Slow server performance when Comodo rulset is used by ModSecurity

Symptoms

• ModSecurity is enabled on the server.
• Comodo ruleset is used by ModSecurity.
• The file /var/cache/modsecurity/ip.pag has a large size (several GBs).

Cause

This is a bug with ID PPPM-7580 which is planned to be fixed in future Plesk updates.

Resolution

1. Connect to the server using SSH.
2. Download the attached utility and unzip it:
   

   # wget https://plesk.zendesk.com/hc/article_attachments/115004837253/modsec-sdbm-util-master.zip
   # unzip modsec-sdbm-util-master.zip
   Archive: modsec-sdbm-util-master.zip
   931d75c50dd7b7a3386d07e7757553d8f748268d
   creating: modsec-sdbm-util-master/
   ..

3. Enter the directory which was created in the previous step:
   

   # cd modsec-sdbm-util-master/

4. Install needed packages:

   For RHEL-based OSes:

   # yum install libtool automake gcc apr-devel apr-util-devel

   For Debian-based OSes:

   # apt-get install libtool automake gcc apache2-dev libapr1-dev libaprutil1-dev

5. Create shrink.sh file with the following content:
   

   # cat shrink.sh:
   /root/modsec-sdbm-util-master/modsec-sdbm-util -k /var/cache/modsecurity/ip -n /var/cache/modsecurity/test
   /root/modsec-sdbm-util-master/modsec-sdbm-util -k /var/cache/modsecurity/test -n /var/cache/modsecurity/ip

6. Grant executable permissions on shrink.sh and autogen.sh files:
   

   # chmod +x shrink.sh autogen.sh

7. Build the utility be executing following command one-by-one:
   

   # ./autogen.sh
   # ./configure
   # make

8. Grant executable permissions on modsec-sdbm-util file:

   # chmod +x ./modsec-sdbm-util

9. Create the following crontask:
   

   # crontab -e
   ...
   15 * * * * /root/modsec-sdbm-util-master/shrink.sh

Additional Information

Comodo rule-set does not work: Failed to write to DBM file "/var/cache/ modsecurity / ip ": Invalid argument