Skip to main content

Exim and imap down, but mail still working

Ippo13
Hello, Recently, we had some issues with our mail migration. Everything is ok, our clients send and receive mails but, we have the same problem as this person : Exim and IMAP appears as down but no answer on the topic... So, Exim and IMAP appears to be down and before the migration, we were able to connect to mailbox on SSL, now we have outlook who ask us to validate a certificate because "the name of the server is incorrect" let me show you some logs :
Log for IMAP from email alert: Service Name imap Service Status failed Notification The service "imap" appears to be down. Service Check Method The system failed to connect to this service"s TCP/IP port. Reason TCP Transaction Log: << * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE NAMESPACE STARTTLS AUTH=PLAIN AUTH=LOGIN] Dovecot ready. >> A001 LOGIN __cpanel__service__auth__imap__UBLw1Hv_mJHnAEduWivRFyHw4399Dc2vAboA9BQOefqgxp6jZQe13Yh9esU7JM3K 2Qh6LYfLe3kN841rjnQB9w4FanR7u73sm5k8SpQ98nSDjq1mHhObHEukW7XeOGe8 << A001 NO [AUTHENTICATIONFAILED] Authentication failed. imap: ** [A001 NO [AUTHENTICATIONFAILED] Authentication failed. != A001 OK] : Died Number of Restart Attempts 156 Service Check Raw Output The 'dovecot' service passed the check. Startup Log No startup log Log for Exim from email alert: Service Name exim Service Status failed Notification The service "exim" appears to be down. Service Check Method The system failed to connect to this service"s TCP/IP port. Reason TCP Transaction Log: << 220-nsxxxxxxxip-1xx-3x-2xx.eu ESMTP Exim 4.87 #1 Mon, 25 Jul 2016 15:47:18 +0200 << << >> EHLO localhost << 250-nsxxxxxx.ip-1xx-3x-2xx.eu Hello localhost [127.0.0.1] << << << << << << >> AUTH PLAIN AF9fY3BhbmVsX19zZXJ2aWNlX19hdXRoX19leGltX19fRVdVcXY5am03UFluaEZXSWNyUFZheVhrZk9sN1BPb095TEVhX3ZjamZzaGtSUlZBeEZkcjJRM1FwcmFhQVIwAFZrd0s3QUljdHhmSkdSSzh1ZFNSZkVOeFRHUWV0N05EczZiSTlJS0FNYjVQajRxeVpxMnIyVFF3dlVsOV9zdVY= << 535 Incorrect authentication data exim: ** [535 Incorrect authentication data != 2] : Died Number of Restart Attempts 68 Service Check Raw Output The 'exim' service passed the check. Startup Log Jul 25 15:37:12 nsxxxxxip-1xx-3x-2xx.eu systemd[1]: Starting Exim is a Mail Transport Agent, which is the program that moves mail from one machine to another.... Jul 25 15:37:12 nsxxxxxx.ip-1xx-3x-2xx.eu systemd[1]: Started Exim is a Mail Transport Agent, which is the program that moves mail from one machine to another.. Log Messages 2016-07-25 15:37:12 exim 4.87 daemon started: pid=16101, -q1h, listening for SMTP on port 366 (IPv6 and IPv4) port 25 (IPv6 and IPv4) port 587 (IPv6 and IPv4) and for SMTPS on port 465 (IPv6 and IPv4) Reject log : 2016-07-25 09:59:13 dovecot_login authenticator failed for ([192.168.0.210]) [46.218.156.82]:21069: 535 Incorrect authentication data (set_id=AB\023) 2016-07-25 09:59:35 dovecot_plain authenticator failed for localhost [127.0.0.1]:44063: 535 Incorrect authentication data (set_id=__cpanel__service__auth__exim__dxknawrd44tlwaluppxb_vjz8lojusa8ixwoa6iohkjlubu1xlr7nopguwjmfqr7@xxxxxxxxx.fr) 2016-07-25 09:59:41 dovecot_login authenticator failed for ([192.168.0.210]) [46.218.156.82]:21064: 435 Unable to authenticate at present: authentication socket write error 2016-07-25 09:59:41 dovecot_login authenticator failed for ([192.168.0.210]) [46.218.156.82]:21065: 435 Unable to authenticate at present: authentication socket write error 2016-07-25 09:59:41 dovecot_login authenticator failed for ([192.168.0.210]) [46.218.156.82]:21066: 435 Unable to authenticate at present: authentication socket write error 2016-07-25 09:59:41 dovecot_login authenticator failed for ([192.168.0.210]) [46.218.156.82]:21068: 435 Unable to authenticate at present: authentication socket write error 2016-07-25 