A website is inaccessible when ModSecurity is enabled: Failed deleting collection (name “ip”, key “xxxxx”): Internal error

Dmitry Bystrov

10 months ago

Symptoms

A website is inaccessible when ModSecurity is enabled
The following error is found in ModSecurity log in Modsecurity log at Domains > example.com > Web Application Firewall > ModSecurity Log File:

collections_remove_stale: Failed deleting collection (name "ip", key "xxxxx"): external error
Comodo Rule Set is not selected at Tools & Settings > Web Application Firewall (ModSecurity) > Settings > Rule set

Cause

Huge ip.pag file from Modsecurity causing a timeout.

Resolution

Solution for Linux

Log in to Plesk
Go to Tools & Settings > Web Application Firewall (ModSecurity) > Settings tab
Under Custom directives, add the directive SecCollectionTimeout 600 (default is 3600), then click Apply to save the settings:
Go to the General tab in the Web Application Firewall.
Under the option Web application firewall mode select Off, then click Apply to save the settings
Connect to the server via SSH
Run the following command to clear the ip.pag file:

# echo "" > /var/cache/modsecurity/www-data-ip.pag
In Plesk, under the option Web application firewall mode select On, then click Ok to apply the settings

Solution for Windows

Log in to Plesk
Go to Tools & Settings > Web Application Firewall (ModSecurity) > Settings tab
Under Custom directives, add the directive SecCollectionTimeout 600 (default is 3600), then click Apply to save the settings:
Go to the General tab in the Web Application Firewall.
Under the option Web application firewall mode select Off, then click Apply to save the settings
Connect to the server via RDP
Open CMD as administrator
Run the command below to find the GUID of the affected domain:

C:> plesk db "select guid from domains where name like '%example.com%'"
+--------------------------------------+
| guid |
+--------------------------------------+
| B51D0987-DEC1-415C-8941-6BB5A49D5E7E |
+--------------------------------------+
Open Windows Explorer and navigate to the folder C:Program Files (x86)PleskModSecurityvhosts<GUID>temp
Empty the file IWPD_3(examplecom)-ip.pag
In Plesk in the General tab in the Web Application Firewall, select On, then click Apply to save the settings

0 Shares