cpaneleximfilter is empty or non-existent

sehh

Well-Known Member
Feb 11, 2006
579
5
168
Europe
My cpanel error log (/usr/local/cpanel/logs/error_log) is full of the following errors:

Code:
 warn [whostmgr2] User file '/var/cpanel/users/webadmin' is empty or non-existent. at /usr/local/cpanel/Cpanel/Config/LoadCpUserFile.pm line 106
 warn [whostmgr2] User file '/var/cpanel/users/mailman' is empty or non-existent. at /usr/local/cpanel/Cpanel/Config/LoadCpUserFile.pm line 106
 warn [whostmgr2] User file '/var/cpanel/users/clamav' is empty or non-existent. at /usr/local/cpanel/Cpanel/Config/LoadCpUserFile.pm line 106
 warn [whostmgr2] User file '/var/cpanel/users/cpanel-horde' is empty or non-existent. at /usr/local/cpanel/Cpanel/Config/LoadCpUserFile.pm line 106
 warn [whostmgr2] User file '/var/cpanel/users/cpanel-phpmyadmin' is empty or non-existent. at /usr/local/cpanel/Cpanel/Config/LoadCpUserFile.pm line 106
 warn [whostmgr2] User file '/var/cpanel/users/cpanel-phppgadmin' is empty or non-existent. at /usr/local/cpanel/Cpanel/Config/LoadCpUserFile.pm line 106
 warn [whostmgr2] User file '/var/cpanel/users/cpanelhorde' is empty or non-existent. at /usr/local/cpanel/Cpanel/Config/LoadCpUserFile.pm line 106
 warn [whostmgr2] User file '/var/cpanel/users/cpanelphpmyadmin' is empty or non-existent. at /usr/local/cpanel/Cpanel/Config/LoadCpUserFile.pm line 106
 warn [whostmgr2] User file '/var/cpanel/users/cpanelphppgadmin' is empty or non-existent. at /usr/local/cpanel/Cpanel/Config/LoadCpUserFile.pm line 106
 warn [whostmgr2] User file '/var/cpanel/users/cpanelroundcube' is empty or non-existent. at /usr/local/cpanel/Cpanel/Config/LoadCpUserFile.pm line 106
 warn [whostmgr2] User file '/var/cpanel/users/cpaneleximfilter' is empty or non-existent. at /usr/local/cpanel/Cpanel/Config/LoadCpUserFile.pm line 106
Is this something serious? what is this file all about?

Any help would be appreciated.

Thank you.
 
Last edited:

cPanelTristan

Quality Assurance Analyst
Staff member
Oct 2, 2010
7,607
38
248
somewhere over the rainbow
cPanel Access Level
Root Administrator
I'm uncertain what would be calling /var/cpanel/users files for these various services, since they would not have cPanel account files at /var/cpanel/users

What are you specifically doing in WHM when this error presents itself?
 

sehh

Well-Known Member
Feb 11, 2006
579
5
168
Europe
I have no idea, I just found them in the error log file while I was looking for something else.

Here is a more complete log:

Code:
warn [whostmgr2] User file '/var/cpanel/users/cpaneleximfilter' is empty or non-existent. at /usr/local/cpanel/Cpanel/Config/LoadCpUserFil
e.pm line 106
        Cpanel::Config::LoadCpUserFile::_load('cpaneleximfilter', undef, 0) called at /usr/local/cpanel/Cpanel/Config/LoadCpUserFile.pm line 25
        Cpanel::Config::LoadCpUserFile::load('cpaneleximfilter') called at /usr/local/cpanel/Cpanel/Config/LoadCpUserFile.pm line 259
        Cpanel::Config::LoadCpUserFile::loadcpuserfile('cpaneleximfilter') called at whostmgr/bin/whostmgr2 line 6965
        main::listbwdescp() called at whostmgr/bin/whostmgr2 line 877
 

cPanelTristan

Quality Assurance Analyst
Staff member
Oct 2, 2010
7,607
38
248
somewhere over the rainbow
cPanel Access Level
Root Administrator
cpaneleximfilter is a file on the system normally at /etc location, so it shouldn't be showing anything about /var/cpanel/users location. The location for that user is /var/cpanel/userhomes/cpaneleximfilter instead.

What does this show?

Code:
grep cpaneleximfilter /etc/passwd
It should have this as the line:

Code:
[email protected] [/]# grep cpaneleximfilter /etc/passwd
cpaneleximfilter:x:32007:32009::/var/cpanel/userhomes/cpaneleximfilter:/usr/local/cpanel/bin/noshell
 

sehh

Well-Known Member
Feb 11, 2006
579
5
168
Europe
here is what I get:

Code:
# grep cpaneleximfilter /etc/passwd
cpaneleximfilter:x:512:512::/var/cpanel/userhomes/cpaneleximfilter:/usr/local/cpanel/bin/noshell
 

cPanelTristan

Quality Assurance Analyst
Staff member
Oct 2, 2010
7,607
38
248
somewhere over the rainbow
cPanel Access Level
Root Administrator
It appears correct. When you go to /var/cpanel/userhomes, do you show this for ownership on that folder?

Code:
[email protected] [/var/cpanel/userhomes]# ls -ld cpaneleximfilter
drwx--x--x 3 cpaneleximfilter cpaneleximfilter 4096 Mar  8  2011 cpaneleximfilter/
Also, do you have any actual file named /var/cpanel/users/cpaneleximfilter on the system? If you do, you likely shouldn't have that on the system.
 

sehh

Well-Known Member
Feb 11, 2006
579
5
168
Europe
This is what I get:

Code:
# ls -ld cpaneleximfilter
drwx--x--x  3 cpaneleximfilter cpaneleximfilter 4096 Jan 11  2011 cpaneleximfilter/
Could this be a remote access attempt? Maybe someone is trying system/service accounts via the cPanel or WHM login process?
 

cPanelTristan

Quality Assurance Analyst
Staff member
Oct 2, 2010
7,607
38
248
somewhere over the rainbow
cPanel Access Level
Root Administrator
It is possible that someone is trying to log into non-existing accounts using the WHM or cPanel interface. You could test that idea by trying to log into one of the accounts noted in both locations to see the error message it reports while you tail the error log:

Code:
tail -fn0 /usr/local/cpanel/logs/error_log
You could also add a piped grep for your IP to ensure it is just your IP where you get the results:

Code:
tail -fn0 /usr/local/cpanel/logs/error_log | grep IP#
Please replace IP# with your IP, which you can find using What Is My IP Address - Shows Your IP Address site if you aren't certain of your local machine's IP number.