https://api.github.com/users/itoffshore","html_url":"https://github.com/itoffshore","followers_url":"https://api.github.com/users/itoffshore/followers","following_url":"https://api.github.com/users/itoffshore/following{/other_user}","gists_url":"https://api.github.com/users/itoffshore/gists{/gist_id}","starred_url":"https://api.github.com/users/itoffshore/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/itoffshore/subscriptions","organizations_url":"https://api.github.com/users/itoffshore/orgs","repos_url":"https://api.github.com/users/itoffshore/repos","events_url":"https://api.github.com/users/itoffshore/events{/privacy}","received_events_url":"https://api.github.com/users/itoffshore/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-06-30T01:02:12Z","updated_at":"2015-07-04T15:51:21Z","closed_at":null,"body":"In [Alpine Linux](http://alpinelinux.org/) with `ENABLE_WHOIS_LOOKUPS        Y;` whois alarms are causing [OpenRC](https://wiki.gentoo.org/wiki/Project:OpenRC) to reboot:\r\n```\r\nroot@kvm-wall [~]# tail /var/log/psad/errs/*\r\n\r\n==> /var/log/psad/errs/psad.die <==\r\nMon Jun 29 17:08:31 2015 psad v2.4.1 pid: 1966 whois alarm at /usr/sbin/psad line 7382, <$fwdata_fh> line 5.\r\nMon Jun 29 17:46:58 2015 psad v2.4.1 pid: 1807 whois alarm at /usr/sbin/psad line 7382, <$fwdata_fh> line 14.\r\nMon Jun 29 20:56:31 2015 psad v2.4.1 pid: 3004 whois alarm at /usr/sbin/psad line 7382, <$fwdata_fh> line 13.\r\nMon Jun 29 23:54:07 2015 psad v2.4.1 pid: 3118 whois alarm at /usr/sbin/psad line 7382, <$fwdata_fh> line 1.\r\n\r\n==> /var/log/psad/errs/psad.warn <==\r\nMon Jun 29 17:08:31 2015 psad v2.4.1 pid: 1966 whois alarm at /usr/sbin/psad line 7382, <$fwdata_fh> line 5.\r\nMon Jun 29 17:46:58 2015 psad v2.4.1 pid: 1807 whois alarm at /usr/sbin/psad line 7382, <$fwdata_fh> line 14.\r\nMon Jun 29 20:56:31 2015 psad v2.4.1 pid: 3004 whois alarm at /usr/sbin/psad line 7382, <$fwdata_fh> line 13.\r\nMon Jun 29 23:54:07 2015 psad v2.4.1 pid: 3118 whois alarm at /usr/sbin/psad line 7382, <$fwdata_fh> line 1.\r\n\r\nroot@kvm-wall [~]# grep -B 1 \"kern.notice kernel: klogd: exiting\" /var/log/messages\r\nJun 29 17:08:31 kvm-wall daemon.info init: starting pid 2063, tty '': '/sbin/rc shutdown'\r\nJun 29 17:08:31 kvm-wall kern.notice kernel: klogd: exiting\r\n--\r\nJun 29 17:46:58 kvm-wall daemon.info init: starting pid 1863, tty '': '/sbin/rc shutdown'\r\nJun 29 17:46:58 kvm-wall kern.notice kernel: klogd: exiting\r\n--\r\nJun 29 20:56:31 kvm-wall daemon.info init: starting pid 3052, tty '': '/sbin/rc shutdown'\r\nJun 29 20:56:31 kvm-wall kern.notice kernel: klogd: exiting\r\n--\r\nJun 29 23:54:07 kvm-wall daemon.info init: starting pid 3189, tty '': '/sbin/rc shutdown'\r\nJun 29 23:54:07 kvm-wall kern.notice kernel: klogd: exiting\r\n```\r\nThe BusyBox `whois` options are as follows:\r\n```\r\nroot@kvm-wall [~]# whois --help\r\nBusyBox v1.23.2 (2015-04-24 16:34:36 GMT) multi-call binary.\r\n\r\nUsage: whois [-h SERVER] [-p PORT] NAME...\r\n\r\nQuery WHOIS info about NAME\r\n\r\n\t-h,-p\tServer to query\r\n```\r\n**In the above logs `whois` lookups were disabled for the 3 hours between 9pm & midnight.**\r\n\r\n`psad --debug` :\r\n```\r\nLinux (removed) 3.18.14-1-grsec #2-Alpine SMP Mon May 25 07:19:17 GMT 2015 i686 Linux\r\n\r\n[+] perl info:\r\n[+] run_command(): perl -V\r\nSummary of my perl5 (revision 5 version 20 subversion 2) configuration:\r\n   \r\n  Platform:\r\n    osname=linux, osvers=3.10.33-0-grsec, archname=i686-linux-thread-multi\r\n    uname='linux build-3-2-x86 3.10.33-0-grsec #1-alpine smp fri mar 7 14:24:31 utc 2014 i686 linux '\r\n    config_args='-des -Dcccdlflags=-fPIC -Dcccdlflags=-fPIC -Dccdlflags=-rdynamic -Dprefix=/usr -Dprivlib=/usr/share/perl5/core_perl -Darchlib=/usr/lib/perl5/core_perl -Dvendorprefix=/usr -Dvendorlib=/usr/share/perl5/vendor_perl -Dvendorarch=/usr/lib/perl5/vendor_perl -Dsiteprefix=/usr/local -Dsitelib=/usr/local/share/perl5/site_perl -Dsitearch=/usr/local/lib/perl5/site_perl -Dlocincpth=  -Doptimize=-Os -fomit-frame-pointer -Duselargefiles -Dusethreads -Duseshrplib -Dd_semctl_semun -Dman1dir=/usr/share/man/man1 -Dman3dir=/usr/share/man/man3 -Dinstallman1dir=/usr/share/man/man1 -Dinstallman3dir=/usr/share/man/man3 -Dman1ext=1 -Dman3ext=3pm -Dinc_version_list= -Dcf_by=Alpine -Ud_csh -Dusenm'\r\n    hint=recommended, useposix=true, d_sigaction=define\r\n    useithreads=define, usemultiplicity=define\r\n    use64bitint=undef, use64bitall=undef, uselongdouble=undef\r\n    usemymalloc=n, bincompat5005=undef\r\n  Compiler:\r\n    cc='cc', ccflags ='-D_REENTRANT -D_GNU_SOURCE -fwrapv -fno-strict-aliasing -pipe -fstack-protector -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64',\r\n    optimize='-Os -fomit-frame-pointer',\r\n    cppflags='-D_REENTRANT -D_GNU_SOURCE -fwrapv -fno-strict-aliasing -pipe -fstack-protector'\r\n    ccversion='', gccversion='4.9.2', gccosandvers=''\r\n    intsize=4, longsize=4, ptrsize=4, doublesize=8, byteorder=1234\r\n    d_longlong=define, longlongsize=8, d_longdbl=define, longdblsize=12\r\n    ivtype='long', ivsize=4, nvtype='double', nvsize=8, Off_t='off_t', lseeksize=8\r\n    alignbytes=4, prototype=define\r\n  Linker and Libraries:\r\n    ld='cc', ldflags =' -fstack-protector -L/usr/local/lib'\r\n    libpth=/usr/include/fortify /usr/lib /usr/local/lib /lib\r\n    libs=-ldl -lm -lcrypt -lutil -lpthread -lc\r\n    perllibs=-ldl -lm -lcrypt -lutil -lpthread -lc\r\n    libc=/usr/lib/libc.a, so=so, useshrplib=true, libperl=libperl.so\r\n    gnulibc_version=''\r\n  Dynamic Linking:\r\n    dlsrc=dl_dlopen.xs, dlext=so, d_dlsymun=undef, ccdlflags='-rdynamic -Wl,-rpath,/usr/lib/perl5/core_perl/CORE'\r\n    cccdlflags='-fPIC', lddlflags='-shared -Os -fomit-frame-pointer -L/usr/local/lib -fstack-protector'\r\n\r\nCharacteristics of this binary (from libperl): \r\n  Compile-time options: HAS_TIMES MULTIPLICITY PERLIO_LAYERS\r\n                        PERL_DONT_CREATE_GVSV\r\n                        PERL_HASH_FUNC_ONE_AT_A_TIME_HARD\r\n                        PERL_IMPLICIT_CONTEXT PERL_MALLOC_WRAP\r\n                        PERL_NEW_COPY_ON_WRITE PERL_PRESERVE_IVUV\r\n                        USE_ITHREADS USE_LARGE_FILES USE_LOCALE\r\n                        USE_LOCALE_COLLATE USE_LOCALE_CTYPE\r\n                        USE_LOCALE_NUMERIC USE_PERLIO USE_PERL_ATOF\r\n                        USE_REENTRANT_API\r\n```\r\n\r\nIs there any other information I can provide to help solve this issue ?"},"comment":{"url":"https://api.github.com/repos/mrash/psad/issues/comments/118525417","html_url":"https://github.com/mrash/psad/issues/22#issuecomment-118525417","issue_url":"https://api.github.com/repos/mrash/psad/issues/22","id":118525417,"user":{"login":"mrash","id":380228,"avatar_url":"https://avatars.githubusercontent.com/u/380228?v=3","gravatar_id":"","url":"https://api.github.com/users/mrash","html_url":"https://github.com/mrash","followers_url":"https://api.github.com/users/mrash/followers","following_url":"https://api.github.com/users/mrash/following{/other_user}","gists_url":"https://api.github.com/users/mrash/gists{/gist_id}","starred_url":"https://api.github.com/users/mrash/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mrash/subscriptions","organizations_url":"https://api.github.com/users/mrash/orgs","repos_url":"https://api.github.com/users/mrash/repos","events_url":"https://api.github.com/users/mrash/events{/privacy}","received_events_url":"https://api.github.com/users/mrash/received_events","type":"User","site_admin":false},"created_at":"2015-07-04T15:51:21Z","updated_at":"2015-07-04T15:51:21Z","body":"As for the whois issue, the log messages like \"psad v2.4.1 pid: 1966 whois alarm\" just indicate that the whois process took too long to produce data, so the alarm timer when off. The timer is defined by the WHOIS_TIMEOUT variable in psad.conf. There used to be an issue with psad creating zombie processes when the timer expired, but this was fixed in psad-2.2.4. Are there any zombie whois processes on your system? Also, psad installs a different whois binary at /usr/bin/whois_psad instead of using the system default. Is see the timestamps above that seem to correlate with failed whois lookups and system reboots. I'll need to set up an Alpine VM to try and reproduce this - definitely strange that userspace whois lookups seem to cause the entire system to reboot."}}