Re: Apache Server Ended abnormally - What happened?

[Jim Franz <franz9000@xxxxxxxxx>]

there are more than a few posts on C2M1601
DUMP TAKEN FOR UNMONITORED ESCAPE MESSAGE
.MESSAGE ID- C2M1601
.MESSAGE FILE- QC2MSGF                LIBRARY- *LIBL

several relate to 3rd party products if you are using those..

Jim

On Wed, Aug 28, 2024 at 10:38 AM Jim Franz <franz9000@xxxxxxxxx> wrote:

> do you have the access and error logs turned on? (writes apache logs for
> each access and errors) - our web server is for customers so outward
> facing, with hack attempts all day...don't think its been down in over 2
> decades (which predates Apache on i) but an error entry around dump
> timestamp may give clue. I block some ip ranges mostly east europe... that
> were constantly banging on it.
> I do always keep up with http group ptfs.
>
>                              Work with Object Links
>   Directory  . . . . :   /www/xyz/logs
>
>  Opt   Object link            Type             Attr
>        error_log.Q1240825 >   STMF
>        error_log.Q1240826 >   STMF
>        error_log.Q1240827 >   STMF
>        error_log.Q1240828 >   STMF
>        maint.log              STMF
> [Wed Aug 28 10:15:22.778080 2024] [core:error] [pid 116256:tid 00000096]
> [client 83.97.73.245:41716] ZSRV_MSG0016: URI in request
> [Wed Aug 28 10:15:26.583544 2024] [ibm_ssl:error] [pid 116256:tid
> 00000093] ZSRV_MSG0214: Improperly formated certificate or cert
> [Wed Aug 28 10:15:26.583600 2024] [ibm_ssl:error] [pid 116256:tid
> 00000093] ZSRV_MSG0281: SSL: 190.242.0.226.
> [Wed Aug 28 10:15:27.125648 2024] [ibm_ssl:error] [pid 116256:tid
> 0000009A] ZSRV_MSG0214: Improperly formated certificate or cert
> [Wed Aug 28 10:15:27.125688 2024] [ibm_ssl:error] [pid 116256:tid
> 0000009A] ZSRV_MSG0281: SSL: 190.242.0.226.
> [Wed Aug 28 10:16:29.256104 2024] [ibm_ssl:error] [pid 116256:tid
> 00000096] ZSRV_MSG0214: Improperly formated certificate or cert
> [Wed Aug 28 10:16:29.256136 2024] [ibm_ssl:error] [pid 116256:tid
> 00000096] ZSRV_MSG0281: SSL: 190.242.0.226.
> [Wed Aug 28 10:20:53.932848 2024] [ibm_ssl:error] [pid 116256:tid
> 0000009A] ZSRV_MSG0214: Improperly formated certificate or cert
> [Wed Aug 28 10:20:53.932912 2024] [ibm_ssl:error] [pid 116256:tid
> 0000009A] ZSRV_MSG0281: SSL: 162.204.46.81.
>
> (what we don't have is a sophisticated firewall...)
>
> Jim Franz
>
> On Wed, Aug 28, 2024 at 9:21 AM Gavin Inman <midrangelist@xxxxxxxxxxxxxx>
> wrote:
>
> > Yesterday, we had one of our web servers end abnormally for no reason.
> > This server has had no issues for at least 2 years...
> >
> > Any ideas what this means?
> >
> > Any Advice would be appreciated.
> >
> > Gavin Inman
> >
> > 5770SS1 V7R4M0  190621 DUMP                   08/27/24         PAGE
> >
> > DUMP TAKEN FOR UNMONITORED ESCAPE MESSAGE
> >
> > .MESSAGE ID- C2M1601
> >
> > .MESSAGE FILE- QC2MSGF                LIBRARY- *LIBL
> >
> > .SEVERITY- 50
> >
> > .MSGTYPE- 0F
> >
> > .SENDING-
> >
> > ..PROGRAM- QC2UTIL1
> >
> > LIBRARY- QSYS
> >
> > ..MODULE- QC2SIGNL
> >
> > ..PROCEDURE- raise
> >
> > ..STATEMENT- 0000000006
> >
> > .RECEIVING-
> >
> > ..PROGRAM- QZSRAAU                LIBRARY- QHTTPSVR
> >
> > ..MODULE- QZSRAAU
> >
> > ..PROCEDURE- aau_swap2qtmhhtp1
> >
> > ..STATEMENT- 0000000036
> >
> > .MESSAGE-
> >
> >    Signal SIGABRT raised (abnormal termination).
> >
> >
> >
> > --
> > This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
> > list
> > To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
> > To subscribe, unsubscribe, or change list options,
> > visit: https://lists.midrange.com/mailman/listinfo/midrange-l
> > or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
> > Before posting, please take a moment to review the archives
> > at https://archive.midrange.com/midrange-l.
> >
> > Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related
> > questions.