/etc/cron.hourly/asl exited with return code 127

Question

The hourly configured cronjob asl started to exit with return code 127 since one day (after run of apt-get update; apt-get dist-upgrade).

Now I'm receiving hourly reports like:

run-parts: /etc/cron.hourly/asl exited with return code 127

Where does it come from? Config file looks quite fine.

/EDIT: I saw the "duplicate thread". Unfortunately there is only that one small chapter about cron.hourly scheduled jobs. All the logs files etc. are not mentioning anything. Executing the cron step by step shows following error:

root@s01:/etc/cron.hourly# /var/asl/bin/aum -u
Checking versions ... 

Updating Web Application Firewall to 201608111803: updated        [PASS]
Restarting Apache ... 
Generating report ... 

Finished
-------------------------------------------------------------------------------
Errors were encountered:

L CODE SOURCE                        MESSAGE
- ---- ----------------------------- ------------------------------------------
2 9901 ASLCommon::cmd_system         ERROR: '/bin/cp -af /var/asl/rules/modsec/
                                     template-* /var/asl/data/templates/ >/dev/
                                     null 2>&1 (1)'

Answer 1

Check the release notes of the version you upgraded to and check how the changes affect the software you are running in the cron job.

Answer 2

Due to an an update the config file was overwritten. Quick fix Guide:

a) Exit code 1

ISSUE: error notifications with respect to cronjobs exiting with code 1.

SOLUTION 1: follow Plesk KB article KB129494, but I would not want to recommend it, for reasons that will become clear later. SOLUTION 2: follow the steps below (in chronological order):

• run the command: cp -p /etc/asl/config.dpkg-dist /etc/asl/config
• run the command: /var/asl/bin/aum -c

and note that you should have the config.dpkg-dist file (on deb based machines, or the equivalent on rpm based machines), otherwise just use solution 1.

CHECK: verify that /etc/asl/config contains the key-value pair of CONFIGURED="yes" in the last line of the config file.

IMPORTANT: you are not finished yet, have a look at point b!

b) Exit code 127

ISSUE: error notifications with respect to cronjobs exiting with code 127.

SOLUTION: change the key-value pair APACHE_RESTART_COMMAND="/etc/init.d/httpd restart" to APACHE_RESTART_COMMAND="/etc/init.d/apache2 restart", IF AND ONLY IF you are on a deb based machine (like Ubuntu).

CHECK: just have a look at /etc/init.d, in order to determine whether you should use "httpd" or "apache2".

IMPORTANT: in most cases of changes to or updates to mod_security and/or rulesets, Apache web server has to be restarted IMPORTANT: do NOT use the "work-around" as mentioned in the post https://talk.plesk.com/threads/suddenly-getting-asl-errors-today.338907/page-2#post-806008 IMPORTANT: it is highly recommend to use the key-value pair RESTART_APACHE="graceful" (!)

NOTE: it is recommended to restart httpd or apache2 service after applying this solution.

Source: https://talk.plesk.com/threads/suddenly-getting-asl-errors-today.338907/page-2#post-806035