WHM and service cpanel status disagree

tudorh

Active Member
Dec 9, 2004
35
10
158
I'm running release version 11.52.2 (build 4).

I've been getting emails for a couple of days telling me that cpsrvd, cpdavd, and spamd have all failed.

When I log on to WHM, it lists that these services are down.

However, if I run "service cpanel status" from the command prompt, I get:
cpsrvd (pid 4683) is running...
entropychat is stopped​

The processes seem to be running:
$ps -Af | grep -e 'cpsrvd\|cpdavd\|spamd'
root 4683 1 0 Jan15 ? 00:02:13 cpsrvd (SSL) - waiting f --llu=1453161326 --listen=10,11,4,5,6,7,8,9
root 13755 1 0 05:24 ? 00:00:02 /usr/local/cpanel/3rdparty/perl/514/bin/spamd --daemonize --max-spare=1 --max-children=3 --allowed-ips=127.0.0.1 --pidfile=/var/run/spamd.pid -i127.0.0.1
root 13764 13755 0 05:24 ? 00:00:00 spamd child
root 14530 1 0 05:29 pts/1 00:00:00 cpdavd - accepting connections on 2077, 2078, 2079, and 2080​


Furthermore, all the logs seem to indicate it's running correctly.

I've tried updating, but it seems that's the current version.

What else could be the problem and how would I go about fixing it?
 

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,884
2,250
463
Hello :)

Could you review /var/log/chkservd.log and see what's output when the services are marked as failed?

Thank you.
 

tudorh

Active Member
Dec 9, 2004
35
10
158
Thanks for looking into this. Here's the output of /var/log/chkservd.log

Code:
Loading services .....clamd....cpanellogd....cpdavd....cpgreylistd....cphulkd....cpsrvd....crond....dnsadmin....exim....ftpd....httpd....imap....ipaliases....mailman....mysql....named....nscd....p0f....pop....queueprocd....rsyslogd....spamd....sshd..Done
[2016-01-19 23:52:25 +0000] Disk check .... /tmp (/var/tmp) [55.15%] ... /dev/xvda (/) [55.15%] ... {status:eek:k} ... Done
[2016-01-19 23:52:25 +0000] OOM check ....Done
[2016-01-19 23:52:25 +0000] Service check ....sshd [[check command:+][socket connect:N/A]]...spamd [][check command:-][socket connect:N/A][fail count:64]Restarting spamd....
[notify:failed service:spamd]]...rsyslogd [[check command:+][socket connect:N/A]]...queueprocd [[check command:+][socket connect:N/A]]...pop [[check command:+][socket connect:+]]...p0f [[check command:+][socket connect:N/A]]...nscd [[check command:+][socket connect:N/A]]...named [[check command:+][socket connect:N/A]]...mysql [[check command:+][socket connect:N/A]]...mailman [[check command:+][socket connect:N/A]]...lfd [[check command:N/A][socket connect:N/A]]...ipaliases [[check command:+][socket connect:N/A]]...imap [[socket_service_auth:1][check command:+][socket connect:+]]...httpd [[check command:N/A][socket connect:+]]...ftpd [[socket_service_auth:1][check command:+][socket connect:+]]...exim [[check command:+][socket connect:+]]...dnsadmin [[check command:+][socket connect:+]]...crond [[check command:+][socket connect:N/A]]...cpsrvd [[http_service_auth:1]cpsrvd: [HTTP/1.1 301 Moved != HTTP/1.x 200 OK] [received_key=<html><head><META HTTP-EQUIV="refresh" CONTENT="2;URL=https://:2087/.__cpanel__service__check__./serviceauth?sendkey=*redacted*&amp;version=1.2"></head><body></body></html>] [expected_key=*redacted*]
][check command:N/A][socket connect:-][socket failure threshold:126/3][fail count:124]Restarting cpsrvd....
[notify:failed service:cpsrvd]]...cphulkd [[check command:+][socket connect:+]]...cpgreylistd [[check command:+][socket connect:N/A]]...cpdavd [[http_service_auth:1]cpdavd: [HTTP/1.1 302 Moved != HTTP/1.x 200 OK] [received_key=] [expected_key=*redacted*]
][check command:+][socket connect:-][socket failure threshold:126/3][fail count:124]Restarting cpdavd....
[notify:failed service:cpdavd]]...cpanellogd [[check command:+][socket connect:N/A]]...clamd [[check command:+][socket connect:N/A]]...Done
Service Check Finished
*redacted* is a real key, but I was unsure if this should be published, so I've replaced it. I notice, however, that received_key is blank.

I'm guessing that my cpdavd service shouldn't have 302-moved.... What could be the problem?
 
Last edited by a moderator:

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,884
2,250
463
It's possible your server is facing load issues or connectivity issues when Chkservd detects a service as down. For instance, when "spamd" fails, do you notice any related output in /var/log/exim_mainlog at the same date/time period?

Thank you.
 

tudorh

Active Member
Dec 9, 2004
35
10
158
Thanks. Load is not an issue on this server. top indicates <4% usage. Only a handful of domains. ~14k lines of logs in /var/log/exim_mainlog each day. <2000 references to spamd. All are to do with not being able to connect:

Code:
2016-01-17 06:45:02 1aKh5C-0001lI-6Y spam acl condition: error reading from spamd socket: Connection reset by peer
2016-01-17 06:46:21 1aKh6T-0001mk-26 spam acl condition: error reading from spamd socket: Connection reset by peer
2016-01-17 06:49:46 1aKh9J-0001pc-ED spam acl condition: error reading from spamd socket: Connection reset by peer
2016-01-17 06:53:12 1aKhD6-0001rx-LP <= [email protected]*redacteddomain* U=root P=local S=44071 T="[*redactedhostdomain*] FAILED \342\233\224: spamd
(*redactedIP*)" for *[email protected]*
2016-01-17 06:59:35 1aKhJG-0001wk-Mz spam acl condition: error reading from spamd socket: Connection reset by peer
2016-01-17 07:03:15 1aKhMp-0001zE-1U <= [email protected]*redacteddomain* U=root P=local S=43946 T="[*redactedhostdomain*] FAILED \342\233\224: spamd
(*redactedIP*)" for *[email protected]*
 
Last edited by a moderator:

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,884
2,250
463
Feel free to open a support ticket using the link in my signature so we can take a closer look. You can post the ticket number here so we can update this thread with the outcome.

Thank you.