Proxmox 4 Web server Hangs up

[Dan Mor]

Hello, all was working fine, but for now my proxmox web interface hangs... browser shows infinite page loading...
All VM guests are continuing working properly.
Rebooting of node through terminal doesn't change anything.

What it could be? How investigate the problem?

 

[El Muchacho]

Did u changed the IP(s) of the vmbr interface(s)?
In that case: Don't forget to change them in /etc/hosts too

Looks like the web interface is using this entry.

 

[Dan Mor]

No, I have not changed any network settings..

 

[dietmar]

Does it help if you clear the browser cache?

 

[Dan Mor]

lol, no of course. I mean no matter what browser - I was trying to access webinterface from different sources, even from guest VM machine - effect is the same

 

[Dan Mor]

Here is it http://151.80.109.169:8006

 

[dietmar]

Is there a firewall?

 

[Dan Mor]

No

 

[dietmar]

Any hint in /var/log/syslog, or /var/log/pveproxy/access.log?

 

[Dan Mor]

Yes!!

There is a hint in /var/log/syslog: " unable to open log file '/var/log/pveproxy/access.log' - Permission denied "

Jan 19 02:28:09 MyServer pveproxy[2666]: starting 2 worker(s)
Jan 19 02:28:09 MyServer pveproxy[2666]: worker 14944 started
Jan 19 02:28:09 MyServer pveproxy[2666]: worker 14945 started
Jan 19 02:28:09 MyServer pveproxy[14944]: unable to open log file '/var/log/pveproxy/access.log' - Permission denied
Jan 19 02:28:09 MyServer pveproxy[14945]: unable to open log file '/var/log/pveproxy/access.log' - Permission denied
Jan 19 02:28:09 MyServer kernel: [44837.914757] audit: type=1400 audit(1453163289.834:207): apparmor="DENIED" operation="sendmsg" profile="/usr/sbin/named" name="/run/systemd/journal/dev-log" pid=1287 comm="named" requested_mask="w" denied_mask="w" fsuid=109 ouid=0
Jan 19 02:28:09 MyServer kernel: [44837.916532] audit: type=1400 audit(1453163289.842:208): apparmor="DENIED" operation="sendmsg" profile="/usr/sbin/named" name="/run/systemd/journal/dev-log" pid=1292 comm="named" requested_mask="w" denied_mask="w" fsuid=109 ouid=0
Jan 19 02:28:09 MyServer kernel: [44838.021775] audit: type=1400 audit(1453163289.946:209): apparmor="DENIED" operation="sendmsg" profile="/usr/sbin/named" name="/run/systemd/journal/dev-log" pid=1291 comm="named" requested_mask="w" denied_mask="w" fsuid=109 ouid=0
Jan 19 02:28:10 MyServer spiceproxy[14942]: worker exit
Jan 19 02:28:10 MyServer spiceproxy[1479]: worker 14942 finished
Jan 19 02:28:10 MyServer spiceproxy[1479]: starting 1 worker(s)
Jan 19 02:28:10 MyServer spiceproxy[1479]: worker 14957 started
Jan 19 02:28:10 MyServer spiceproxy[14957]: unable to open log file '/var/log/pveproxy/access.log' - Permission denied

And for some reason owner of /var/log/pveproxy/ folder is www-data. Is it normal?

And last logs in /var/log/pveproxy/access.log are:

