I deleted few folders and now my mails are down and not working

kostianev

Member
Dec 28, 2015
10
3
3
Bulgaria
cPanel Access Level
Website Owner
Hi, I have trouble with my server - one of my account has exploit and send about 200 000 emails from this account. After that, the server run out of space because of the logs and exim database. I deleted few folders and now have problems with some services. I can't run:

cpanellogd
exim
ftpd
imap

All my accounts can't receive and send emails. I attach the screenshot of service status. Please, can someone help me to repair my cPanel.
 

Attachments

kostianev

Member
Dec 28, 2015
10
3
3
Bulgaria
cPanel Access Level
Website Owner
Hi, I can't remember which Folders was, but it was folders (4-5 folders) from Logs and Exim.
Also I receive emails every hour like this:


Code:
The service “cpanellogd” appears to be down.
Number of Restart Attempts 151

==> cPanel Log Daemon version 26.0
Failed to open(>> ): No such file or directory at /usr/local/cpanel/Cpanel/Logd/StatsLog.pm line 85.
Can't call method "redirect_fh_to_me" on an undefined value at /usr/local/cpanel/libexec/cpanellogd line 134.
Code:
Reason TCP Transaction Log: 
<< 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------
<< 
<< 
<< 
<< 
<< 
>> USER __cpanel__service__auth__ftpd__dL2hr8QeOcjczP8HUyi2blSBT1_vJ7BHIXFzbhTSbD4q7uAblF2t6olN_FLdxSNQ
<< 331 User __cpanel__service__auth__ftpd__dL2hr8QeOcjczP8HUyi2blSBT1_vJ7BHIXFzbhTSbD4q7uAblF2t6olN_FLdxSNQ OK. Password required
>> PASS dPD8HSqxBEXySTcuALzuB1tSX_HgoH_GQJnJXlVRMbKCEIbOKuQGL46Eylp7wG9g
<< 530 Login authentication failed
ftpd: ** [530 Login authentication failed != 2]
: Died
Number of Restart Attempts 87
Service Check Raw Output The 'pureftpd' service passed the check.
Startup Log Starting pure-config.pl: [60G[ [0;32m OK [0;39m] 
Starting pure-authd:
Log Messages Dec 29 01:26:22 apollo pure-ftpd: ([email protected]) [INFO] Logout.
Dec 29 01:26:07 apollo pure-ftpd: ([email protected]) [WARNING] Authentication failed for user [__cpanel__service__auth__ftpd__dL2hr8QeOcjczP8HUyi2blSBT1_vJ7BHIXFzbhTSbD4q7uAblF2t6olN_FLdxSNQ]
Dec 29 01:26:02 apollo pure-ftpd: ([email protected]) [INFO] New connection from 127.0.0.1
Dec 29 01:21:20 apollo pure-ftpd: ([email protected]) [INFO] Logout.
Dec 29 01:21:05 apollo pure-ftpd: ([email protected]) [WARNING] Authentication failed for user [__cpanel__service__auth__ftpd__IJRWN6QJn8uyYxXURMz4Kmn7XpnZRJ3_cDiW0DQBXsJseAXxBdjo_NRr5zM2zUWG]
 

SysSachin

Well-Known Member
Aug 23, 2015
604
48
28
India
cPanel Access Level
Root Administrator
Twitter
Hello,
You have deleted folder by accessing server through SSH ? If yes then you can run history command to check which folders you have deleted.
 

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,913
2,203
363
You can try forcing an update of cPanel via:

Code:
/scripts/upcp --force
However, depending on which directories you removed, it's possible you will need to backup the accounts and data to a remote destination and restore them after reinstalling the OS/cPanel. You can review /root/.bash_history or use the "history" command to
let us know which command you used to delete the directories.

Thank you.
 

kostianev

Member
Dec 28, 2015
10
3
3
Bulgaria
cPanel Access Level
Website Owner
When I type this command, there is only service restart and status items, I deleted fileds and folders by NCDU commands. How to get the history of this NCDU?
 

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,913
2,203
363
Were you able to force an update of cPanel as suggested in my previous response? You may not be able to review the NCDU activity, depending on how it's configured on your server.

Thank you.