I deleted few folders and now my mails are down and not working

[kostianev]

Hi, I have trouble with my server - one of my account has exploit and send about 200 000 emails from this account. After that, the server run out of space because of the logs and exim database. I deleted few folders and now have problems with some services. I can't run:

cpanellogd
exim
ftpd
imap

All my accounts can't receive and send emails. I attach the screenshot of service status. Please, can someone help me to repair my cPanel.

 

[cPanelMichael]

Hello

Could you clarify which files/directories were removed?

Thank you.

 

[kostianev]

Hi, I can't remember which Folders was, but it was folders (4-5 folders) from Logs and Exim.
Also I receive emails every hour like this:

The service “cpanellogd” appears to be down.
Number of Restart Attempts 151

==> cPanel Log Daemon version 26.0
Failed to open(>> ): No such file or directory at /usr/local/cpanel/Cpanel/Logd/StatsLog.pm line 85.
Can't call method "redirect_fh_to_me" on an undefined value at /usr/local/cpanel/libexec/cpanellogd line 134.

Reason TCP Transaction Log: 
<< 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------
<< 
<< 
<< 
<< 
<< 
>> USER __cpanel__service__auth__ftpd__dL2hr8QeOcjczP8HUyi2blSBT1_vJ7BHIXFzbhTSbD4q7uAblF2t6olN_FLdxSNQ
<< 331 User __cpanel__service__auth__ftpd__dL2hr8QeOcjczP8HUyi2blSBT1_vJ7BHIXFzbhTSbD4q7uAblF2t6olN_FLdxSNQ OK. Password required
>> PASS dPD8HSqxBEXySTcuALzuB1tSX_HgoH_GQJnJXlVRMbKCEIbOKuQGL46Eylp7wG9g
<< 530 Login authentication failed
ftpd: ** [530 Login authentication failed != 2]
: Died
Number of Restart Attempts 87
Service Check Raw Output The 'pureftpd' service passed the check.
Startup Log Starting pure-config.pl: [60G[ [0;32m OK [0;39m] 
Starting pure-authd:
Log Messages Dec 29 01:26:22 apollo pure-ftpd: ([email protected]) [INFO] Logout.
Dec 29 01:26:07 apollo pure-ftpd: ([email protected]) [WARNING] Authentication failed for user [__cpanel__service__auth__ftpd__dL2hr8QeOcjczP8HUyi2blSBT1_vJ7BHIXFzbhTSbD4q7uAblF2t6olN_FLdxSNQ]
Dec 29 01:26:02 apollo pure-ftpd: ([email protected]) [INFO] New connection from 127.0.0.1
Dec 29 01:21:20 apollo pure-ftpd: ([email protected]) [INFO] Logout.
Dec 29 01:21:05 apollo pure-ftpd: ([email protected]) [WARNING] Authentication failed for user [__cpanel__service__auth__ftpd__IJRWN6QJn8uyYxXURMz4Kmn7XpnZRJ3_cDiW0DQBXsJseAXxBdjo_NRr5zM2zUWG]

 

[SysSachin]

Hello,
You have deleted folder by accessing server through SSH ? If yes then you can run history command to check which folders you have deleted.

 

[cPanelMichael]

You can try forcing an update of cPanel via:

/scripts/upcp --force

However, depending on which directories you removed, it's possible you will need to backup the accounts and data to a remote destination and restore them after reinstalling the OS/cPanel. You can review /root/.bash_history or use the "history" command to
let us know which command you used to delete the directories.

Thank you.

 

[Zaheer Ahmad Khan]

In case you used rm (and/or rm -rf) for deleting files, may you post the output of following command
history | grep rm
Kind Regards

 

[kostianev]

When I type this command, there is only service restart and status items, I deleted fileds and folders by NCDU commands. How to get the history of this NCDU?

 

[cPanelMichael]

Were you able to force an update of cPanel as suggested in my previous response? You may not be able to review the NCDU activity, depending on how it's configured on your server.

Thank you.