95.213.177.122 - - [22/Dec/2015:09:02:41 +0200] "POST http://check.proxyradar.com/azenv.php?auth=145076776167&a=PSCMN&i=2538630569&p=3128 HTTP/1.1" 501 -
61.160.213.56 - - [22/Dec/2015:09:03:38 +0200] "GET http://zc.qq.com/cgi-bin/chs/numreg/init? HTTP/1.0" 501 -
188.68.224.62 - - [22/Dec/2015:09:21:59 +0200] "GET http://51.254.206.142/httptest.php HTTP/1.1" 501 -
95.213.177.123 - - [22/Dec/2015:13:15:57 +0200] "POST http://check.proxyradar.com/azenv.php?auth=145078295665&a=PSCMN&i=2538630569&p=3128 HTTP/1.1" 501 -
188.68.224.62 - - [22/Dec/2015:14:26:09 +0200] "GET http://51.254.206.142/httptest.php HTTP/1.1" 501 -
188.68.224.62 - - [22/Dec/2015:14:26:17 +0200] "GET http://51.254.206.142/httptest.php HTTP/1.1" 501 -
188.68.224.62 - - [22/Dec/2015:17:06:18 +0200] "GET http://51.254.206.142/httptest.php HTTP/1.1" 501 -
95.213.177.124 - - [22/Dec/2015:17:34:19 +0200] "POST http://check.proxyradar.com/azenv.php?auth=145079845991&a=PSCMN&i=2538630569&p=3128 HTTP/1.1" 501 -
218.15.128.59 - - [22/Dec/2015:18:44:16 +0200] "CONNECT search.yahoo.com:443 HTTP/1.1" 401 -
188.68.224.62 - - [22/Dec/2015:19:39:29 +0200] "GET http://51.254.206.142/httptest.php HTTP/1.1" 501 -
188.68.224.62 - - [22/Dec/2015:20:16:41 +0200] "GET http://51.254.206.142/httptest.php HTTP/1.1" 501 -
188.68.224.62 - - [22/Dec/2015:20:24:25 +0200] "GET http://51.254.206.142/httptest.php HTTP/1.1" 501 -
188.68.224.62 - - [22/Dec/2015:20:39:52 +0200] "GET http://51.254.206.142/httptest.php HTTP/1.1" 501 -
95.213.177.123 - - [22/Dec/2015:21:56:21 +0200] "POST http://check.proxyradar.com/azenv.php?auth=145081418105&a=PSCMN&i=2538630569&p=3128 HTTP/1.1" 501 -
188.68.224.62 - - [22/Dec/2015:23:17:23 +0200] "GET http://51.254.206.142/httptest.php HTTP/1.1" 501 -
188.68.224.62 - - [22/Dec/2015:23:57:29 +0200] "GET http://51.254.206.142/httptest.php HTTP/1.1" 501 -
66.240.192.138 - - [23/Dec/2015:00:12:45 +0200] "GET / HTTP/1.1" 501 -
66.240.192.138 - - [23/Dec/2015:00:12:45 +0200] "GET /robots.txt HTTP/1.1" 501 -
95.213.177.125 - - [23/Dec/2015:02:14:14 +0200] "POST http://check.proxyradar.com/azenv.php?auth=145082965449&a=PSCMN&i=2538630569&p=3128 HTTP/1.1" 501 -
188.68.224.62 - - [23/Dec/2015:03:39:25 +0200] "GET http://51.254.206.142/httptest.php HTTP/1.1" 501 -
[...]
95.213.177.124 - - [23/Dec/2015:10:53:00 +0200] "POST http://check.proxyradar.com/azenv.php?auth=145086078029&a=PSCMN&i=2538630569&p=3128 HTTP/1.1" 501 -
188.68.224.62 - - [23/Dec/2015:12:56:30 +0200] "GET http://51.254.206.142/httptest.php HTTP/1.1" 501 -
89.248.167.162 - - [23/Dec/2015:14:15:39 +0200] "GET / HTTP/1.0" 501 -
188.68.224.62 - - [23/Dec/2015:15:01:07 +0200] "GET http://51.254.206.142/httptest.php HTTP/1.1" 501 -
95.213.177.122 - - [23/Dec/2015:15:05:52 +0200] "POST http://check.proxyradar.com/azenv.php?auth=145087595277&a=PSCMN&i=2538630569&p=3128 HTTP/1.1" 501 -
188.68.224.62 - - [23/Dec/2015:17:44:00 +0200] "GET http://51.254.206.142/httptest.php HTTP/1.1" 501 -
188.68.224.62 - - [23/Dec/2015:18:13:41 +0200] "GET http://51.254.206.142/httptest.php HTTP/1.1" 501 -
95.213.177.123 - - [23/Dec/2015:19:19:01 +0200] "POST http://check.proxyradar.com/azenv.php?auth=145089114131&a=PSCMN&i=2538630569&p=3128 HTTP/1.1" 501 -
188.68.224.62 - - [23/Dec/2015:20:51:09 +0200] "GET http://51.254.206.142/httptest.php HTTP/1.1" 501 -
188.68.224.62 - - [23/Dec/2015:20:51:14 +0200] "GET http://51.254.206.142/httptest.php HTTP/1.1" 501 -
188.68.224.62 - - [23/Dec/2015:22:51:26 +0200] "GET http://51.254.206.142/httptest.php HTTP/1.1" 501 -
188.68.224.62 - - [23/Dec/2015:23:06:06 +0200] "GET http://51.254.206.142/httptest.php HTTP/1.1" 501 -
188.68.224.62 - - [23/Dec/2015:23:16:59 +0200] "GET http://51.254.206.142/httptest.php HTTP/1.1" 501 -
95.213.177.123 - - [23/Dec/2015:23:36:09 +0200] "POST http://check.proxyradar.com/azenv.php?auth=145090656943&a=PSCMN&i=2538630569&p=3128 HTTP/1.1" 501 -
188.68.224.62 - - [24/Dec/2015:03:13:29 +0200] "GET http://51.254.206.142/httptest.php HTTP/1.1" 501 -
