WHM and service cpanel status disagree

tudorh

Active Member
Dec 9, 2004
34
9
158
I'm running release version 11.52.2 (build 4).

I've been getting emails for a couple of days telling me that cpsrvd, cpdavd, and spamd have all failed.

When I log on to WHM, it lists that these services are down.

However, if I run "service cpanel status" from the command prompt, I get:
cpsrvd (pid 4683) is running...
entropychat is stopped​

The processes seem to be running:
$ps -Af | grep -e 'cpsrvd\|cpdavd\|spamd'
root 4683 1 0 Jan15 ? 00:02:13 cpsrvd (SSL) - waiting f --llu=1453161326 --listen=10,11,4,5,6,7,8,9
root 13755 1 0 05:24 ? 00:00:02 /usr/local/cpanel/3rdparty/perl/514/bin/spamd --daemonize --max-spare=1 --max-children=3 --allowed-ips=127.0.0.1 --pidfile=/var/run/spamd.pid -i127.0.0.1
root 13764 13755 0 05:24 ? 00:00:00 spamd child
root 14530 1 0 05:29 pts/1 00:00:00 cpdavd - accepting connections on 2077, 2078, 2079, and 2080​


Furthermore, all the logs seem to indicate it's running correctly.

I've tried updating, but it seems that's the current version.

What else could be the problem and how would I go about fixing it?
 

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,904
2,219
463
Hello :)

Could you review /var/log/chkservd.log and see what's output when the services are marked as failed?

Thank you.
 

tudorh

Active Member
Dec 9, 2004
34
9
158
Thanks for looking into this. Here's the output of /var/log/chkservd.log

Code:
Loading services .....clamd....cpanellogd....cpdavd....cpgreylistd....cphulkd....cpsrvd....crond....dnsadmin....exim....ftpd....httpd....imap....ipaliases....mailman....mysql....named....nscd....p0f....pop....queueprocd....rsyslogd....spamd....sshd..Done
[2016-01-19 23:52:25 +0000] Disk check .... /tmp (/var/tmp) [55.15%] ... /dev/xvda (/) [55.15%] ... {status:eek:k} ... Done
[2016-01-19 23:52:25 +0000] OOM check ....Done
[2016-01-19 23:52:25 +0000] Service check ....sshd [[check command:+][socket connect:N/A]]...spamd [][check command:-][socket connect:N/A][fail count:64]Restarting spamd....
[notify:failed service:spamd]]...rsyslogd [[check command:+][socket connect:N/A]]...queueprocd [[check command:+][socket connect:N/A]]...pop [[check command:+][socket connect:+]]...p0f [[check command:+][socket connect:N/A]]...nscd [[check command:+][socket connect:N/A]]...named [[check command:+][socket connect:N/A]]...mysql [[check command:+][socket connect:N/A]]...mailman [[check command:+][socket connect:N/A]]...lfd [[check command:N/A][socket connect:N/A]]...ipaliases [[check command:+][socket connect:N/A]]...imap [[socket_service_auth:1][check command:+][socket connect:+]]...httpd [[check command:N/A][socket connect:+]]...ftpd [[socket_service_auth:1][check command:+][socket connect:+]]...exim [[check command:+][socket connect:+]]...dnsadmin [[check command:+][socket connect:+]]...crond [[check command:+][socket connect:N/A]]...cpsrvd [[http_service_auth:1]cpsrvd: [HTTP/1.1 301 Moved != HTTP/1.x 200 OK] [received_key=<html><head><META HTTP-EQUIV="refresh" CONTENT="2;URL=https://:2087/.__cpanel__service__check__./serviceauth?sendkey=*redacted*&amp;version=1.2"></head><body></body></html>] [expected_key=*redacted*]
][check command:N/A][socket connect:-][socket failure threshold:126/3][fail count:124]Restarting cpsrvd....
[notify:failed service:cpsrvd]]...cphulkd [[check command:+][socket connect:+]]...cpgreylistd [[check command:+][socket connect:N/A]]...cpdavd [[http_service_auth:1]cpdavd: [HTTP/1.1 302 Moved != HTTP/1.x 200 OK] [received_key=] [expected_key=*redacted*]
][check command:+][socket connect:-][socket failure threshold:126/3][fail count:124]Restarting cpdavd....
[notify:failed service:cpdavd]]...cpanellogd [[check command:+][socket connect:N/A]]...clamd [[check command:+][socket connect:N/A]]...Done
Service Check Finished
*redacted* is a real key, but I was unsure if this should be published, so I've replaced it. I notice, however, that received_key is blank.

I'm guessing that my cpdavd service shouldn't have 302-moved.... What could be the problem?
 
Last edited by a moderator:

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,904
2,219
463
It's possible your server is facing load issues or connectivity issues when Chkservd detects a service as down. For instance, when "spamd" fails, do you notice any related output in /var/log/exim_mainlog at the same date/time period?

Thank you.
 

tudorh

Active Member
Dec 9, 2004
34
9
158
Thanks. Load is not an issue on this server. top indicates <4% usage. Only a handful of domains. ~14k lines of logs in /var/log/exim_mainlog each day. <2000 references to spamd. All are to do with not being able to connect:

Code:
2016-01-17 06:45:02 1aKh5C-0001lI-6Y spam acl condition: error reading from spamd socket: Connection reset by peer
2016-01-17 06:46:21 1aKh6T-0001mk-26 spam acl condition: error reading from spamd socket: Connection reset by peer
2016-01-17 06:49:46 1aKh9J-0001pc-ED spam acl condition: error reading from spamd socket: Connection reset by peer
2016-01-17 06:53:12 1aKhD6-0001rx-LP <= [email protected]*redacteddomain* U=root P=local S=44071 T="[*redactedhostdomain*] FAILED \342\233\224: spamd
(*redactedIP*)" for *[email protected]*
2016-01-17 06:59:35 1aKhJG-0001wk-Mz spam acl condition: error reading from spamd socket: Connection reset by peer
2016-01-17 07:03:15 1aKhMp-0001zE-1U <= [email protected]*redacteddomain* U=root P=local S=43946 T="[*redactedhostdomain*] FAILED \342\233\224: spamd
(*redactedIP*)" for *[email protected]*
 
Last edited by a moderator:

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,904
2,219
463
Feel free to open a support ticket using the link in my signature so we can take a closer look. You can post the ticket number here so we can update this thread with the outcome.

Thank you.