wkhtmltoimage and wkhtmltopdf failing after upgrade

[epurins]

Hi team,

After upgrading from 5.4.10 to 5.6.7, on self-managed centos 7.3 from tar archives, scheduled reports that call wkhtmltoimage and wkhtmltopdf are sent by email, but reports that use pdf or images are failing to embed the pdf/image.

Downloading the files from the report succeeds when it is a CSV, but fails with image and pdf types.

For example, the PDF error page includes the text:
Failed to create PDF
Verify that your Nagios XI server can connect to the URL:
https://localhost/nagiosxi/reports/availability.php?

If I hit the URL replacing localhost with my fully-qualified hostname, I get an image ok.
(https://my.nagios.com/nagiosxi/reports/availability.php?)

When I checked the 'External URL' field, it was unconfigured. I set a matching value, applied configuration, and restarted nagios with `systemctl restart nagios`. Downloading the report as a pdf or image still fails, and still displays the localhost url.

Tailing /var/log/httpd/error_log, there are log lines like the following:
/usr/bin/wkhtmltoimage: /lib64/libcrypto.so.10: version `OPENSSL_1.0.2' not found (required by /usr/bin/wkhtmltoimage)
/usr/bin/wkhtmltopdf: /lib64/libcrypto.so.10: version `OPENSSL_1.0.2' not found (required by /usr/bin/wkhtmltopdf)

Running the binaries to check their version string throws the same error on the command line.
[nagios@host epurins]$ /usr/bin/wkhtmltoimage -V
/usr/bin/wkhtmltoimage: /lib64/libcrypto.so.10: version `OPENSSL_1.0.2' not found (required by /usr/bin/wkhtmltoimage)
[nagios@host epurins]$ /usr/bin/wkhtmltopdf -V
/usr/bin/wkhtmltopdf: /lib64/libcrypto.so.10: version `OPENSSL_1.0.2' not found (required by /usr/bin/wkhtmltopdf)

What steps can I take to ensure that the binaries run ok on the command line without error?
How can I repair this component so it sends images ok again?

-e

[scottwilkerson]

Something doesn't seem right, can I have you run

Code: Select all

yum reinstall openssl openssl-libs libzip

[epurins]

Hi Scott,

I reinstalled, but the commands still fail with the same error.
I also tried removing the wkhtmltox.x86_64 package and re-installing that.

-e

[epurins]

Hi Scott,

I looked at the prod server libs using ldd.
The applications point to libcrypto, which is expecting /lib64/libssl.so.10
This lib is a symlink on the system, pointing to `/lib64/libssl.so.1.0.1e`
So that seems to line up with the error.

Maybe the base OS repos for the centos version in production are too old to install a modern libssl?

-e

[epurins]

Alternately, is there a suitable downgrade I can apply in the short term? I know the version from 5.4.10 was running ok. Is it safe to replace just this subcomponent?

[epurins]

Answering own question, I was able to pull the old binaries from previous 5.4.10 install and replace them manually, and the system seems ok.

[scottwilkerson]

Answering own question, I was able to pull the old binaries from previous 5.4.10 install and replace them manually, and the system seems ok.

Great!

Locking thread