Seriously wrong diskspace count!!

[Ganga]

Hello guys,

Please may I have your help on this issue, which has been around for a while.

Looging obn Cpanel (and I stress that all my accounts do that!!) the disk space used/left count ignores mySQL space completely when it shouldn't.

That should be part of the quota and it isn't at present.

Also, all accounts seem to report an excessive amount of space used.

For example, my main account (whose user name is "hosting") reveals that a home backup (untarred) is only less than 10 Mb, yet Cpanel shows disk usage is 40 Mb!!!

A du -hSc command in SSH on the directory /home/hosting reveals that the space taken on the server is only 17 Megabyte, not 40 Mb!!

However, a full backup untarred shows that a directory called "logs" is nearly 60 Mb in size!!

In SSH, I can't find that directory "logs" anywhere I look...

I have run the /scripts/quotas and /scripts/fixcommonproblems to no avail.

Is it possible at all, I wonder, to have accurate disk usage information from CPanel?

The customer may easily make a comparison between what their home directory is and compare it with the value expressed in Cpanel and complain (as they already have)..

Thanks for any advice

Fabio

 

[Ganga]

Doesn't anybody know an answer for this issue please?

 

[casey]

http://forums.cpanel.net/showthread.php?s=&threadid=9865

Search and ye shall find.

Also, you are not backing up the accounts on the same hard disk are you? If you are, that will give the wrong totals.

 

[Ganga]

Thanks for the reply.

No, I'm not backing up on the same disk.

 

[Ganga]

also, I don't seem to see any weird entries in my /etc/passwd, as you can see pasted here:

root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
news:x:9:13:news:/etc/news:
uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin
operator:x:11:0perator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
gopher:x:13:30:gopher:/var/gopher:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
rpm:x:37:37::/var/lib/rpm:/bin/bash
vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
nscd:x:28:28:NSCD Daemon:/:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
rpc:x:32:32:Portmapper RPC user:/:/sbin/nologin
rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
mailnull:x:47:47::/var/spool/mqueue:/sbin/nologin
smmsp:x:51:51::/var/spool/mqueue:/sbin/nologin
pcap:x:77:77::/var/arpwatch:/sbin/nologin
apache:x:48:48:Apache:/var/www:/sbin/nologin
squid:x:23:23::/var/spool/squid:/sbin/nologin
webalizer:x:67:67:Webalizer:/var/www/html/usage:/sbin/nologin
xfs:x:43:43:X Font Server:/etc/X11/fs:/sbin/nologin
named:x:25:25:Named:/var/named:/sbin/nologin
ntp:x:38:38::/etc/ntp:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
mysql:x:100:101:MySQL server:/var/lib/mysql:/bin/bash
cpanel:x:32001:32001::/usr/local/cpanel:/bin/bash
mailman:x:32002:32002::/usr/local/cpanel/3rdparty/mailman:/bin/bash
markait:x:32004:32004::/home/markait:/bin/bash
csvc:x:32006:32006::/home/csvc:/usr/local/cpanel/bin/noshell
wind:x:32007:32007::/home/wind:/usr/local/cpanel/bin/noshell
demo:x:32008:32008::/home/demo:/usr/local/cpanel/bin/noshell
don86:x:32009:32009::/home/don86:/usr/local/cpanel/bin/noshell
mfanclub:x:32010:32010::/home/mfanclub:/usr/local/cpanel/bin/noshell
marjsols:x:32011:32011::/home/marjsols:/usr/local/cpanel/bin/noshell
isax:x:32012:32012::/home/isax:/usr/local/cpanel/bin/noshell
madanpic:x:32013:32013::/home/madanpic:/usr/local/cpanel/bin/noshell
prepaid:x:32014:32014::/home/prepaid:/usr/local/cpanel/bin/noshell
fedelilx:x:32015:32015::/home/fedelilx:/usr/local/cpanel/bin/noshell
satnewsb:x:32016:32016::/home/satnewsb:/usr/local/cpanel/bin/noshell
satplan:x:32017:32017::/home/satplan:/usr/local/cpanel/bin/noshell
sat:x:32018:32018::/home/sat:/usr/local/cpanel/bin/noshell
guidor:x:32019:32019::/home/guidor:/usr/local/cpanel/bin/noshell
cmancini:x:32020:32020::/home/cmancini:/usr/local/cpanel/bin/noshell
anakinn:x:32021:32021::/home/anakinn:/usr/local/cpanel/bin/noshell
mondo3:x:32023:32023::/home/mondo3:/usr/local/cpanel/bin/noshell
compstud:x:32022:32022::/home/compstud:/usr/local/cpanel/bin/noshell
andread:x:32003:32003::/home/andread:/usr/local/cpanel/bin/noshell
hosting:x:32005:32005::/home/hosting:/usr/local/cpanel/bin/jailshell
eyeon:x:32024:32024::/home/eyeon:/bin/bash
giorgiog:x:32025:32025::/home/giorgiog:/usr/local/cpanel/bin/noshell
hostings:x:32026:32026::/home/hostings:/usr/local/cpanel/bin/noshell
hostupl:x:32028:32028::/home/hostupl:/bin/bash
bitdnet:x:32027:32027::/home/bitdnet:/usr/local/cpanel/bin/noshell

The account which seems to be affected the most is "hosting" as far as I can see I don't see any crossed IDs...

Many thanks for any further help offered.

 

[casey]

Originally posted by Ganga
also, I don't seem to see any weird entries in my /etc/passwd, as you can see pasted here:



The account which seems to be affected the most is "hosting" as far as I can see I don't see any crossed IDs...

Many thanks for any further help offered.

It's not the /etc/passwd file that you're supposed to be looking at. The passwd file is just so that you can find the userid. Since it's "hosting" that you want to find and its user id is 32005, do:

find -user 32005

Then see if there are any files listed that shouldn't be.

 

[Ganga]

Many many thanks to casey for helping me to fix the problem, sorry I shoud l have told you before!!

Now, I have a second dedicated server with Cpanel WHM 8.5.4 and this same problem occurred again, and... surprise! surprise! still with ID 32005 being involved.

Here's therefore a question:

How can I create a fake account (which will be obviously have a different ID such as 32xxx) and then swap this ID with the one of account having ID 32005?

This way, I would at least be sure that it won't be a customer being affected but simply a fake account.

Thank you!

Ganga

 

[Ganga]

any ideas, please, anybody?

Thanks!