imap seriously failing!!

[7thDsites]

Hi all,

We have a unix server running whm/cpanel - WHM 10.8.0 cPanel 10.8.2-R119
Fedora i686 - WHM X v3.1.0

EVERY DAY we're having imap failures in conjunction with high server loads...

I found that some of it was an exploit which had been taken advantage of through joomla - who knows what the hell the evil person had been doing through the exploit, for like a month, before we noticed it but we did find the problem and removed a bunch of junk from the /tmp and had to deactivate joomla...

anyway... all of that seems to be a done deal but we're still having these imap failures each morning for a couple of hours in conjunction with the cpu/load being well over max... the thing that's driving me nuts is that I can't see what's causing the high load... there is nothing out of the ordinary in the /tmp - the whm is not reporting anything 'high' and we have a vzpp power panel and I can't see anything using all of the resources through that either

oh; and when I try to restart imap it will not... it seems to have to be in fail for a couple of hours before it will come back itself...

any ideas, anyone? Please...

Thanks in advance!!

 

[iCARus]

If this is result of Joomla exploit, install mod_security into Apache and use rules from http://www.gotroot.com/downloads/ftp/mod_security/jitp.conf
You dont need all rules, but use all that consider for Joomla.

Hope it helps.


Bye.

 

[chirpy]

You also need to specify which imap daemon you're running. Is it courier-imap or cpimap run through xinetd?

 

[7thDsites]

I was just notified that we're running the daemon imapd

has anyone else experienced imap failures daily, at a certain time, ours happen each morning for about 2-3 hours - could this cause the server load to max out, they both seem to happen at the same times?

 

[7thDsites]

could anyone please tell me why inetd/imap would fail all of the time - especially during certain time periods...

and could anyone please tell me why a server load would max out all of the time and we wouldn't be able to see what processes are causing this -
the inetd and the server load thing seem to be in snyc with each other but our tech people that normally really keep us squared away are apparently stumped by this - hence my search for some answers and continued sanity...

 

[7thDsites]

our imap has failed 308 times in less than 3 months