0

In the last Debian Stretch routing security updates I had a problem. When trying install the security upgrades, and consequently upgrading nginx, I got the following error bellow.

I have tried running apt-get upgradeagain, or apt-get install with any of the involved packages, but nothing seems to work.

What to do?

$ apt-get upgrade
Reading package lists... Done
Building dependency tree       
Reading state information... Done
Calculating upgrade... Done
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
6 not fully installed or removed.
After this operation, 0 B of additional disk space will be used.
Do you want to continue? [Y/n] 
Setting up libnginx-mod-stream (1.10.2-2) ...
nginx: [alert] kill(1433, 1) failed (3: No such process)
dpkg: error processing package libnginx-mod-stream (--configure):
 subprocess installed post-installation script returned error exit status 1
Setting up libnginx-mod-http-echo (1.10.2-2) ...
nginx: [alert] kill(1433, 1) failed (3: No such process)
dpkg: error processing package libnginx-mod-http-echo (--configure):
 subprocess installed post-installation script returned error exit status 1
dpkg: dependency problems prevent configuration of nginx-full:
 nginx-full depends on libnginx-mod-http-echo (= 1.10.2-2); however:
  Package libnginx-mod-http-echo is not configured yet.
 nginx-full depends on libnginx-mod-stream (= 1.10.2-2); however:
  Package libnginx-mod-stream is not configured yet.

dpkg: error processing package nginx-full (--configure):
 dependency problems - leaving unconfigured
Setting up libnginx-mod-http-upstream-fair (1.10.2-2) ...
nginx: [alert] kill(1433, 1) failed (3: No such process)
dpkg: error processing package libnginx-mod-http-upstream-fair (--configure):
 subprocess installed post-installation script returned error exit status 1
Setting up libnginx-mod-http-geoip (1.10.2-2) ...
nginx: [alert] kill(1433, 1) failed (3: No such process)
dpkg: error processing package libnginx-mod-http-geoip (--configure):
 subprocess installed post-installation script returned error exit status 1
dpkg: dependency problems prevent configuration of nginx:
 nginx depends on nginx-full (<< 1.10.2-2.1~) | nginx-light (<< 1.10.2-2.1~) | nginx-extras (<< 1.10.2-2.1~); however:
  Package nginx-full is not configured yet.
  Package nginx-light is not installed.
  Package nginx-extras is not installed.
 nginx depends on nginx-full (>= 1.10.2-2) | nginx-light (>= 1.10.2-2) | nginx-extras (>= 1.10.2-2); however:
  Package nginx-full is not configured yet.
  Package nginx-light is not installed.
  Package nginx-extras is not installed.

dpkg: error processing package nginx (--configure):
 dependency problems - leaving unconfigured
Errors were encountered while processing:
 libnginx-mod-stream
 libnginx-mod-http-echo
 nginx-full
 libnginx-mod-http-upstream-fair
 libnginx-mod-http-geoip
 nginx
E: Sub-process /usr/bin/dpkg returned an error code (1)

1 Answer 1

2

Ultimately, analysing the problem, and looking at the post install scripts, the problem was determined. When installing/upgrading any of those nginx components, every single one of those packages, try to restart nginx and check for the success of the operation.

So, in our update operations, we have to start stopping monit before doing the maintenance security updates/upgrades cycle, for it not to start nginx midway the process of apt-get upgrade.

The fix was ultimately, and in order:

  • stopping monit;
  • doing a (p)kill -9 to the nginx processes (strangely the stop seemed to be no longer effective)
  • doing a service start nginx
  • and finally doing again apt-get upgrade again.
  • Finally, at the end of a successful upgrade doing service monit start.

This time without monit getting in the way, the upgrade was effective.

At the end of the day, the lesson is to modify our standard upgrade procedures, and change our Ansible playbook to stop or ideally suspend monit before the security updates process.

2
  • 1
    The post-installation and pre-deinstallation scripts for nginx-full run invoke-rc.d with start and stop at various points. So if you can find a way to connect monit up to invoke-rc.d things should happen automatically for you.
    – JdeBP
    Dec 1, 2016 at 9:28
  • @JdeBP thxs for idea, I will investigate that. Dec 1, 2016 at 9:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .