Repeated app / app_api crash with ECONNRESET in CryoSPARC v5.0.6

Troubleshooting
1

We have been seeing a recurring issue over the past couple of weeks where the CryoSPARC web interface suddenly becomes unavailable, while running jobs continue normally.

We are currently running:

CryoSPARC v5.0.6+260710

After the issue occurred, cryosparcm status showed that the app process had exited, while the database, scheduler, and other services were still running.

In the app log immediately before the crash, there was a burst of unusual HTTP requests to paths such as:

/cgi-bin/help.php
/cgi-bin/search.cgi
/server-manager/
/esm_login.asp

followed by:

ERROR | uncaughtException: read ECONNRESET
Error: read ECONNRESET

The app_api log around the same time also showed:

node:events:497
      throw er; // Unhandled 'error' event

Error: read ECONNRESET

and supervisord reported:

WARN exited: app (exit status 1; not expected)
WARN exited: app_api (exit status 1; not expected)

The app_api process was restarted automatically, but the app process remained exited until CryoSPARC was restarted.

Importantly, active processing jobs did not appear to stop when the web app went down.

This has happened multiple times, so I’m trying to understand whether this is a known issue in v5.0.6, whether the connection resets or unusual HTTP requests could be triggering the crash, and whether there is a recommended fix or configuration change.

I can provide the relevant app, app_api, supervisord, system status, and kernel logs if helpful.

Thanks!

2

Welcome to the forum @quinnzy and thanks for your post.

The app.log excerpt indicates attempts to access endpoints that do not exist within the CryoSPARC web app, but that are typically associated with web vulnerability scans.

CryoSPARC is designed to be robust to accidental incorrect, inapplicable or unauthenticated requests to its services and ports. The app log entries, however, indicate access attempts to multiple inapplicable end points, which appear deliberate and may lead to an app crash.

As a reminder: CryoSPARC ports must never be exposed on the internet.

Regarding mitigation, if you have confirmed that the faulty requests are part of security scans that occur in reasonable frequency (less frequently than daily) intervals, you may consider enabling autorestart=true in the [program:app] section of the cryosparc_master/config/supervisord.conf file. A full CryoSPARC restart would be required for the change to become effective. This customization may get overwritten during a future CryoSPARC update.