The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

FTPD Fails Repeatedly

Discussion in 'General Discussion' started by Steve Kessler, Mar 23, 2015.

  1. Steve Kessler

    Steve Kessler Active Member

    Joined:
    Feb 22, 2015
    Messages:
    25
    Likes Received:
    0
    Trophy Points:
    1
    Location:
    Denver, Colorado, United State
    cPanel Access Level:
    Root Administrator
    I keep getting text messages from WHM that FTPD has failed. When I look at the services FTPD is up. Also, I was getting texts that it was resolved these are no longer coming in. I am using Pure-FTPD. I have not changed any FTP settings on WHM. In fact this is a very new install. I cannot trace a time this started with any change to the configuration nor is their a real regularity to the posts.

    Thanks,
    Steve
     

    Attached Files:

    #1 Steve Kessler, Mar 23, 2015
    Last edited: Mar 23, 2015
  2. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    30,678
    Likes Received:
    653
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
    Hello,

    Do you see any output in /var/log/messages at the time FTP is reported as failing? You can search for the term "Restarting ftpd" in /var/log/chkservd.log to see when it's been detected as down. EX:

    Code:
    grep "Restarting ftpd" /var/log/chkservd.log
    Thank you.
     
  3. Steve Kessler

    Steve Kessler Active Member

    Joined:
    Feb 22, 2015
    Messages:
    25
    Likes Received:
    0
    Trophy Points:
    1
    Location:
    Denver, Colorado, United State
    cPanel Access Level:
    Root Administrator
    This is what I am seeing for each of the failures

    Service Check Started
    Loading services .....cpanellogd....cpsrvd....ftpd....imap....named....queueprocd..Done
    [2015-03-24 00:00:00 -0600] Service check ....queueprocd [[check command:+][socket connect:N/A]]...named [[check command:+][socket connect:N/A]]...imap [[socket_service_auth:1][check command:+][socket connect:+]]...ftpd [[socket_service_auth:1][check command:+][socket connect:+]]...cpsrvd [[http_service_auth:1][check command:N/A][socket connect:+]]...cpanellogd [[check command:+][socket connect:N/A]]...Done
    Service Check Finished

    When I do the grep you suggest the bottom of the massive output looks like this

    [notify:failed service:imap]]...ftpd [[socket_service_auth:1]Timeout while trying to get data from service: Died][check command:+][socket connect:-][socket failure threshold:40/3][fail count:38]Restarting ftpd....

    Looks like IMAP might be failed as well...

    Any help on this is appreciated.

    Thanks,
    Steve
     
  4. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    30,678
    Likes Received:
    653
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
    Hello,

    The search of /var/log/chkservd.log was simply so you could get a time stamp of when it happened. Now that you know when it happened, you can search /var/log/messages for that time to see if there are any messages about FTP.

    Thank you.
     
  5. Steve Kessler

    Steve Kessler Active Member

    Joined:
    Feb 22, 2015
    Messages:
    25
    Likes Received:
    0
    Trophy Points:
    1
    Location:
    Denver, Colorado, United State
    cPanel Access Level:
    Root Administrator
    There does not appear to be anything in the log. Just mass amounts of entries like these.

    Mar 23 11:53:21 denverdataman PAM-hulk[24605]: Brute force detection active: 580 LOGIN DENIED -- EXCESSIVE FAILURES -- IP TEMP BANNED
    Mar 23 11:53:25 denverdataman PAM-hulk[24693]: Brute force detection active: 580 LOGIN DENIED -- EXCESSIVE FAILURES -- IP TEMP BANNED

    11:53:23 was the most recent failure.

    Where else can I look.

    Thanks,
    Steve
     
  6. cPanelPeter

    cPanelPeter Technical Analyst III
    Staff Member

    Joined:
    Sep 23, 2013
    Messages:
    569
    Likes Received:
    15
    Trophy Points:
    18
    cPanel Access Level:
    Root Administrator
    Twitter:
    Hello,

    Feel free to open a ticket using the link in my signature. Please post the ticket number here so we can update this thread accordingly.
     
  7. Steve Kessler

    Steve Kessler Active Member

    Joined:
    Feb 22, 2015
    Messages:
    25
    Likes Received:
    0
    Trophy Points:
    1
    Location:
    Denver, Colorado, United State
    cPanel Access Level:
    Root Administrator
    I got help under Ticket ID: 6301931

    Thanks,
    Steve
     
  8. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    30,678
    Likes Received:
    653
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
    To update, it was determined that FTP activity was not logged to /var/log/messages as it normally is. The rsyslog configuration was reset, and FTP activity is now properly logged to the /var/log/messages log file. This will help narrow down the issue should FTP fail again.

    Thank you.
     
Loading...

Share This Page