Php memory size, error or attack?

kogi · March 30, 2023, 11:09am

Keep getting these in my php error logs, all from the same ip. Have I misconfigured something?

[client 193.32.162.159:40938] AH01071: Got error ‘PHP message: PHP Fatal error: Allowed memory size of 536870912 bytes exhausted (tried to allocate 20480 bytes) in /home/qent/public_html/app/functions/fn.init.php on line 1069’

[client 193.32.162.159:40938] AH01071: Got error ‘PHP message: PHP Fatal error: Allowed memory size of 536870912 bytes exhausted (tried to allocate 32768 bytes) in /home/qent/public_html/app/Tygh/Exceptions/PHPErrorException.php on line 1’

CS-Cart_team · April 3, 2023, 11:38am

Hi!

Can you please check what pages this visitor opened that caused these errors? Also, please check which code corresponds to the lines that appear in the error log.

soft-solid · April 5, 2023, 8:15am

Have you recently installed any new external add-ons in your store? Or this issue appear in a clear, vanilia installation of CS-Cart?

Best regards,
Robert

kogi · April 5, 2023, 8:40am

the only abnormal thing installed is vivashop

kogi · April 5, 2023, 8:41am

Will do as soon as i am in back in home country

kogi · April 11, 2023, 9:57am

wierd dates correct but I can’t get the times to line up

[Wed Mar 29 13:04:57.640588 2023] [proxy_fcgi:error] [pid 133245:tid 140588129134144] [client 193.32.162.159:36420] AH01071: Got error 'PHP message: PHP Fatal error:  Allowed memory size of 268435456 bytes exhausted (tried to allocate 262144 bytes) in /home/qent/public_html/app/Tygh/Application.php on line 135'
[Wed Mar 29 13:04:57.640691 2023] [proxy_fcgi:error] [pid 133245:tid 140588129134144] [client 193.32.162.159:36420] AH01071: Got error 'PHP message: PHP Fatal error:  Allowed memory size of 268435456 bytes exhausted (tried to allocate 262144 bytes) in Unknown on line 0'
[Wed Mar 29 13:04:57.640710 2023] [proxy_fcgi:error] [pid 133245:tid 140588129134144] [client 193.32.162.159:36420] AH01071: Got error 'PHP message: PHP Fatal error:  Allowed memory size of 268435456 bytes exhausted (tried to allocate 262144 bytes) in Unknown on line 0'
[Wed Mar 29 13:04:57.640725 2023] [proxy_fcgi:error] [pid 133245:tid 140588129134144] [client 193.32.162.159:36420] AH01071: Got error 'PHP message: PHP Warning:  Unknown: Cannot call session save handler in a recursive manner in Unknown on line 0'
[Wed Mar 29 16:35:58.750352 2023] [proxy_fcgi:error] [pid 133245:tid 140588053599808] [client 193.32.162.159:55720] AH01071: Got error 'PHP message: PHP Fatal error:  Allowed memory size of 268435456 bytes exhausted (tried to allocate 20480 bytes) in /home/qent/public_html/app/functions/fn.init.php on line 1069'
[Wed Mar 29 16:35:58.750523 2023] [proxy_fcgi:error] [pid 133245:tid 140588053599808] [client 193.32.162.159:55720] AH01071: Got error 'PHP message: PHP Fatal error:  Allowed memory size of 268435456 bytes exhausted (tried to allocate 32768 bytes) in /home/qent/public_html/app/Tygh/Exceptions/PHPErrorException.php on line 1'
[Wed Mar 29 17:13:41.757575 2023] [proxy_fcgi:error] [pid 133245:tid 140588061992512] [client 193.32.162.159:45256] AH01071: Got error 'PHP message: PHP Fatal error:  Allowed memory size of 268435456 bytes exhausted (tried to allocate 20480 bytes) in /home/qent/public_html/app/functions/fn.init.php on line 1069'
[Wed Mar 29 17:13:41.757726 2023] [proxy_fcgi:error] [pid 133245:tid 140588061992512] [client 193.32.162.159:45256] AH01071: Got error 'PHP message: PHP Fatal error:  Allowed memory size of 268435456 bytes exhausted (tried to allocate 32768 bytes) in /home/qent/public_html/app/Tygh/Exceptions/PHPErrorException.php on line 1'
[Wed Mar 29 23:49:12.266100 2023] [proxy_fcgi:error] [pid 133246:tid 140588179490368] [client 193.32.162.159:48096] AH01071: Got error 'PHP message: PHP Fatal error:  Allowed memory size of 268435456 bytes exhausted (tried to allocate 262144 bytes) in /home/qent/public_html/app/Tygh/Application.php on line 135'
[Wed Mar 29 23:49:12.266252 2023] [proxy_fcgi:error] [pid 133246:tid 140588179490368] [client 193.32.162.159:48096] AH01071: Got error 'PHP message: PHP Fatal error:  Allowed memory size of 268435456 bytes exhausted (tried to allocate 262144 bytes) in Unknown on line 0'
[Wed Mar 29 23:49:12.266272 2023] [proxy_fcgi:error] [pid 133246:tid 140588179490368] [client 193.32.162.159:48096] AH01071: Got error 'PHP message: PHP Fatal error:  Allowed memory size of 268435456 bytes exhausted (tried to allocate 262144 bytes) in Unknown on line 0'
[Wed Mar 29 23:49:12.266300 2023] [proxy_fcgi:error] [pid 133246:tid 140588179490368] [client 193.32.162.159:48096] AH01071: Got error 'PHP message: PHP Warning:  Unknown: Cannot call session save handler in a recursive manner in Unknown on line 0'

