Please whitelist cPanel in your adblocker so that you’re able to see our version release promotions, thanks!

The Community Forums

Interact with an entire community of cPanel & WHM users!

What usually happens at 2:10 in the morning?

Discussion in 'General Discussion' started by Vatoloco, Jul 18, 2005.

  1. Vatoloco

    Vatoloco Well-Known Member

    Joined:
    Jun 21, 2004
    Messages:
    100
    Likes Received:
    0
    Trophy Points:
    166
    I'm just wondering if there is any process that usually runs by default at 2:10 am? My server crashed (I had to have ev1 do a reboot) and when it came back up nothing looked out of the ordinary in the logs.
     
  2. chirpy

    chirpy Well-Known Member

    Joined:
    Jun 15, 2002
    Messages:
    13,470
    Likes Received:
    21
    Trophy Points:
    463
    Location:
    Go on, have a guess
    Check the timings of the jobs in your root crontab:

    crontab -l

    Also, make sure that the laus rpm is not installed (search the forums about that).
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  3. Vatoloco

    Vatoloco Well-Known Member

    Joined:
    Jun 21, 2004
    Messages:
    100
    Likes Received:
    0
    Trophy Points:
    166
    crontab -l

    2,58 * * * * /usr/local/bandmin/bandmin
    0 0 * * * /usr/local/bandmin/ipaddrmap
    16 2 * * * /scripts/upcp
    0 1 * * * /scripts/cpbackup
    */15 * * * * /usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1
    0 6 * * * /scripts/exim_tidydb > /dev/null 2>&1
    */5 * * * * /usr/local/cpanel/bin/dcpumon >/dev/null 2>&1


    I'm not sure what that is telling me. I see a few 2's so maybe those are things that run at 2 am.

    Anyways, I did search the forums for laus and found a few of your posts where you gave information on removing it. Thanks! These forums are awesome!

    I ran rpm -e laus and it just gave me the prompt back so I ran it again and got "error: package laus is not installed". So I think I removed it.

    I also checked to see if there was a /var/spool/audit.d directory and there was not but I ran this anyways: rm -Rf /var/spool/audit.d/

    And now the only thing I can find is the logs for it at /var/log/audit.d:

    -rw------- 1 root root 20971520 Jul 16 15:10 bin.0
    -rw------- 1 root root 20971520 Jul 17 23:35 bin.1
    -rw------- 1 root root 20971520 Jul 18 15:10 bin.2
    -rw------- 1 root root 20971520 Jul 8 11:19 bin.3
    -rw------- 1 root root 20971440 Jul 16 15:10 save.0
    -rw------- 1 root root 20971361 Jul 17 23:35 save.1


    I guess I'll find out tonight if things stay running.
     
  4. chirpy

    chirpy Well-Known Member

    Joined:
    Jun 15, 2002
    Messages:
    13,470
    Likes Received:
    21
    Trophy Points:
    463
    Location:
    Go on, have a guess
    Two things:

    1. The most likely job that is causing the problem then is upcp:

    16 2 * * * /scripts/upcp

    That means it is running at 02:16 which may be close enough?

    2. Now that you have removed laus, you need to run the following:

    echo alias "char-major-10-224 off" >> /etc/modules.conf
    service crond stop
    rmmod audit
    service crond start


    You can then delete all the files in /var/log/audit.d/
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  5. Vatoloco

    Vatoloco Well-Known Member

    Joined:
    Jun 21, 2004
    Messages:
    100
    Likes Received:
    0
    Trophy Points:
    166
    It seems like the last things in the log were at about 2:10 so that's probably close enough. I'll try running /scripts/upcp and see if anything happens.

    As far as laus, I ended up doing all this:

     
Loading...

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice