The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Server crashing on ftp?

Discussion in 'General Discussion' started by drose25, Jan 30, 2007.

  1. drose25

    drose25 Well-Known Member

    Joined:
    Apr 3, 2002
    Messages:
    50
    Likes Received:
    0
    Trophy Points:
    6
    Hi all,

    I'm having a new problem that I haven't been able to figure out. My normally stable server has been crashing every few days. Going back through /var/log/messages, it appears that a couple of things are happening regularly about the time the server dies.

    First, a particular user is engaged in an FTP session with the server. He either logs out, or times out, shortly before the system crashes.

    Second, some of the usual APF drop log entries appear. I don't see anything special there.

    Third, there is a "zone transfer denied" error appearing. From what I can tell so far, this error is related to a malconfigured Win2K machine out there somewhere, but nothing to cause a server to crash.

    And finally, on one occasion there is a "martian destination" error concerning an IP registered to the Department of Defense.

    I'm posting log excerpts below. If anyone has any ideas, I'd appreciate it.

    Jan 28 05:36:07 max named[4441]: client 69.72.158.226#37300: zone transfer 'cda.ro/IN' denied
    Jan 28 05:39:18 max pure-ftpd: (patcii@76.172.166.120) [INFO] Timeout - try typing a little faster next time
    Jan 28 05:43:22 max kernel: ** IN_UDP DROP ** IN=eth0 OUT= MAC=00:04:5a:7e:3b:af:00:90:69:5f:b0:5d:08:00 SRC=88.191.25.118 DST=69.50.208.113 LEN=785 TOS=0x00 PREC=0x00 TTL=49 ID=0 DF PROTO=UDP SPT=56492 DPT=1026 LEN=765
    Jan 28 05:44:11 max kernel: ** IN_TCP DROP ** IN=eth0 OUT= MAC=00:04:5a:7e:3b:af:00:90:69:5f:b0:5d:08:00 SRC=84.232.248.193 DST=69.50.210.240 LEN=48 TOS=0x04 PREC=0x00 TTL=108 ID=55810 DF PROTO=TCP SPT=1340 DPT=5900 WINDOW=64240 RES=0x00 SYN URGP=0 OPT (020405B401010402)
    Jan 28 05:44:54 max kernel: ** IN_UDP DROP ** IN=eth0 OUT= MAC=00:04:5a:7e:3b:af:00:90:69:5f:b0:5d:08:00 SRC=204.16.210.60 DST=69.50.208.113 LEN=452 TOS=0x00 PREC=0x00 TTL=53 ID=0 DF PROTO=UDP SPT=60822 DPT=1026 LEN=432
    Jan 28 05:44:54 max kernel: ** IN_UDP DROP ** IN=eth0 OUT= MAC=00:04:5a:7e:3b:af:00:90:69:5f:b0:5d:08:00 SRC=204.16.210.60 DST=69.50.208.113 LEN=452 TOS=0x00 PREC=0x00 TTL=53 ID=0 DF PROTO=UDP SPT=60822 DPT=1027 LEN=432
    Jan 28 05:46:20 max kernel: ** IN_UDP DROP ** IN=eth0 OUT= MAC=00:04:5a:7e:3b:af:00:90:69:5f:b0:5d:08:00 SRC=61.103.223.120 DST=69.50.208.113 LEN=404 TOS=0x00 PREC=0x00 TTL=49 ID=9421 PROTO=UDP SPT=30369 DPT=1026 LEN=384
    Jan 28 05:46:38 max kernel: martian destination 0.0.0.0 from 214.11.82.50, dev eth0
    Jan 28 06:40:06 max syslogd 1.4.1: restart.