95.213.177.123 - - [24/Dec/2015:03:53:31 +0200] "POST http://check.proxyradar.com/azenv.php?auth=145092201183&a=PSCMN&i=2538630569&p=3128 HTTP/1.1" 501 -
188.68.224.62 - - [24/Dec/2015:04:10:57 +0200] "GET http://51.254.206.142/httptest.php HTTP/1.1" 501 -
95.213.177.122 - - [24/Dec/2015:08:07:04 +0200] "POST http://check.proxyradar.com/azenv.php?auth=145093722437&a=PSCMN&i=2538630569&p=3128 HTTP/1.1" 501 -
188.68.224.62 - - [24/Dec/2015:08:39:42 +0200] "GET http://51.254.206.142/httptest.php HTTP/1.1" 501 -
188.68.224.62 - - [24/Dec/2015:08:49:53 +0200] "GET http://51.254.206.142/httptest.php HTTP/1.1" 501 -
115.28.14.62 - - [24/Dec/2015:12:10:44 +0200] "CONNECT search.yahoo.com:443 HTTP/1.1" 401 -
[...]
95.213.177.124 - - [27/Dec/2015:08:56:03 +0200] "POST http://check.proxyradar.com/azenv.php?auth=145119936363&a=PSCMN&i=2538630569&p=3128 HTTP/1.1" 501 -
62.210.181.163 - - [27/Dec/2015:12:15:39 +0200] "GET / HTTP/1.1" 501 -
95.213.177.126 - - [27/Dec/2015:13:07:47 +0200] "POST http://check.proxyradar.com/azenv.php?auth=145121446793&a=PSCMN&i=2538630569&p=3128 HTTP/1.1" 501 -
95.213.177.126 - - [27/Dec/2015:17:20:57 +0200] "POST http://check.proxyradar.com/azenv.php?auth=145122965731&a=PSCMN&i=2538630569&p=3128 HTTP/1.1" 501 -
95.213.177.125 - - [27/Dec/2015:21:44:32 +0200] "POST http://check.proxyradar.com/azenv.php?auth=145124547209&a=PSCMN&i=2538630569&p=3128 HTTP/1.1" 501 -
95.213.177.126 - - [28/Dec/2015:02:01:28 +0200] "POST http://check.proxyradar.com/azenv.php?auth=145126088819&a=PSCMN&i=2538630569&p=3128 HTTP/1.1" 501 -
95.213.177.126 - - [28/Dec/2015:06:28:18 +0200] "POST http://check.proxyradar.com/azenv.php?auth=145127689867&a=PSCMN&i=2538630569&p=3128 HTTP/1.1" 501 -
95.213.177.124 - - [28/Dec/2015:10:43:49 +0200] "POST http://check.proxyradar.com/azenv.php?auth=145129222915&a=PSCMN&i=2538630569&p=3128 HTTP/1.1" 501 -
120.76.76.136 - - [28/Dec/2015:10:58:28 +0200] "CONNECT search.yahoo.com:443 HTTP/1.1" 401 -
95.213.177.122 - - [28/Dec/2015:14:50:39 +0200] "POST http://check.proxyradar.com/azenv.php?auth=145130703997&a=PSCMN&i=2538630569&p=3128 HTTP/1.1" 501 -
95.213.177.122 - - [28/Dec/2015:18:57:16 +0200] "POST http://check.proxyradar.com/azenv.php?auth=145132183603&a=PSCMN&i=2538630569&p=3128 HTTP/1.1" 501 -
95.213.177.122 - - [28/Dec/2015:23:11:44 +0200] "POST http://check.proxyradar.com/azenv.php?auth=145133710405&a=PSCMN&i=2538630569&p=3128 HTTP/1.1" 501 -
95.213.177.123 - - [29/Dec/2015:03:16:58 +0200] "POST http://check.proxyradar.com/azenv.php?auth=145135181825&a=PSCMN&i=2538630569&p=3128 HTTP/1.1" 501 -
185.25.151.159 - - [29/Dec/2015:03:25:11 +0200] "GET http://testp4.pospr.waw.pl/testproxy.php HTTP/1.1" 501 -
95.213.177.124 - - [29/Dec/2015:07:31:46 +0200] "POST http://check.proxyradar.com/azenv.php?auth=145136710621&a=PSCMN&i=2538630569&p=3128 HTTP/1.1" 501 -
95.213.177.122 - - [29/Dec/2015:16:15:33 +0200] "POST http://check.proxyradar.com/azenv.php?auth=145139853369&a=PSCMN&i=2538630569&p=3128 HTTP/1.1" 501 -

there are no my IPs ! Someone trying t hack me?

 

[dietmar]

The files should have the following permissions/owner:

# ls -al /var/log/pveproxy/
total 252
drwx------  2 www-data www-data  4096 Jan 17 06:25 .
drwxr-xr-x 16 root     root      4096 Jan 19 06:25 ..
-rw-r-----  1 www-data www-data     0 Jan 17 06:25 access.log

 

[dietmar]

there are no my IPs ! Someone trying t hack me?

You should run a firewall to block unwanted access.

 

[Dan Mor]

The files should have the following permissions/owner:

drwx------  2 www-data www-data  4096 Jan 17 06:25 .

thanks for this info, I had just drw... without execute. I added execute permission to folder, ad web interface started working!!!

But still have questions:
1. Why it needed to have execute right? There is just need to be a permission to write?
I also noticed, that I cant see files in that folder from another user of group www-data, while I have not execute rights! Read&write files for some reason are not enough..

2. Why it was working properly in the past? I never changes rights of that folder...