Cannot load ticket audit logs (or operator audit logs) after migration

tommange

Hi,
I have recently moved my OsTicket installation to a new server, and for now everything seemed to work fine, with the exception of the Audit Plugin. In fact, if I open a ticket and try to see the relative audit logs, or try to see the audit logs for an operator, I just get a blank window (see screenshots).

I have tried reinstalling the plugin, unsuccessfully.
Thank you very much in advance for your help

Please find below the information on the installation:
OS: Linux
PHP: 7.4.10
MySQL: 5.7.32
OsTicket: v1.15.2

PHP Error Log:
[error] [client REDACTED] - www.REDACTED - AH01215: PHP Warning: include(): Failed opening 'templates/agent-audit.tmpl.php' for inclusion (include_path='./:/web/htdocs/www.REDACTED/home/email/include/:/web/htdocs/www.REDACTED/home/email/include/pear/') in phar:///web/htdocs/www.REDACTED/home/email/include/plugins/audit.phar/audit.php on line 64: /web/htdocs/www.REDACTED/home/email/scp/staff.php, referer https://www.REDACTED/email/scp/staff.php

[error] [client REDACTED] - www.REDACTED - AH01215: PHP Warning: include(): Failed opening 'templates/ticket-audit.tmpl.php' for inclusion (include_path='./:/web/htdocs/www.REDACTED/home/email/include/:/web/htdocs/www.REDACTED/home/email/include/pear/') in phar:///web/htdocs/www.REDACTED/home/email/include/plugins/audit.phar/audit.php on line 80: /web/htdocs/www.REDACTED/home/email/scp/ajax.php, referer https://www.REDACTED/email/scp/tickets.php?id=297

ntozier

I notice that you have not mentioned what webserver software that you are using. This looks like AJAX requests are not being handled correctly. My guess is that are you running NGINX instead of Apache.

tommange

Hi, sorry for forgetting to mention the webserver software. Upon checking, I can confirm that it is in fact Apache, as per the screenshot below. Any idea on what may be causing the problem? Thank you for your time

ntozier

You would have to look at your Apache error logs (and if you are running anything like SELinux and/or mod_security look at their logs) to see what is getting logged. You might also have to look at something like Chrome Developer tools to see if any errors are showing up there also.

tommange

Hi, I am on a shared hosting, so unfortunately I have no access to the Apache error logs, only the php errors, which I have already posted. With Chrome Developer tools I cannot seem to find anything particular, at least according to my understanding.
Would there be any other way to look into this?

KevinTheJedi

@tommange

Download and re-install the latest version of the Audit Log plugin available on our website here:

https://osticket.com/download

Cheers.

tommange

KevinTheJedi
Hi, I had tried that already, without any luck

KevinTheJedi

@tommange

Typically this means issues with your PHP setup. Try downgrading to PHP 7.2 or 7.3 and see if there is any difference.

Cheers.

tommange

KevinTheJedi
Hi, I have tried downgrading to 7.3 and 7.2, but it still won't work (even if I try reinstalling the plugin each time).
I can see that the hosting provider would let me change these options, should it be needed.

KevinTheJedi

@tommange

Can you go to the plug-in repo, download the audit/ folder, upload it to your include/plugins/ folder on the server, remove the old phar (for now), re-install the plug-in in the UI, and see if that works. If not, keep the audit folder in the plugins folder and we can try one more thing.

Cheers.

tommange

KevinTheJedi
Installing the plugin with the folder instead of the .phar worked!
Thank you very much to you and @ntozier for the help

KevinTheJedi

@tommange

Hmm so something is wrong with phar inclusions on your host. Might be worth opening a ticket with them to see what prevents this so this doesn’t happen again in the future. I assume it’s some sort of overly aggressive security rule (like always).

Cheers.

tommange

KevinTheJedi
Sure, I will, but they are not very helpful usually.
Actually, opon checking, not quite "everything" is well. In fact, If I go on the admin panel, click on "reports" and then on "audit logs", I get an HTTP 500. Not that it is much of a problem, as both ticket audits and operator audits work, but just to let you know.

KevinTheJedi

@tommange

You will need to check your PHP error logs again.

Cheers.

tommange

KevinTheJedi

Hi,
when I try to open the Audit page from the report section in the admin panel, this 4 errors show up in the php error log:

11/03/2021` 10:59:43 [error] [client REDACTED IP] - www.REDACTED - AH01215: PHP Warning: require_once(phar:///web/htdocs/www.REDACTED/home/email/include//plugins/audit.phar/class.audit.php): failed to open stream: phar error: invalid url or non-existent phar "phar:///web/htdocs/www.REDACTED/home/email/include//plugins/audit.phar/class.audit.php" in /web/htdocs/www.REDACTED/home/email/scp/audits.php on line 19: /web/htdocs/www.REDACTED/home/email/scp/audits.php, referer https://www.REDACTED/email/scp/logs.php

11/03/2021 10:59:43 [error] [client REDACTED IP] - www.REDACTED - AH01215: PHP Fatal error: require_once(): Failed opening required 'phar:///web/htdocs/www.REDACTED/home/email/include//plugins/audit.phar/class.audit.php' (include_path='./:/web/htdocs/www.REDACTED/home/email/include/:/web/htdocs/www.REDACTED/home/email/include/pear/') in /web/htdocs/www.REDACTED/home/email/scp/audits.php on line 19: /web/htdocs/www.REDACTED/home/email/scp/audits.php, referer https://www.REDACTED/email/scp/logs.php

11/03/2021 10:59:43 [error] [client REDACTED IP] - www.REDACTED - AH01215: PHP Warning: require_once(phar:///web/htdocs/www.REDACTED/home/email/include//plugins/audit.phar/class.audit.php): failed to open stream: phar error: invalid url or non-existent phar "phar:///web/htdocs/www.REDACTED/home/email/include//plugins/audit.phar/class.audit.php" in /web/htdocs/www.REDACTED/home/email/scp/audits.php on line 19: /web/htdocs/www.REDACTED/home/email/scp/audits.php, referer https://www.REDACTED/email/scp/logs.php

11/03/2021 10:59:43 [error] [client REDACTED IP] - www.REDACTED - AH01215: PHP Fatal error: require_once(): Failed opening required 'phar:///web/htdocs/www.REDACTED/home/email/include//plugins/audit.phar/class.audit.php' (include_path='./:/web/htdocs/www.REDACTED/home/email/include/:/web/htdocs/www.REDACTED/home/email/include/pear/') in /web/htdocs/www.REDACTED/home/email/scp/audits.php on line 19: /web/htdocs/www.REDACTED/home/email/scp/audits.php, referer https://www.REDACTED/email/scp/logs.php

tommange

ntozier KevinTheJedi

Hi, upon checking with the provider (sorry for the delay), there are no restrictions in using .phar files.
Also, I have tried what you have suggested but it did not work.

Any furher idea?

Thanks again

ntozier

I'm thinking that the shared host might be preventing .phar files from being used. You might want to contact support for your webhost and show them the error logs and ask them if they are prohibiting .phar's from being used on sites.

They could have disabled phar files. Alternatively you could always download the .phar from the https://osticket.com/download and de-phar it yourself and upload the raw files and run the plugin that way. If it works then we know that your webhost doesn't allow .phar files.

KevinTheJedi

@tommange

I see it now. Go to scp/audits.php, and change line 19 from:

require_once('phar://' . INCLUDE_DIR . '/plugins/audit.phar/class.audit.php');

to:

require_once('phar://' . INCLUDE_DIR . 'plugins/audit.phar/class.audit.php');

Cheers.

tommange

KevinTheJedi
Hi, it still won't work🙁

KevinTheJedi

@tommange

What do the new errors say?

Cheers.

tommange

KevinTheJedi
Hi,
here's what I get.
Please remember that currently I have the folder installed for the audit plugin, not the phar, because if I use the phar nothing works. With the folder, at least, the ticket and operator audits work, but not those on the report page.

16/03/2021 18:53:26 [error] [client 188.114.103.238] - www.REDACTED - AH01215: PHP Warning: require_once(phar:///web/htdocs/www.REDACTED/home/email/include/plugins/audit/class.audit.php): failed to open stream: internal corruption of phar "/web/htdocs/www.REDACTED/home/email/include/plugins/audit/class.audit.php" (__HALT_COMPILER(); not found) in /web/htdocs/www.REDACTED/home/email/scp/audits.php on line 19: /web/htdocs/www.REDACTED/home/email/scp/audits.php, referer https://www.REDACTED/email/scp/logs.php

16/03/2021 18:53:26 [error] [client 188.114.103.238] - www.REDACTED - AH01215: PHP Fatal error: require_once(): Failed opening required 'phar:///web/htdocs/www.REDACTED/home/email/include/plugins/audit/class.audit.php' (include_path='./:/web/htdocs/www.REDACTED/home/email/include/:/web/htdocs/www.REDACTED/home/email/include/pear/') in /web/htdocs/www.REDACTED/home/email/scp/audits.php on line 19: /web/htdocs/www.REDACTED/home/email/scp/audits.php, referer https://www.REDACTED/email/scp/logs.php

16/03/2021 18:53:25 [error] [client 188.114.103.238] - www.REDACTED - AH01215: PHP Warning: require_once(phar:///web/htdocs/www.REDACTED/home/email/include/plugins/audit/class.audit.php): failed to open stream: internal corruption of phar "/web/htdocs/www.REDACTED/home/email/include/plugins/audit/class.audit.php" (__HALT_COMPILER(); not found) in /web/htdocs/www.REDACTED/home/email/scp/audits.php on line 19: /web/htdocs/www.REDACTED/home/email/scp/audits.php, referer https://www.REDACTED/email/scp/logs.php

16/03/2021 18:53:25 [error] [client 188.114.103.238] - www.REDACTED - AH01215: PHP Fatal error: require_once(): Failed opening required 'phar:///web/htdocs/www.REDACTED/home/email/include/plugins/audit/class.audit.php' (include_path='./:/web/htdocs/www.REDACTED/home/email/include/:/web/htdocs/www.REDACTED/home/email/include/pear/') in /web/htdocs/www.REDACTED/home/email/scp/audits.php on line 19: /web/htdocs/www.REDACTED/home/email/scp/audits.php, referer https://REDACTED/email/scp/logs.php