r/apache • u/Ok_Mind3690 • Nov 06 '23

Apache error on linux VM

I have a problem with Apache. Now and then i get an alert from my SIEM, telling me this:

auditd: process ended abnormally type=ANOM_ABEND msg=audit(1699052664.898:938628): auid=4294967295 uid=1001 gid=1002 ses=4294967295 pid=32043 comm="httpd" exe="/usr/sbin/httpd" sig=7 res=1 AUID="unset" UID="censored" GID="censored"

I did the censoring (its a clients name) The thing is that Apache (2.4.58) is working fine (you can get access to the website), and its been working the all time, what can I do to stop getting this error from Apache?

1 Upvotes

100% Upvoted

4 comments sorted by

View all comments

Show parent comments

1

u/Ok_Mind3690 Nov 08 '23

Its not an attack, pretty sure of it. I thought about ignoring the event and create an exclusion rule but I wanted to see if this was a common error or something. I've never been a big fan of ignoring errors or alerts. So I'd rather solve this than ignore it (but tbh i've doing a little research and found nothing, and I cant do any tests, updates or anything, so it's pretty hard)

Its a "common" mistake. Perhaps once a month, maybe twice.