SlapHappy

Member
Jul 8, 2014
18
1
53
cPanel Access Level
Reseller Owner
We suddenly lost access to a server today via the browser interface (WHM) and ssh response was slow.
'Top' didn't show anything out of the ordinary and restarting Apache had no effect.

We phoned the provider and after a few minutes they come back and said the server ran out of memory so we performed a soft reboot. When asked why they said they would have to check the logs and get back to us. Being the impatient type I jumped into the Messages log and found a lot of these entries "web1 pdns_server: Limit of simultaneous TCP connections reached - raise max-tcp-connections" logged just around the time I lost access.

Just before those entries I see a lot these too. web1 kernel: Firewall: *TCP_OUT Blocked*, web1 kernel: Firewall: *UDP_IN Blocked* and web1 kernel: Firewall: *ICMP_IN Blocked*

Where else might I look to find an answer if possible?
 

cPRex

Jurassic Moderator
Staff member
Oct 19, 2014
16,505
2,605
363
cPanel Access Level
Root Administrator
Hey there! It sounds like this likely isn't related to any cPanel tools, so any system logs like /var/log/messages would be a good place to start. If there were a large number of TCP connections, you could always check the Apache logs from just before the crash happened to see if there was some type of DoS attack happening on the system.

The sar logs may also have good information about resource usage just before the outage, and details on how to check those logs can be found here: https://support.cpanel.net/hc/en-us...4-How-to-diagnose-high-loads-with-sar-command

While likely not directly related to your issue, most of the details here would also be applicable as you'll be hunting in the same areas for information: https://support.cpanel.net/hc/en-us/articles/360056001894-How-to-diagnose-high-server-loads

Let us know what you find!
 

Draxer

Member
Jan 13, 2021
9
1
3
LA
cPanel Access Level
Website Owner
This seems to be a server-side issue. Therefore, it is better for you to check this through a monitoring service, which will identify the cause of the problem. Most likely, you will have to solve a technical problem with the hosting provider, or simply change the tariff plan for the better.
 
Last edited by a moderator: