The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

What usually happens at 2:10 in the morning?

Discussion in 'General Discussion' started by Vatoloco, Jul 18, 2005.

  1. Vatoloco

    Vatoloco Well-Known Member

    Joined:
    Jun 21, 2004
    Messages:
    100
    Likes Received:
    0
    Trophy Points:
    16
    I'm just wondering if there is any process that usually runs by default at 2:10 am? My server crashed (I had to have ev1 do a reboot) and when it came back up nothing looked out of the ordinary in the logs.
     
  2. chirpy

    chirpy Well-Known Member

    Joined:
    Jun 15, 2002
    Messages:
    13,475
    Likes Received:
    20
    Trophy Points:
    38
    Location:
    Go on, have a guess
    Check the timings of the jobs in your root crontab:

    crontab -l

    Also, make sure that the laus rpm is not installed (search the forums about that).
     
  3. Vatoloco

    Vatoloco Well-Known Member

    Joined:
    Jun 21, 2004
    Messages:
    100
    Likes Received:
    0
    Trophy Points:
    16
    crontab -l

    2,58 * * * * /usr/local/bandmin/bandmin
    0 0 * * * /usr/local/bandmin/ipaddrmap
    16 2 * * * /scripts/upcp
    0 1 * * * /scripts/cpbackup
    */15 * * * * /usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1
    0 6 * * * /scripts/exim_tidydb > /dev/null 2>&1
    */5 * * * * /usr/local/cpanel/bin/dcpumon >/dev/null 2>&1


    I'm not sure what that is telling me. I see a few 2's so maybe those are things that run at 2 am.

    Anyways, I did search the forums for laus and found a few of your posts where you gave information on removing it. Thanks! These forums are awesome!

    I ran rpm -e laus and it just gave me the prompt back so I ran it again and got "error: package laus is not installed". So I think I removed it.

    I also checked to see if there was a /var/spool/audit.d directory and there was not but I ran this anyways: rm -Rf /var/spool/audit.d/

    And now the only thing I can find is the logs for it at /var/log/audit.d:

    -rw------- 1 root root 20971520 Jul 16 15:10 bin.0
    -rw------- 1 root root 20971520 Jul 17 23:35 bin.1
    -rw------- 1 root root 20971520 Jul 18 15:10 bin.2
    -rw------- 1 root root 20971520 Jul 8 11:19 bin.3
    -rw------- 1 root root 20971440 Jul 16 15:10 save.0
    -rw------- 1 root root 20971361 Jul 17 23:35 save.1


    I guess I'll find out tonight if things stay running.
     
  4. chirpy

    chirpy Well-Known Member

    Joined:
    Jun 15, 2002
    Messages:
    13,475
    Likes Received:
    20
    Trophy Points:
    38
    Location:
    Go on, have a guess
    Two things:

    1. The most likely job that is causing the problem then is upcp:

    16 2 * * * /scripts/upcp

    That means it is running at 02:16 which may be close enough?

    2. Now that you have removed laus, you need to run the following:

    echo alias "char-major-10-224 off" >> /etc/modules.conf
    service crond stop
    rmmod audit
    service crond start


    You can then delete all the files in /var/log/audit.d/
     
  5. Vatoloco

    Vatoloco Well-Known Member

    Joined:
    Jun 21, 2004
    Messages:
    100
    Likes Received:
    0
    Trophy Points:
    16
    It seems like the last things in the log were at about 2:10 so that's probably close enough. I'll try running /scripts/upcp and see if anything happens.

    As far as laus, I ended up doing all this:

     
Loading...

Share This Page