nginx with ModSecurity_2.9.1 . when handle larger post request body, the nginx worker process exited on signal 11.

[herono2010]

i have a nginx worker process coredump, like this :
"
#14147 0x00007f6573128ad7 in ?? () from /lib/x86_64-linux-gnu/libpcre.so.3
#14148 0x00007f6573135a0b in ?? () from /lib/x86_64-linux-gnu/libpcre.so.3
#14149 0x00007f6573128ad7 in ?? () from /lib/x86_64-linux-gnu/libpcre.so.3
#14150 0x00007f6573129a76 in ?? () from /lib/x86_64-linux-gnu/libpcre.so.3
#14151 0x00007f6573128ad7 in ?? () from /lib/x86_64-linux-gnu/libpcre.so.3
#14152 0x00007f657313af41 in pcre_exec () from /lib/x86_64-linux-gnu/libpcre.so.3
#14153 0x000000000049cf10 in msc_regexec_capture ()
#14154 0x00000000004b31e0 in msre_op_rx_execute ()
#14155 0x00000000004acf7d in execute_operator ()
#14156 0x00000000004ae2b7 in msre_ruleset_process_phase ()
#14157 0x0000000000496020 in modsecurity_process_phase ()
#14158 0x0000000000494f4f in hook_request_late ()
#14159 0x000000000048e6bc in modsecProcessRequestBody ()
#14160 0x0000000000484638 in ngx_http_modsecurity_body_handler ()
#14161 0x0000000000445ee4 in ngx_http_do_read_client_request_body ()
#14162 0x00000000004462eb in ngx_http_read_client_request_body_handler ()
#14163 0x000000000043c943 in ngx_http_request_handler ()
#14164 0x0000000000423fcd in ngx_event_process_posted ()
#14165 0x0000000000423bb4 in ngx_process_events_and_timers ()
#14166 0x00000000004299fc in ngx_worker_process_cycle ()
#14167 0x0000000000428466 in ngx_spawn_process ()
#14168 0x0000000000429b55 in ngx_start_worker_processes ()
#14169 0x000000000042a9c8 in ngx_master_process_cycle ()
#14170 0x000000000040d696 in main ()
"

why ???

[AnoopAlias]

It is recommended to use Mod_Sec v3 with Nginx

…

On Fri, Oct 19, 2018 at 5:34 PM herono2010 ***@***.***> wrote: i have a nginx worker process coredump, like this : " #14147 0x00007f6573128ad7 in ?? () from /lib/x86_64-linux-gnu/libpcre.so.3 #14148 0x00007f6573135a0b in ?? () from /lib/x86_64-linux-gnu/libpcre.so.3 #14149 0x00007f6573128ad7 in ?? () from /lib/x86_64-linux-gnu/libpcre.so.3 #14150 0x00007f6573129a76 in ?? () from /lib/x86_64-linux-gnu/libpcre.so.3 #14151 0x00007f6573128ad7 in ?? () from /lib/x86_64-linux-gnu/libpcre.so.3 #14152 0x00007f657313af41 in pcre_exec () from /lib/x86_64-linux-gnu/libpcre.so.3 #14153 0x000000000049cf10 in msc_regexec_capture () #14154 0x00000000004b31e0 in msre_op_rx_execute () #14155 0x00000000004acf7d in execute_operator () #14156 0x00000000004ae2b7 in msre_ruleset_process_phase () #14157 0x0000000000496020 in modsecurity_process_phase () #14158 0x0000000000494f4f in hook_request_late () #14159 0x000000000048e6bc in modsecProcessRequestBody () #14160 0x0000000000484638 in ngx_http_modsecurity_body_handler () #14161 0x0000000000445ee4 in ngx_http_do_read_client_request_body () #14162 0x00000000004462eb in ngx_http_read_client_request_body_handler () #14163 0x000000000043c943 in ngx_http_request_handler () #14164 0x0000000000423fcd in ngx_event_process_posted () #14165 0x0000000000423bb4 in ngx_process_events_and_timers () #14166 0x00000000004299fc in ngx_worker_process_cycle () #14167 0x0000000000428466 in ngx_spawn_process () #14168 0x0000000000429b55 in ngx_start_worker_processes () #14169 0x000000000042a9c8 in ngx_master_process_cycle () #14170 0x000000000040d696 in main () " why ??? — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#1932>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AHr6JzuWRR8bwh1Gn5lFLieDR39WTfs8ks5umb_mgaJpZM4XwOkL> .

-- *Anoop P Alias*

[zimmerle]

Hi @herono2010,

As well noted by @AnoopAlias, the recomendation is to upgrade to ModSecurity v3 + nginx connector:

• https://github.com/SpiderLabs/ModSecurity/tree/v3/master
• https://github.com/SpiderLabs/ModSecurity-nginx

[herono2010]

Hi @herono2010,

As well noted by @AnoopAlias, the recomendation is to upgrade to ModSecurity v3 + nginx connector:

• https://github.com/SpiderLabs/ModSecurity/tree/v3/master
• https://github.com/SpiderLabs/ModSecurity-nginx

On version 2.9.1, we made a lot of changes...so It's not easy to upgrade to v3.....Actually I also want to know what causes the worker process exited.

[zimmerle]

Hi @herono2010,

There is a lot of discussion on this particular subject: #575, #142, #582, #959, #976, #904, #1360. Here is a motivation why to move forward towards v3: An Overview of the Upcoming libModSecurity