Exim and imap down, but mail still working

Ippo13

Registered
Jul 26, 2016
2
0
1
France
cPanel Access Level
Root Administrator
Hello,

Recently, we had some issues with our mail migration.

Everything is ok, our clients send and receive mails but, we have the same problem as this person :

Exim and IMAP appears as down

but no answer on the topic...

So, Exim and IMAP appears to be down and before the migration, we were able to connect to mailbox on SSL, now we have outlook who ask us to validate a certificate because "the name of the server is incorrect"

let me show you some logs :

Code:
Log for IMAP from email alert:

Service Name

imap

Service Status

failed 

Notification

The service “imap” appears to be down.

Service Check Method

The system failed to connect to this service’s TCP/IP port.

Reason

TCP Transaction Log:
<< * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE NAMESPACE STARTTLS AUTH=PLAIN AUTH=LOGIN] Dovecot ready.
>> A001 LOGIN __cpanel__service__auth__imap__UBLw1Hv_mJHnAEduWivRFyHw4399Dc2vAboA9BQOefqgxp6jZQe13Yh9esU7JM3K 2Qh6LYfLe3kN841rjnQB9w4FanR7u73sm5k8SpQ98nSDjq1mHhObHEukW7XeOGe8
<< A001 NO [AUTHENTICATIONFAILED] Authentication failed.
imap: ** [A001 NO [AUTHENTICATIONFAILED] Authentication failed. != A001 OK]
: Died

Number of Restart Attempts

156

Service Check Raw Output

The 'dovecot' service passed the check.

Startup Log

No startup log


Log for Exim from email alert:

Service Name

exim

Service Status

failed 

Notification

The service “exim” appears to be down.

Service Check Method

The system failed to connect to this service’s TCP/IP port.

Reason

TCP Transaction Log:
<< 220-nsxxxxxxxip-1xx-3x-2xx.eu ESMTP Exim 4.87 #1 Mon, 25 Jul 2016 15:47:18 +0200
<<
<<
>> EHLO localhost
<< 250-nsxxxxxx.ip-1xx-3x-2xx.eu Hello localhost [127.0.0.1]
<<
<<
<<
<<
<<
<<
>> AUTH PLAIN AF9fY3BhbmVsX19zZXJ2aWNlX19hdXRoX19leGltX19fRVdVcXY5am03UFluaEZXSWNyUFZheVhrZk9sN1BPb095TEVhX3ZjamZzaGtSUlZBeEZkcjJRM1FwcmFhQVIwAFZrd0s3QUljdHhmSkdSSzh1ZFNSZkVOeFRHUWV0N05EczZiSTlJS0FNYjVQajRxeVpxMnIyVFF3dlVsOV9zdVY=
<< 535 Incorrect authentication data
exim: ** [535 Incorrect authentication data != 2]
: Died

Number of Restart Attempts

68

Service Check Raw Output

The 'exim' service passed the check.

Startup Log

Jul 25 15:37:12 nsxxxxxip-1xx-3x-2xx.eu systemd[1]: Starting Exim is a Mail Transport Agent, which is the program that moves mail from one machine to another....
Jul 25 15:37:12 nsxxxxxx.ip-1xx-3x-2xx.eu systemd[1]: Started Exim is a Mail Transport Agent, which is the program that moves mail from one machine to another..

Log Messages

2016-07-25 15:37:12 exim 4.87 daemon started: pid=16101, -q1h, listening for SMTP on port 366 (IPv6 and IPv4) port 25 (IPv6 and IPv4) port 587 (IPv6 and IPv4) and for SMTPS on port 465 (IPv6 and IPv4)


Reject log :


