Apache errors about missing Plack perl modules after upgrade

[Danie de Jager]

Hi,

After upgrading my Sensor this morning I cannot start apache2 anymore on the current release of Security Onion. I've tried to modify the file Web.psgi but even though Apache now starts I cannot open the main page and my Master's ELSA is not showing any recent results (not sure if this is related). I've upgraded my Master without seeing any of these issues.

1. It is looking for Perl modules called Plack::Builder::Conditionals that is not in the @INC location but is located here:
/opt/elsa/perl5/lib/perl5/Plack/Builder/Conditionals.pm.

Error:
[Wed Jul 20 06:17:23.969323 2016] [perl:error] [pid 15082] Error while loading /opt/elsa/web/lib/Web.psgi: Can't locate Plack/Builder/Conditionals.pm in @INC (you may need to install the Plack::Builder::Conditionals module) (@INC contains: /opt/elsa/web/lib /etc/perl /usr/local/lib/perl/5.18.2 /usr/local/share/perl/5.18.2 /usr/lib/perl5 /usr/share/perl5 /usr/lib/perl/5.18 /usr/share/perl/5.18 /usr/local/lib/site_perl . /etc/apache2) at /opt/elsa/web/lib/Web.psgi line 6.\nBEGIN failed--compilation aborted at /opt/elsa/web/lib/Web.psgi line 6.\nBEGIN failed--compilation aborted at /etc/apache2/elsa_startup.pl line 19.\nCompilation failed in require at (eval 2) line 1.\n


2. There is complaints that a module is too old after I hacked Web.psgi.
Error:
[Wed Jul 20 07:42:12.337585 2016] [perl:error] [pid 42963] Error while loading /opt/elsa/web/lib/Web.psgi: List::Util version 1.33 required--this is only version 1.27 at /opt/elsa/perl5/lib/perl5/Package/DeprecationManager.pm line 9.\nBEGIN failed--compilation aborted at /opt/elsa/perl5/lib/perl5/Package/DeprecationManager.pm line 9.\nCompilation failed in require at /opt/elsa/perl5/lib/perl5//x86_64-linux-gnu-thread-multi/Moose/Deprecated.pm line 12.\nBEGIN failed--compilation aborted at /opt/elsa/perl5/lib/perl5//x86_64-linux-gnu-thread-multi/Moose/Deprecated.pm line 12.\nCompilation failed in require at /opt/elsa/perl5/lib/perl5//x86_64-linux-gnu-thread-multi/Moose.pm line 14.\nBEGIN failed--compilation aborted at /opt/elsa/perl5/lib/perl5//x86_64-linux-gnu-thread-multi/Moose.pm line 14.\nCompilation failed in require at /opt/elsa/web/lib/Controller.pm line 2.\nBEGIN failed--compilation aborted at /opt/elsa/web/lib/Controller.pm line 2.\nCompilation failed in require at /opt/elsa/web/lib/Web.psgi line 12.\nBEGIN failed--compilation aborted at /opt/elsa/web/lib/Web.psgi line 12.\nBEGIN failed--compilation aborted at /etc/apache2/elsa_startup.pl line 19.\nCompilation failed in require at (eval 2) line 1.\n


Regards,
Danie de Jager

[Wes]

Danie,

I don't think you would need to modify Web.psgi and I wouldn't go about modifying any perl modules just yet.

Please attach the output of sostat-redacted as a .txt file or by using a service such as Pastebin.com.

Also, have a look in /elsa/data/elsa/log/* and Apache's error log to see if you can find any other clues.

Thanks,
Wes

[Danie de Jager]

Thanks Wes.

Here is the link to the results:
http://pastebin.com/Kit8GmF2

[Wes]

Danie,

I would first try reverting whatever changes you may have made and following the guidance here in regard to ELSA buffers:

https://github.com/Security-Onion-Solutions/security-onion/wiki/FAQ#why-does-sostat-show-a-high-number-of-elsa-buffers-in-queue

Thanks,
Wes