Big cPanel problem, every night last few days...

[x-man]

Every morning I can`t login to my server with SSH and with WHM, with SSH all start fine, username, pass and after ENTER nothing, don`t want login!! All rest work fine (apache)...

Also, every night cPanel START sending to me e-mail messages (this night after 3AM - 03:15) with:
"cpsrvd failed @ Mon Sep 19 03:15:32 2005. A restart was attempted automagicly."

And that don`t stop, whole night after start and if I want login to server and if I want stop that I must contact my host and tell them to reboot server and after that ALL WORK FINE!!
What can be problem???

Last night I stay loged with ssh to server and now in morning again I can`t login to server but this connection working fine and now I try to restart cPanel (service cpanel restart) and all is fine, only problem is:
Starting cPanel ssl services: [FAILED]

What I can do now????? I can`t every morning contact my host for reboot...

And one more thing what is bad on my server that is log for "audit.d", in /var/log I have folder "audit.d" and in that folder very much files and all is over 6GB!!


I hope so that somebody have solution for me...

SORRY IF MY ENGLISH BAD.

Thanks.

 

[patryk]

Start with update your CPanel to lastest version with "/scripts/upcp --force".

 

[chirpy]

And one more thing what is bad on my server that is log for "audit.d", in /var/log I have folder "audit.d" and in that folder very much files and all is over 6GB!!

That's the laus rpm and it can cause server instability but shouldn't affect your ability to login. To remove laus:

rpm -ev laus
echo alias "char-major-10-224 off" >> /etc/modules.conf
service crond stop
rmmod audit
service crond start
rm -Rfv /var/log/audit.d/

 

[x-man]

I don`t know what help or this is only for this night but this night no problems...

I do cpanel force update and I removed laus...

Thanks.

 

[Pady]

i am experiencing the same problems, it all happened since the last update via whm. have tried the force update to no avail.

 

[Stream]

I've also experienced this problem for a couple of days (suddenly kind of high load and impossible to login to SSH (and WHM) - after server reboot it works fine for about 24 hours). Just tried removing all old files in "/var/log/audit.d" for a starter - to see if that helps.

Otherwise I'll try removing this audit-thingy alltogether.

 

[TheGman]

I also had this problem. Did disabling the laus rpm fix it for you guys or is it still happening?

 

[Stream]

Just removing the logfiles did the trick for me...

 

[eos1]

That's the laus rpm and it can cause server instability but shouldn't affect your ability to login. To remove laus:

rpm -ev laus
echo alias "char-major-10-224 off" >> /etc/modules.conf
service crond stop
rmmod audit
service crond start
rm -Rfv /var/log/audit.d/

Thank You, Jonathan!!!

 

[BianchiDude]

What are all these save files?
[email protected] [/var/log/audit.d]# ls
./ save.1149 save.1305 save.1462 save.1619 save.1776 save.222 save.38 save.536 save.693 save.85
../ save.115 save.1306 save.1463 save.162 save.1777 save.223 save.380 save.537 save.694 save.850
bin.0 save.1150 save.1307 save.1464 save.1620 save.1778 save.224 save.381 save.538 save.695 save.851
bin.1 save.1151 save.1308 save.1465 save.1621 save.1779 save.225 save.382 save.539 save.696 save.852
bin.2 save.1152 save.1309 save.1466 save.1622 save.178 save.226 save.383 save.54 save.697 save.853
bin.3 save.1153 save.131 save.1467 save.1623 save.1780 save.227 save.384 save.540 save.698 save.854
save.0 save.1154 save.1310 save.1468 save.1624 save.1781 save.228 save.385 save.541 save.699 save.855
save.1 save.1155 save.1311 save.1469 save.1625 save.1782 save.229 save.386 save.542 save.7 save.856
save.10 save.1156 save.1312 save.147 save.1626 save.1783 save.23 save.387 save.543 save.70 save.857
save.100 save.1157 save.1313 save.1470 save.1627 save.1784 save.230 save.388 save.544 save.700 save.858
save.1000 save.1158 save.1314 save.1471 save.1628 save.1785 save.231 save.389 save.545 save.701 save.859
........

I have over 37gig of those files
37G audit.d
another one of my servers had over 68gig
68G audit.d

68gb of meaning logs files that crash the server.

I noticed laus is only on a few of my servers, the newest ones, is this something cpanel just added? If so, uhhh, how bout removing it????

 

[chirpy]

That's laus:
http://forums.cpanel.net/showpost.php?p=209739&postcount=3

 

[aingaranweb]

I had the exact same problem.. Once I did what Chirpy recommended there, I deleted 46 Gigs worth of crap off my server.. Yes 46 Gigs.. And my server is only an 80 gig hard drive.

 

[Santoman]

That's the laus rpm and it can cause server instability but shouldn't affect your ability to login. To remove laus:

rpm -ev laus
echo alias "char-major-10-224 off" >> /etc/modules.conf
service crond stop
rmmod audit
service crond start
rm -Rfv /var/log/audit.d/

Just did it, thanks... Yeah, the server had been running for a couple of a year or so now (Thank you ev1 and cpanel), without any major complains, so I'm glad it's resolved now.

 

[jsimon]

Big cPanel problem

I experience the same problem:
Every couple of days I get a Email like this:
cpsrvd failed @ Mon Apr 24 09:34:06 2006. A restart was attempted automagicly.

I tried the steps but I get missng messages on both packages:

# rpm -ev laus
error: package laus is not installed
# echo alias "char-major-10-224 off" >> /etc/modules.conf
# service crond stop
# rmmod audit
ERROR: Module audit does not exist in /proc/modules
# service crond start
Starting crond: [ OK ]
# rm -Rfv /var/log/audit.d/

Is there something else I should do?