2016-07-25 09:59:13 dovecot_login authenticator failed for ([192.168.0.210]) [46.218.156.82]:21069: 535 Incorrect authentication data (set_id=AB\023)
2016-07-25 09:59:35 dovecot_plain authenticator failed for localhost [127.0.0.1]:44063: 535 Incorrect authentication data (set_id=__cpanel__service__auth__exim__d[email protected]xxxxxxxxx.fr)
2016-07-25 09:59:41 dovecot_login authenticator failed for ([192.168.0.210]) [46.218.156.82]:21064: 435 Unable to authenticate at present: authentication socket write error
2016-07-25 09:59:41 dovecot_login authenticator failed for ([192.168.0.210]) [46.218.156.82]:21065: 435 Unable to authenticate at present: authentication socket write error
2016-07-25 09:59:41 dovecot_login authenticator failed for ([192.168.0.210]) [46.218.156.82]:21066: 435 Unable to authenticate at present: authentication socket write error
2016-07-25 09:59:41 dovecot_login authenticator failed for ([192.168.0.210]) [46.218.156.82]:21068: 435 Unable to authenticate at present: authentication socket write error
2016-07-25 09:59:41 dovecot_login authenticator failed for ([192.168.0.210]) [46.218.156.82]:21067: 435 Unable to authenticate at present: authentication socket write error
2016-07-25 09:59:41 dovecot_login authenticator failed for ([192.168.0.210]) [46.218.156.82]:21063: 435 Unable to authenticate at present: authentication socket write error
2016-07-25 09:59:41 dovecot_login authenticator failed for ([192.168.0.210]) [46.218.156.82]:21062: 435 Unable to authenticate at present: authentication socket write error
2016-07-25 10:14:43 dovecot_plain authenticator failed for localhost [127.0.0.1]:44195: 535 Incorrect authentication data (set_id=__cpanel__service__auth__exim__k[email protected]xxxxxxxx.fr)
2016-07-25 10:30:11 dovecot_plain authenticator failed for localhost [127.0.0.1]:44410: 535 Incorrect authentication data (set_id=__cpanel__service__auth__exim__7[email protected]xxxxxxxx.fr)
2016-07-25 10:41:14 dovecot_plain authenticator failed for localhost [127.0.0.1]:44497: 535 Incorrect authentication data (set_id=__cpanel__service__auth__exim__f[email protected]xxxxxxx.fr)
2016-07-25 10:56:28 dovecot_plain authenticator failed for localhost [127.0.0.1]:44794: 535 Incorrect authentication data (set_id=__cpanel__service__auth__exim__c[email protected]xxxxxxxx.fr)
2016-07-25 11:00:01 dovecot_login authenticator failed for xxxxxxxxx40.w90-19.abo.wanadoo.fr (auditeur3) [90.19.24.240]:49348: 535 Incorrect authentication data ([email protected])
2016-07-25 11:00:10 dovecot_login authenticator failed for xxxxxxxxx40.w90-19.abo.wanadoo.fr (xxxxur3) [xx.1x.2x.xx0]:49352: 535 Incorrect authentication data ([email protected])
2016-07-25 11:00:17 dovecot_login authenticator failed for aorleans-xxxxxxxxxxx90-19.abo.wanadoo.fr (auditeur3) [9x.1x.2x.2xx]:49353: 535 Incorrect authentication data ([email protected])
2016-07-25 11:11:32 dovecot_plain authenticator failed for localhost [127.0.0.1]:44936: 535 Incorrect authentication data (set_id=__cpanel__service__auth__exim__k[email protected]xxxxxxxxx.fr)
2016-07-25 11:26:35 dovecot_plain authenticator failed for localhost [127.0.0.1]:45054: 535 Incorrect authentication data (set_id=__cpanel__service__auth__exim__v[email protected]xxxxxxx.fr)
2016-07-25 11:41:39 dovecot_plain authenticator failed for localhost [127.0.0.1]:45323: 535 Incorrect authentication data (set_id=__cpanel__service__auth__exim__x[email protected]xxxxxxxxxx.fr)
2016-07-25 11:56:43 dovecot_plain authenticator failed for localhost [127.0.0.1]:45566: 535 Incorrect authentication data (set_id=__cpanel__service__auth__exim__t[email protected]xxxxxxxxxxx.fr)
2016-07-25 11:59:57 dovecot_login authenticator failed for (axxxxx3h) [78.1xx.2xx.1xx]:4994: 535 Incorrect authentication data ([email protected])
2016-07-25 12:11:46 dovecot_plain authenticator failed for localhost [127.0.0.1]:45682: 535 Incorrect authentication data (set_id=__cpanel__service__auth__exim__i[email protected]axxxxxxxxxxxx.fr)
2016-07-25 12:26:49 dovecot_plain authenticator failed for localhost [127.0.0.1]:45820: 535 Incorrect authentication data (set_id=__cpanel__service__auth__exim__a[email protected]axxxxxxxx.fr)
2016-07-25 12:41:53 dovecot_plain authenticator failed for localhost [127.0.0.1]:45890: 535 Incorrect authentication data (set_id=__cpanel__service__auth__exim__h[email protected]axxxxxxxxx.fr)
2016-07-25 12:56:57 dovecot_plain authenticator failed for localhost [127.0.0.1]:46024: 535 Incorrect authentication data (set_id=__cpanel__service__auth__exim__3[email protected]xxxxxxxxxxs.fr)
 
