Forums

Articles
Create
cancel
Showing results for 
Search instead for 
Did you mean: 

Confluence server works fine for about 15 min and then it crashes

Unity Web
I'm New Here
I'm New Here
Those new to the Atlassian Community have posted less than three times. Give them a warm welcome!
September 4, 2021

Hello,

My confluence server works fine for about 15 min and then it crashes and I need to restart the service. 

Memory doesn't seem to be the issue as I increased it to 10Gb.

Also, the Heap memory was increased to 1500mb..

No useful information in the logs regarding the crash.

Any ideas? 

It just started happening all of the sudden.

I upgraded to the latest version to see if this would solve the issue but I have the same result. 

Please note that JIRA Server is also running in the same server and facing no issues at all. 

Best Regards,

Daniel Sanchez

3 answers

2 accepted

1 vote
Answer accepted
Unity Web
I'm New Here
I'm New Here
Those new to the Atlassian Community have posted less than three times. Give them a warm welcome!
September 4, 2021

I found the issue. We were a victim of a cryptominer attacking a vulnerability in confluence: 

https://www.bleepingcomputer.com/news/security/atlassian-confluence-flaw-actively-exploited-to-install-cryptominers/

The cryptominer was killing confluence...

The problem has been solved and the server patched :) 

0 votes
Answer accepted
Mohamed Adel
Rising Star
Rising Star
Rising Stars are recognized for providing high-quality answers to other users. Rising Stars receive a certificate of achievement and are on the path to becoming Community Leaders.
September 4, 2021

Hi @Unity Web  

Can you share the server logs from confluence-application.log.

 

Thanks in advance

Mohamed Adel 

0 votes
Daniel Ebers
Rising Star
Rising Star
Rising Stars are recognized for providing high-quality answers to other users. Rising Stars receive a certificate of achievement and are on the path to becoming Community Leaders.
September 9, 2021

Hi @Unity Web

while patching the vulnerable Confluence installation alongside with removing the malicious crypto miner is the correct measure in first place you would need to assess if the server is compromised in a way it needs probably to be restored from backup.

Basically a machine got hacked like yours should not be trusted anymore. Please do a thorough check of the environment, too. The malware seen in that cases is reported to "jump" to other hosts, too.

Regards,
Daniel

Suggest an answer

Log in or Sign up to answer
DEPLOYMENT TYPE
SERVER
TAGS
AUG Leaders

Atlassian Community Events