    ---

    Jan 29 00:54:31 max kernel: ** IN_TCP DROP ** IN=eth0 OUT= MAC=00:04:5a:7e:3b:af:00:90:69:5f:b0:5d:08:00 SRC=69.47.135.132 DST=69.50.210.248 LEN=64 TOS=0x04 PREC=0x00 TTL=36 ID=49283 DF PROTO=TCP SPT=3430 DPT=2967 WINDOW=53760 RES=0x00 SYN URGP=0 OPT (020405B4010303030101080A000000000000000001010402)
    Jan 29 00:57:08 max kernel: ** IN_UDP DROP ** IN=eth0 OUT= MAC=00:04:5a:7e:3b:af:00:90:69:5f:b0:5d:08:00 SRC=204.16.210.140 DST=69.50.208.113 LEN=449 TOS=0x00 PREC=0x00 TTL=54 ID=0 DF PROTO=UDP SPT=46003 DPT=1026 LEN=429
    Jan 29 00:57:08 max kernel: ** IN_UDP DROP ** IN=eth0 OUT= MAC=00:04:5a:7e:3b:af:00:90:69:5f:b0:5d:08:00 SRC=204.16.210.140 DST=69.50.208.113 LEN=449 TOS=0x00 PREC=0x00 TTL=54 ID=0 DF PROTO=UDP SPT=46003 DPT=1027 LEN=429
    Jan 29 00:57:18 max pure-ftpd: (patcii@76.172.166.120) [INFO] Timeout - try typing a little faster next time
    Jan 29 01:12:55 max syslogd 1.4.1: restart.

    ---

    Jan 30 06:16:06 max pure-ftpd: (?@76.172.166.120) [INFO] patcii is now logged in
    Jan 30 06:16:07 max pure-ftpd: (patcii@76.172.166.120) [NOTICE] /home/patcii//www/mihp2/news/news_content_2.shtml uploaded (1031 bytes, 20.97KB/sec)
    Jan 30 06:17:48 max pure-ftpd: (?@127.0.0.1) [INFO] New connection from 127.0.0.1
    Jan 30 06:17:48 max pure-ftpd: (?@127.0.0.1) [INFO] Logout.
    Jan 30 06:19:32 max named[4441]: client 209.126.159.118#46047: zone transfer 'cda.ro/IN' denied
    Jan 30 06:24:00 max named[4441]: client 69.72.158.226#36916: zone transfer 'cda.ro/IN' denied
    Jan 30 06:24:43 max kernel: ** IN_TCP DROP ** IN=eth0 OUT= MAC=00:04:5a:7e:3b:af:00:90:69:5f:b0:5d:08:00 SRC=69.163.24.174 DST=69.50.210.248 LEN=48 TOS=0x04 PREC=0x00 TTL=110 ID=30923 DF PROTO=TCP SPT=1308 DPT=2967 WINDOW=65535 RES=0x00 SYN URGP=0 OPT (020405B401010402)
    Jan 30 06:24:45 max kernel: ** IN_TCP DROP ** IN=eth0 OUT= MAC=00:04:5a:7e:3b:af:00:90:69:5f:b0:5d:08:00 SRC=69.163.24.174 DST=69.50.210.248 LEN=48 TOS=0x04 PREC=0x00 TTL=110 ID=31103 DF PROTO=TCP SPT=1308 DPT=2967 WINDOW=65535 RES=0x00 SYN URGP=0 OPT (020405B401010402)
    Jan 30 06:25:13 max kernel: ** IN_UDP DROP ** IN=eth0 OUT= MAC=00:04:5a:7e:3b:af:00:90:69:5f:b0:5d:08:00 SRC=71.163.80.107 DST=69.50.210.246 LEN=30 TOS=0x00 PREC=0x00 TTL=115 ID=17318 PROTO=UDP SPT=1089 DPT=1026 LEN=10
    Jan 30 06:25:53 max named[4441]: client 66.252.1.255#57031: zone transfer 'cda.ro/IN' denied
    Jan 30 06:26:31 max pure-ftpd: (?@127.0.0.1) [INFO] New connection from 127.0.0.1
    Jan 30 06:26:31 max pure-ftpd: (?@127.0.0.1) [INFO] Logout.
    Jan 30 06:45:46 max syslogd 1.4.1: restart.
     