Last edited by a moderator:

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,908
2,218
463
Hello,

Could you verify if the system has sufficient disk space and inodes? You can check this with the following commands:

Code:
df -h
df -i
Also, what are the permission and ownership values on /var/cpanel/serviceauth and it's subdirectories (e.g. exim, imap)?

Thank you.
 

Ippo13

Registered
Jul 26, 2016
2
0
1
France
cPanel Access Level
Root Administrator
Hello Michael,
Thanks a lot for your answer.

df -h and df -i gave :
Filesystem Size Used Avail Use% Mounted on
/dev/root 77G 15G 59G 20% /
devtmpfs 32G 0 32G 0% /dev
tmpfs 32G 0 32G 0% /dev/shm
tmpfs 32G 1.3G 31G 4% /run
tmpfs 32G 0 32G 0% /sys/fs/cgroup
/dev/sda2 361G 258G 85G 76% /home
tmpfs 6.3G 0 6.3G 0% /run/user/0

[email protected] [/etc/firewalld]# df -i
Filesystem Inodes IUsed IFree IUse% Mounted on
/dev/root 5120000 176114 4943886 4% /
devtmpfs 8231574 1518 8230056 1% /dev
tmpfs 8239950 1 8239949 1% /dev/shm
tmpfs 8239950 1670 8238280 1% /run
tmpfs 8239950 13 8239937 1% /sys/fs/cgroup
/dev/sda2 24027136 1001603 23025533 5% /home
tmpfs 8239950 1 8239949 1% /run/user/0
ls -al :

drwx--x--x 10 root root 4096 Jul 24 20:57 serviceauth/

subdir :


total 64
drwx--x--x 10 root root 4096 Jul 24 20:57 ./
drwx--x--x 94 root root 12288 Jul 26 17:07 ../
drwx------ 2 root root 4096 May 19 15:39 cpdavd/
drwx------ 2 root root 4096 May 19 15:39 cpsrvd/
drwx------ 2 root root 4096 Jun 3 02:57 dnsadmin/
drwxr-x--- 2 root mail 4096 Jul 24 20:57 exim/
drwxr-x--- 2 root mail 4096 Jul 24 20:15 exim_old/
drwx------ 2 root root 4096 May 19 15:37 ftpd/
drwx------ 2 root root 4096 Jul 24 20:24 imap/
drwx------ 2 root root 4096 Jul 24 20:01 imap_old/
-rw-r--r-- 1 root root 64 Jul 26 17:07 recv
-rw-r--r-- 1 root root 64 Jul 24 20:18 recv_old
-rw-r--r-- 1 root root 64 Jul 26 17:07 send
-rw-r--r-- 1 root root 64 Jul 24 20:18 send_old


we have some "old" files because we tried to delete /exim/ and /imap/ folders then reboot to resolve the problem (i saw this on another topic).

Thanks a lot
 

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,908
2,218
463
Could you open a support ticket using the link in my signature so we can take a closer look? You can post the ticket number here so we can update this thread with the outcome.

Thank you.
 

Mysticeti

Well-Known Member
Sep 16, 2002
57
5
158
Southern NH
Was there any resolution to this issue? Just wondering as I've started seeing "The service “exim” appears to be down" alerts every few days lately. Disk space would not seem to be an issue on my VPS.

Thanks.
 

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,908
2,218
463
New Was there any resolution to this issue? Just wondering as I've started seeing "The service “exim” appears to be down" alerts every few days lately. Disk space would not seem to be an issue on my VPS.
Is there any particular output to /var/log/exim_mainlog or /var/log/exim_paniclog at the times when Chkservd detects it as down?

Thank you.
 

Mysticeti

Well-Known Member
Sep 16, 2002
57
5
158
Southern NH
There wasn't anything at all in exim_paniclog (it was empty) and I didn't see anything obvious in exim_mainlog. But the good news is the problem seems to have gone away as I haven't seen any "exim appears to be done" messages in a week.

Cheers.
 
  • Like
Reactions: cPanelMichael