Re: Apache Server Ended abnormally - What happened?

[Gavin Inman <midrangelist@xxxxxxxxxxxxxx>]

yes, we are seeing a lot of improperly formatted certificate errors at 
times.   However, this is not a public facing server.

On 8/28/2024 10:38 AM, Jim Franz wrote:

do you have the access and error logs turned on? (writes apache logs for
each access and errors) - our web server is for customers so outward
facing, with hack attempts all day...don't think its been down in over 2
decades (which predates Apache on i) but an error entry around dump
timestamp may give clue. I block some ip ranges mostly east europe... that
were constantly banging on it.
I do always keep up with http group ptfs.

                             Work with Object Links
  Directory  . . . . :   /www/xyz/logs

 Opt   Object link            Type             Attr
       error_log.Q1240825 >   STMF
       error_log.Q1240826 >   STMF
       error_log.Q1240827 >   STMF
       error_log.Q1240828 >   STMF
       maint.log              STMF
[Wed Aug 28 10:15:22.778080 2024] [core:error] [pid 116256:tid 00000096]
[client 83.97.73.245:41716] ZSRV_MSG0016: URI in request
[Wed Aug 28 10:15:26.583544 2024] [ibm_ssl:error] [pid 116256:tid 00000093]
ZSRV_MSG0214: Improperly formated certificate or cert
[Wed Aug 28 10:15:26.583600 2024] [ibm_ssl:error] [pid 116256:tid 00000093]
ZSRV_MSG0281: SSL: 190.242.0.226.
[Wed Aug 28 10:15:27.125648 2024] [ibm_ssl:error] [pid 116256:tid 0000009A]
ZSRV_MSG0214: Improperly formated certificate or cert
[Wed Aug 28 10:15:27.125688 2024] [ibm_ssl:error] [pid 116256:tid 0000009A]
ZSRV_MSG0281: SSL: 190.242.0.226.
[Wed Aug 28 10:16:29.256104 2024] [ibm_ssl:error] [pid 116256:tid 00000096]
ZSRV_MSG0214: Improperly formated certificate or cert
[Wed Aug 28 10:16:29.256136 2024] [ibm_ssl:error] [pid 116256:tid 00000096]
ZSRV_MSG0281: SSL: 190.242.0.226.
[Wed Aug 28 10:20:53.932848 2024] [ibm_ssl:error] [pid 116256:tid 0000009A]
ZSRV_MSG0214: Improperly formated certificate or cert
[Wed Aug 28 10:20:53.932912 2024] [ibm_ssl:error] [pid 116256:tid 0000009A]
ZSRV_MSG0281: SSL: 162.204.46.81.

(what we don't have is a sophisticated firewall...)

Jim Franz

On Wed, Aug 28, 2024 at 9:21 AM Gavin Inman<midrangelist@xxxxxxxxxxxxxx>
wrote:

> Yesterday, we had one of our web servers end abnormally for no reason.
> This server has had no issues for at least 2 years...
>
> Any ideas what this means?
>
> Any Advice would be appreciated.
>
> Gavin Inman
>
> 5770SS1 V7R4M0  190621 DUMP                   08/27/24         PAGE
>
> DUMP TAKEN FOR UNMONITORED ESCAPE MESSAGE
>
> .MESSAGE ID- C2M1601
>
> .MESSAGE FILE- QC2MSGF                LIBRARY- *LIBL
>
> .SEVERITY- 50
>
> .MSGTYPE- 0F
>
> .SENDING-
>
> ..PROGRAM- QC2UTIL1
>
> LIBRARY- QSYS
>
> ..MODULE- QC2SIGNL
>
> ..PROCEDURE- raise
>
> ..STATEMENT- 0000000006
>
> .RECEIVING-
>
> ..PROGRAM- QZSRAAU                LIBRARY- QHTTPSVR
>
> ..MODULE- QZSRAAU
>
> ..PROCEDURE- aau_swap2qtmhhtp1
>
> ..STATEMENT- 0000000036
>
> .MESSAGE-
>
>     Signal SIGABRT raised (abnormal termination).
>
>
>
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
> To post a message email:MIDRANGE-L@xxxxxxxxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit:https://lists.midrange.com/mailman/listinfo/midrange-l
> or email:MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> athttps://archive.midrange.com/midrange-l.
>
> Please contactsupport@xxxxxxxxxxxxxxxxxxxx  for any subscription related
> questions.