Both Sites Showing 522 Error / But Can SSH

Woke up this morning to find both of my servers offline showing a Cloudflare 522 error.

Both servers (VPS) are:
cmm 09beta
nginx 1.17.0
1 server is 7.3.6 and the other is 7.2.19

I had no problem logging in via ssh.

---

I even rebooted the servers.

Tried a bunch of stuff, rebuilding php, nginx, checking files.

Ended up having to restart csf. Once I did that everything was back to normal.

I looked at my emails and people were still posting as of a few 1 hour ago and the last time CSF was updated was 9 hours ago.

Thought maybe it was a csf update or something that was bad. Hope I wasn't hacked or something.

Not sure why it happened on both machines.

If anyone has any idea of what to check next, I'm all ears. Really curious why this happened.

 

No network status events. I checked that and I wasn't having any issue logging in via ssh - that worked fine.

Code:

# grep -i csf /var/log/cron | sed -e "s|$(hostname -s)|hostname|g"
May 26 20:36:01 hostname CROND[22088]: (root) CMD (/usr/sbin/csf -u)
May 27 00:00:01 hostname CROND[6329]: (root) CMD (/usr/sbin/csf --lfd restart > /dev/null 2>&1)
May 27 02:01:01 hostname CROND[16342]: (root) CMD (/root/tools/csfcf_update.sh 2>/dev/null)
May 27 03:01:02 hostname CROND[21275]: (root) CMD (/root/tools/csf_update.sh 2>/dev/null)
May 27 20:36:01 hostname CROND[11105]: (root) CMD (/usr/sbin/csf -u)
May 28 00:00:01 hostname CROND[27787]: (root) CMD (/usr/sbin/csf --lfd restart > /dev/null 2>&1)
May 28 02:01:01 hostname CROND[5396]: (root) CMD (/root/tools/csfcf_update.sh 2>/dev/null)
May 28 03:01:01 hostname CROND[10521]: (root) CMD (/root/tools/csf_update.sh 2>/dev/null)
May 28 20:36:01 hostname CROND[31824]: (root) CMD (/usr/sbin/csf -u)
May 29 00:00:01 hostname CROND[16402]: (root) CMD (/usr/sbin/csf --lfd restart > /dev/null 2>&1)
May 29 02:01:01 hostname CROND[27675]: (root) CMD (/root/tools/csfcf_update.sh 2>/dev/null)
May 29 03:01:01 hostname CROND[835]: (root) CMD (/root/tools/csf_update.sh 2>/dev/null)
May 29 20:36:01 hostname CROND[21826]: (root) CMD (/usr/sbin/csf -u)
May 30 00:00:01 hostname CROND[5290]: (root) CMD (/usr/sbin/csf --lfd restart > /dev/null 2>&1)
May 30 02:01:01 hostname CROND[15067]: (root) CMD (/root/tools/csfcf_update.sh 2>/dev/null)
May 30 03:01:01 hostname CROND[19834]: (root) CMD (/root/tools/csf_update.sh 2>/dev/null)
May 30 20:36:01 hostname CROND[4918]: (root) CMD (/usr/sbin/csf -u)
May 31 00:00:02 hostname CROND[21468]: (root) CMD (/usr/sbin/csf --lfd restart > /dev/null 2>&1)
May 31 02:01:01 hostname CROND[31138]: (root) CMD (/root/tools/csfcf_update.sh 2>/dev/null)
May 31 03:01:02 hostname CROND[3582]: (root) CMD (/root/tools/csf_update.sh 2>/dev/null)

Code:

# virt-what
kvm

 

During the process I also put CF into attack mode and restarted nginx and php. When I restarted nginx / php via nprestart sometimes it would load once, after that it will keep loading until I got the error again.

Ever since I did the csf -r it is working fine (which was the last thing I did).

 

Both servers are on ssdnodes, so even if there was a network outage, I highly doubt I'd hear about it unless everything was completely down. Like I mentioned, I had access to ssh the entire time. Not sure how long it was offline before I woke up it's 10:30am here and I noticed the problem at 8:30am.

Nothing else looks out of place. Hopefully it won't happen again. Since I'm on monthly for 1 server at ssdnodes and yearly is just about up for my other server there, I might be moving back to OVH where they record every little issue that happens.

 

nprestart always worked 2x [ok] every time. Once or twice when I did the nprestart it would give me the maintenance.html page (I used that page because it would load fast vs the main site page to test).