93.32.162.159 - - [29/Mar/2023:01:08:59 +1100] "GET / HTTP/1.1" 200 3460 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36 Edg/90.0.818.46"
193.32.162.159 - - [29/Mar/2023:01:09:05 +1100] "GET /dispatch.asp HTTP/1.1" 404 491 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36 Edg/90.0.818.46"

193.32.162.159 - - [29/Mar/2023:03:06:25 +1100] "GET / HTTP/1.1" 200 3460 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36 Edg/90.0.818.46"
193.32.162.159 - - [29/Mar/2023:03:06:30 +1100] "GET /dispatch.asp HTTP/1.1" 404 491 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36 Edg/90.0.818.46"

193.32.162.159 - - [29/Mar/2023:06:17:39 +1100] "GET / HTTP/1.1" 200 3460 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36 Edg/90.0.818.46"
193.32.162.159 - - [29/Mar/2023:06:17:45 +1100] "GET /dispatch.asp HTTP/1.1" 404 491 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36 Edg/90.0.818.46"

193.32.162.159 - - [29/Mar/2023:09:29:33 +1100] "GET / HTTP/1.1" 200 3460 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36 Edg/90.0.818.46"
193.32.162.159 - - [29/Mar/2023:09:29:38 +1100] "GET /dispatch.asp HTTP/1.1" 404 491 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36 Edg/90.0.818.46"

thetool · April 11, 2023, 1:22pm

/dispatch.asp is non-existent but I wonder if the system is still trying to process it because “dispatch” is common.?

Not sure what the fix would be though.

What is the code at /home/qent/public_html/app/functions/fn.init.php on line 1069

kogi · April 11, 2023, 9:10pm

$valid_timezone_identifiers = timezone_identifiers_list();

thetool · April 12, 2023, 10:34am

I had this issue a few years ago but I never could pinpoint the cause and it didn’t occur too often. It’s possible that it was a bug in PHP. What version of PHP are you using and check to see if it needs to be updated.

kogi · April 12, 2023, 11:18am

PHP Version 7.4.33

Cool, as long as the site is not compromised

CS-Cart_team · April 18, 2023, 8:28am

These log entries don’t seem to match. Unfortunately I have nothing to add based on this information.