The service “p0f” appears to be down

[guillof]

I'm receiving tons of email notifications. The subject is:

[ip-172-31-x-xxx.ap-northeast-1.compute.internal] FAILED : p0f (172.31.x.xxx)


That ip is not the one from my server anymore (it use to be), but still receiving those messages after I updated the ips, rebooted the server, etc.

Any idea?

 

[Vishnu Pradeep]

Hello Guillof,

The alerts are due to enabling the "p0f" service from "service manager" in WHM/cPanel. This is used to monitor the services and alert if any services goes down. The alerts is usually send to "root" or "cpanel" user and is set to forward to your mail. This forwarding of mail is set in "Contact Manager" in WHM. As per your earlier post, I assume that the system mail accounts are still set to forward to your mail. Since you are not managing the server, please contact the responsible and remove this forwarder. Also, you could direct them to execute the following command to fix the issue, if you wish.
-----------
/usr/local/cpanel/scripts/check_cpanel_rpms --fix
-----------

Cheers,
Vishnu Pradeep

 

[cPanelMichael]

That ip is not the one from my server anymore (it use to be), but still receiving those messages after I updated the ips, rebooted the server, etc.

Hello,

Could you verify if you migrated to a new server, or if you changed the IP address of the existing server? Could you review the email headers in the notification to verify which server the notification originates from?

Thank you.