FTPD Fails Repeatedly

Steve Kessler

• March 23, 2015 16:03

I keep getting text messages from WHM that FTPD has failed. When I look at the services FTPD is up. Also, I was getting texts that it was resolved these are no longer coming in. I am using Pure-FTPD. I have not changed any FTP settings on WHM. In fact this is a very new install. I cannot trace a time this started with any change to the configuration nor is their a real regularity to the posts. Thanks, Steve

• 

  cPanelMichael

  • March 24, 2015 15:46

  Hello, Do you see any output in /var/log/messages at the time FTP is reported as failing? You can search for the term "Restarting ftpd" in /var/log/chkservd.log to see when it's been detected as down. EX:
  grep "Restarting ftpd" /var/log/chkservd.log
  Thank you.

  0
• 

  Steve Kessler

  • March 24, 2015 16:54

  This is what I am seeing for each of the failures Service Check Started Loading services .....cpanellogd....cpsrvd....ftpd....imap....named....queueprocd..Done [2015-03-24 00:00:00 -0600] Service check ....queueprocd [[check command:+][socket connect:N/A]]...named [[check command:+][socket connect:N/A]]...imap [[socket_service_auth:1][check command:+][socket connect:+]]...ftpd [[socket_service_auth:1][check command:+][socket connect:+]]...cpsrvd [[http_service_auth:1][check command:N/A][socket connect:+]]...cpanellogd [[check command:+][socket connect:N/A]]...Done Service Check Finished When I do the grep you suggest the bottom of the massive output looks like this [notify:failed service:imap]]...ftpd [[socket_service_auth:1]Timeout while trying to get data from service: Died][check command:+][socket connect:-][socket failure threshold:40/3][fail count:38]Restarting ftpd.... Looks like IMAP might be failed as well... Any help on this is appreciated. Thanks, Steve

  0
• 

  cPanelMichael

  • March 25, 2015 13:28

  Hello, The search of /var/log/chkservd.log was simply so you could get a time stamp of when it happened. Now that you know when it happened, you can search /var/log/messages for that time to see if there are any messages about FTP. Thank you.

  0
• 

  Steve Kessler

  • March 25, 2015 19:12

  There does not appear to be anything in the log. Just mass amounts of entries like these. Mar 23 11:53:21 denverdataman PAM-hulk[24605]: Brute force detection active: 580 LOGIN DENIED -- EXCESSIVE FAILURES -- IP TEMP BANNED Mar 23 11:53:25 denverdataman PAM-hulk[24693]: Brute force detection active: 580 LOGIN DENIED -- EXCESSIVE FAILURES -- IP TEMP BANNED 11:53:23 was the most recent failure. Where else can I look. Thanks, Steve

  0
• 

  cPanelPeter cPanel Staff

  • March 26, 2015 18:45

  Hello, Feel free to open a ticket using the link in my signature. Please post the ticket number here so we can update this thread accordingly.

  0
• 

  Steve Kessler

  • March 28, 2015 18:29

  I got help under Ticket ID: 6301931 Thanks, Steve

  0
• 

  cPanelMichael

  • April 06, 2015 18:39

  To update, it was determined that FTP activity was not logged to /var/log/messages as it normally is. The rsyslog configuration was reset, and FTP activity is now properly logged to the /var/log/messages log file. This will help narrow down the issue should FTP fail again. Thank you.

  0

Please sign in to leave a comment.