[ SOLVED ] awstats problem

[victor531]

Hi,
Now I have a strange problem with awstats.

I have 3 domains in my server, domain1.com, domain2.com and domain3.com.

To see the statistics I just have to go to domain1.com/stats/ and it requires a user and password, and then it should show me the statistics from awstats, but the strange thing in this case is that it only happens when I enter to the domain2.com, while domain1.com and domain3.com goes to an error 500 after I've entered the username and the password.

in /var/cache/awstats there are this files
awstats032009.domain1.com.txt
awstats032009.domain2.com.txt
awstats032009.domain3.com.txt
and also exist
dnscachelastupdate.domain1.com.txt ( domain2 and domain3)

in /var/log/apache2/error.log there is nothing

In protected areas of each domain exist the user and group, and also in var/www/virtual/domain1...3 the .htacces files for the group and pass exist.

Any ideas how to solve it ?

Victor

debian Lenny
Ispcp 1.00 stable
test server
3 domain

[sci2tech]

1. Try rebuild configs
2. Try manually update awstats file (see in /etc/cron.d/ispcp what command to use)
3. Try add / remove user from statistics group

[victor531]

Thanks sci2tech for your fast answer

Quote:1. Try rebuild configs

done... still error 500

Quote:2. Try manually update awstats file (see in /etc/cron.d/ispcp what command to use)

Please tell me how can I do it? here is my cron
{AW-ENABLED}15 */6 * * * root {AWSTATS_ROOT_DIR}/awstats_updateall.pl now -awstatsprog={AWSTATS_ENGINE_DIR}/awstats.pl >/dev/null 2>&1

Quote:3. Try add / remove user from statistics group

I did it .... and nothing
after that I've removed domain1.com, and I newly readded it ...and nothing again... still error 500

Thanks in advance

victor

[sci2tech]

Your cron is messed up. Replace all {var} with values from /etc/ispcp/ispcp.conf. As example Awstats line should look like

Code:

# AWStats
15      */6     *       *       *       root /var/www/ispcp/engine/awstats/awstats_updateall.pl now -awstatsprog=/usr/lib/cgi-bin/awstats.pl >/dev/null 2>&1

To manually run it, as root

Code:

/var/www/ispcp/engine/awstats/awstats_updateall.pl now -awstatsprog=/usr/lib/cgi-bin/awstats.pl >/dev/null 2>&1

[victor531]

thanks sci2tech.

With those changes 4 out of 5 domains work fine, but the first domain is still with error 500.

I have deleted and recreated this domain twice without results.

where can I see the logs ?, because aparently everything is OK.

Thanks again


Victor

[sci2tech]

Logs are for domains in /var/logs/apache2/users/domain-error.log. Master errors are in /var/logs/apache2/users/default-error.log

[victor531]

sci2tech, in /var/logs/apache2/users/default-error.log

error] [client 127.0.0.1] ModSecurity: Access denied with code 500 (phase 2). Pattern match "\\.(?:c(?:o(?:nf(?:ig)?|m)|s(?:proj|r)?|dx|er|fg|md)|p(?:rinter|ass|db|ol|wd)|v(​?:b(?:proj|s)?|sdisco)|a(?:s(?:ax?|cx)|xd)|d(?:bf?|at|ll|os)|i(?[acq]|n[ci])|ba(?:[kt]|ckup)|res(?:ources|x)|s(?:h?tm|ql|ys)|l(?:icx|nk|og)|\\w{0,5}~|webinfo|ht[rw]|xs[dx]| ..." at REQUEST_BASENAME. [file "/etc/modsecurity2/modsecurity_crs_30_http_policy.conf"] [line "94"] [id "960035"] [msg "URL file extension is restricted by policy"] [severity "CRITICAL"] [tag "POLICY/EXT_RESTRICTED"] [hostname "localhost"] [uri "/awstats/domain1.com"] [unique_id "SbVCFsCoAgQAABHQDkAAAAAJ"]

error] [client 127.0.0.1] ModSecurity: Access denied with code 500 (phase 2). Pattern match "\\.(?:c(?:o(?:nf(?:ig)?|m)|s(?:proj|r)?|dx|er|fg|md)|p(?:rinter|ass|db|ol|wd)|v(​?:b(?:proj|s)?|sdisco)|a(?:s(?:ax?|cx)|xd)|d(?:bf?|at|ll|os)|i(?[acq]|n[ci])|ba(?:[kt]|ckup)|res(?:ources|x)|s(?:h?tm|ql|ys)|l(?:icx|nk|og)|\\w{0,5}~|webinfo|ht[rw]|xs[dx]| ..." at REQUEST_BASENAME. [file "/etc/modsecurity2/modsecurity_crs_30_http_policy.conf"] [line "94"] [id "960035"] [msg "URL file extension is restricted by policy"] [severity "CRITICAL"] [tag "POLICY/EXT_RESTRICTED"] [hostname "localhost"] [uri "/awstats/domain1.com"] [unique_id "SbVCFsCoAgQAABHQDkIAAAAL"]

error] [client 127.0.0.1] ModSecurity: Access denied with code 500 (phase 2). Pattern match "\\.(?:c(?:o(?:nf(?:ig)?|m)|s(?:proj|r)?|dx|er|fg|md)|p(?:rinter|ass|db|ol|wd)|v(​?:b(?:proj|s)?|sdisco)|a(?:s(?:ax?|cx)|xd)|d(?:bf?|at|ll|os)|i(?[acq]|n[ci])|ba(?:[kt]|ckup)|res(?:ources|x)|s(?:h?tm|ql|ys)|l(?:icx|nk|og)|\\w{0,5}~|webinfo|ht[rw]|xs[dx]| ..." at REQUEST_BASENAME. [file "/etc/modsecurity2/modsecurity_crs_30_http_policy.conf"] [line "94"] [id "960035"] [msg "URL file extension is restricted by policy"] [severity "CRITICAL"] [tag "POLICY/EXT_RESTRICTED"] [hostname "localhost"] [uri "/awstats/domain1.com"] [unique_id "SbVF9sCoAgQAABHQDkgAAAAP"]


In /var/logs/apache2/users/domain-error.log
[error] [client 192.168.2.3] File does not exist: /var/www/virtual/kari.com/htdocs/favicon.ico
[error] [client 192.168.2.3] File does not exist: /var/www/virtual/kari.com/htdocs/favicon.ico

kari.com shows the statistics OK and Domain1.com can not be seen ( just error 500).

How can I understand this? why do some domain have problems and other don't?.....Perhaps it is for the mod security in apache ?

Would you help me to understand it ?

Victor

[sci2tech]

It is a mod_security issue. And somehow it match one role for denying. You should check / correct those rule.

[victor531]

Thanks a lot sci2tech, I've just comment the rule and everything is fine

+1 4you
Victor

[sci2tech]

Glad to help