  2. wh7702

    wh7702 Member

    Joined:
    Mar 13, 2005
    Messages:
    6
    Likes Received:
    0
    Trophy Points:
    1
    I think I might be experiencing something similar to this. I have yet to put my finger on whats causing me all the problems yet though. A your post was about a month ago, are you still having problems? If not, what did you find the problem to be?

    For me, it seems to happen between 4:00AM and 5:00AM, and logs during that time seem sparse to say the least.

    Thanks,

    WH
     
  3. budway

    budway Well-Known Member

    Joined:
    Apr 16, 2003
    Messages:
    186
    Likes Received:
    0
    Trophy Points:
    16
    What os are you guys on?

    What dc?
     
  4. 4u123

    4u123 Well-Known Member
    PartnerNOC

    Joined:
    Jan 2, 2006
    Messages:
    765
    Likes Received:
    1
    Trophy Points:
    18
    Just wanted to add that we had this problem with 3 of our servers (centos 4.4) which were all running kernels prior to 2.6.9-42.0.8.ELsmp

    After upgrading them to that kernel the problem stopped although one of these servers actually crashed with a kernel panic last night (different problem) that original issue hasnt happened since.
     
  5. 4u123

    4u123 Well-Known Member
    PartnerNOC

    Joined:
    Jan 2, 2006
    Messages:
    765
    Likes Received:
    1
    Trophy Points:
    18
    Happened again - same server - this time using kernel 2.6.9-42.0.10.ELsmp - i only upgraded it this morning.

    Mar 5 13:17:12 hs006 pure-ftpd: (xxx@xxxx.com@217.147.38.226) [INFO] Timeout - try typing a little faster next time

    Mar 5 13:17:20 hs006 kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=00:30:48:89:c9:d2:00:09:12:04:f4:00:08:00 SRC=125.168.254.39 DST=xx.xx.xx.xx LEN=76 TOS=0x00 PREC=0x00 TTL=110 ID=25654 DF PROTO=TCP SPT=25 DPT=15601 WINDOW=65465 RES=0x00 ACK PSH URGP=0
    Mar 5 13:17:49 hs006 kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=00:30:48:89:c9:d2:00:09:12:04:f4:00:08:00 SRC=62.24.228.54 DST=xx.xx.xx.xx LEN=102 TOS=0x00 PREC=0x00 TTL=54 ID=55771 DF PROTO=TCP SPT=25 DPT=44589 WINDOW=1448 RES=0x00 ACK PSH URGP=0


    Mar 5 13:26:03 hs006 syslogd 1.4.1: restart.

    Can anyone recommend a safe kernel ?
     
  6. budway

    budway Well-Known Member

    Joined:
    Apr 16, 2003
    Messages:
    186
    Likes Received:
    0
    Trophy Points:
    16
    please post your (/etc/sysctl.conf) thanks.

    also php safe mode on?
     
  7. AndyReed

    AndyReed Well-Known Member
    PartnerNOC

    Joined:
    May 29, 2004
    Messages:
    2,222
    Likes Received:
    3
    Trophy Points:
    38
    Location:
    Minneapolis, MN
    I looked through your first post. The problem might not be the Kernel. Now, try the following:
    1. Disable the firewall you're using.
    2. Force re-installing Pure-FTP, if that doesn't help
    3. Switch to ProFTP
    4. Disable Anonymous FTP
    5. re-build the cPanel: /scripts/upcp --force
     
  8. 4u123

    4u123 Well-Known Member
    PartnerNOC

    Joined:
    Jan 2, 2006
    Messages:
    765
    Likes Received:
    1
    Trophy Points:
    18
    This problem is still happening on a few of our servers.

    I'm not sure what to do. The message log shows some FTP activity and alot of firewall blocking - then the server just hangs. Its usually early in the morning. Had the exact problem this morning at 3am on a server that has been fine for a week. Kernel is 2.6.9-42.0.10.ELsmp on all of them. I'm totally baffled.

    If anyone can suggest anything I would be very grateful.
     
  9. ksingh

    ksingh Active Member

    Joined:
    Mar 21, 2003
    Messages:
    29
    Likes Received:
    0
    Trophy Points:
    1
    I am also facing same issue on our server CPanel, Cent OS 4.4. Earlier kernel was 2.6.9-42.0.10.EL, but its happening even after downgrading it to 2.6.9-42.0.8.EL

    Kirti
     
  10. 4u123

    4u123 Well-Known Member
    PartnerNOC

    Joined:
    Jan 2, 2006
    Messages:
    765
    Likes Received:
    1
    Trophy Points:
    18
    For us the problem has stopped. We havent made any specific changes but there have been no re-occurances since my last post on here.
     
  11. vinc_dc43

    vinc_dc43 Well-Known Member

    Joined:
    Jan 19, 2003
    Messages:
    60
    Likes Received:
    0
    Trophy Points:
    6
    I think I am experiencing a similar issue and always seems to be around periods of intense FTP activity ... one machine just started doing it after working fine for 2 years with few changes, and the second machine is brand new.

    If i find anything I will post here.

    Best, V -
     
  12. vinc_dc43

    vinc_dc43 Well-Known Member

    Joined:
    Jan 19, 2003
    Messages:
    60
    Likes Received:
    0
    Trophy Points:
    6
    is anyone here using APF? That is experiencing this problem? has switching it off and testing resulted in a total clear up?
     
  13. webdesignlx

    webdesignlx Member

    Joined:
    Aug 13, 2004
    Messages:
    14
    Likes Received:
    0
    Trophy Points:
    1
    Any solution?:confused:
     
  14. mangohead

    mangohead Member

    Joined:
    Aug 4, 2003
    Messages:
    23
    Likes Received:
    0
    Trophy Points:
    1
    Same thing over here.

    New Centos 4.5, WHM 10.8.0 cPanel 10.9.0-R10737
    Kernel - 2.6.9-42.0.10.ELsmp

    anyone? This just started happening tonight, so far pure-ftp has failed 11 times tonight (this morning )

    May 23 00:40:39 cl-t004-161cl pure-ftpd: pure-config.pl startup succeeded
    May 23 00:45:39 cl-t004-161cl pure-config.pl: Running: /usr/sbin/pure-ftpd -O clf:/var/log/xferlog -lextauth:/var/run/ftpd.sock --daemonize -A -c50 -B -C8 -D -fftp -H -I15 -lextauth:/var/run/ftpd.sock -L2000:8 -m4 -s -U133:022 -u100 -Oxferlog:/usr/local/apache/domlogs/ftpxferlog -k99 -Z -Y1
    May 23 00:45:39 cl-t004-161cl pure-ftpd: pure-config.pl startup succeeded
    May 23 00:46:49 cl-t004-161cl pure-ftpd: (?@127.0.0.1) [INFO] New connection from 127.0.0.1
    May 23 00:46:49 cl-t004-161cl pure-ftpd: (?@127.0.0.1) [INFO] Logout.
    May 23 00:48:39 cl-t004-161cl filelimits: Increasing file system limits succeeded
    May 23 00:50:39 cl-t004-161cl pure-config.pl: Running: /usr/sbin/pure-ftpd -O clf:/var/log/xferlog -lextauth:/var/run/ftpd.sock --daemonize -A -c50 -B -C8 -D -fftp -H -I15 -lextauth:/var/run/ftpd.sock -L2000:8 -m4 -s -U133:022 -u100 -Oxferlog:/usr/local/apache/domlogs/ftpxferlog -k99 -Z -Y1
    May 23 00:50:39 cl-t004-161cl pure-ftpd: pure-config.pl startup succeeded
     
Loading...

Share This Page