09:59:41 dovecot_login authenticator failed for ([192.168.0.210]) [46.218.156.82]:21067: 435 Unable to authenticate at present: authentication socket write error 2016-07-25 09:59:41 dovecot_login authenticator failed for ([192.168.0.210]) [46.218.156.82]:21063: 435 Unable to authenticate at present: authentication socket write error 2016-07-25 09:59:41 dovecot_login authenticator failed for ([192.168.0.210]) [46.218.156.82]:21062: 435 Unable to authenticate at present: authentication socket write error 2016-07-25 10:14:43 dovecot_plain authenticator failed for localhost [127.0.0.1]:44195: 535 Incorrect authentication data (set_id=__cpanel__service__auth__exim__kqkzkhlkjjpo0w6qwbcxr3ptr2quv0b5_pblqprhbofkyan5mohqyfuqnkbmyofc@xxxxxxxx.fr) 2016-07-25 10:30:11 dovecot_plain authenticator failed for localhost [127.0.0.1]:44410: 535 Incorrect authentication data (set_id=__cpanel__service__auth__exim__7oqpizarul8zlh5iuot7zks5yhqqxwdvwgndhhkihw3z1jjzff3thdadil7i1u1o@xxxxxxxx.fr) 2016-07-25 10:41:14 dovecot_plain authenticator failed for localhost [127.0.0.1]:44497: 535 Incorrect authentication data (set_id=__cpanel__service__auth__exim__fztixwqp8almcdn7a916upqd0hzxu4o5wjfz2rf3gz4w3d7jufyv2jmmurnfrejo@xxxxxxx.fr) 2016-07-25 10:56:28 dovecot_plain authenticator failed for localhost [127.0.0.1]:44794: 535 Incorrect authentication data (set_id=__cpanel__service__auth__exim__cedzmxelbor4f8gooatpppqyw4oeswkdwxv_olbdfgbsldovuqsjfw72zk0dzgbk@xxxxxxxx.fr) 2016-07-25 11:00:01 dovecot_login authenticator failed for xxxxxxxxx40.w90-19.abo.wanadoo.fr (auditeur3) [90.19.24.240]:49348: 535 Incorrect authentication data (set_id=f.mxxxxxxx@xxxxxxxxxx.fr) 2016-07-25 11:00:10 dovecot_login authenticator failed for xxxxxxxxx40.w90-19.abo.wanadoo.fr (xxxxur3) [xx.1x.2x.xx0]:49352: 535 Incorrect authentication data (set_id=f.xxxxxt@xxxxxxx.fr) 2016-07-25 11:00:17 dovecot_login authenticator failed for aorleans-xxxxxxxxxxx90-19.abo.wanadoo.fr (auditeur3) [9x.1x.2x.2xx]:49353: 535 Incorrect authentication data (set_id=f.mxxxx@xxxxxxxx.fr) 2016-07-25 11:11:32 dovecot_plain authenticator failed for localhost [127.0.0.1]:44936: 535 Incorrect authentication data (set_id=__cpanel__service__auth__exim__kglslp_pggtfsjpakuduxltebw14nuivwtjf3_x6bytaz6hw5e4it9ues2vgucv8@xxxxxxxxx.fr) 2016-07-25 11:26:35 dovecot_plain authenticator failed for localhost [127.0.0.1]:45054: 535 Incorrect authentication data (set_id=__cpanel__service__auth__exim__vathvx2a8pmy3rtae8vvd9r9rhn9cob0dklllioex4o3smwyddkfiwvpuuqzuvmf@xxxxxxx.fr) 2016-07-25 11:41:39 dovecot_plain authenticator failed for localhost [127.0.0.1]:45323: 535 Incorrect authentication data (set_id=__cpanel__service__auth__exim__xtgasrjnair2if9s_11py1dhfqjmpvo65urfiefdgflkgf4hbaqgjzdcom6ly2cm@xxxxxxxxxx.fr) 2016-07-25 11:56:43 dovecot_plain authenticator failed for localhost [127.0.0.1]:45566: 535 Incorrect authentication data (set_id=__cpanel__service__auth__exim__tciacockitphs2rlxpht2n4f_0u4dsexfssas6fj5k0itumsbzqpj6nykm9itchm@xxxxxxxxxxx.fr) 2016-07-25 11:59:57 dovecot_login authenticator failed for (axxxxx3h) [78.1xx.2xx.1xx]:4994: 535 Incorrect authentication data (set_id=emailing@axxxxxxxx.fr) 2016-07-25 12:11:46 dovecot_plain authenticator failed for localhost [127.0.0.1]:45682: 535 Incorrect authentication data (set_id=__cpanel__service__auth__exim__ikiowoj8xlxybvkj4osayavzgnhxuxooznxy97reqijvpwnoexl297b6q2ocayh2@axxxxxxxxxxxx.fr) 2016-07-25 12:26:49 dovecot_plain authenticator failed for localhost [127.0.0.1]:45820: 535 Incorrect authentication data (set_id=__cpanel__service__auth__exim__a_zh051vvbpa0ufxteqgtt7vgyuumeobmmxvcnzm5xq6p7hip4d3u7ue32yolz5l@axxxxxxxx.fr) 2016-07-25 12:41:53 dovecot_plain authenticator failed for localhost [127.0.0.1]:45890: 535 Incorrect authentication data (set_id=__cpanel__service__auth__exim__hrwyccbrgmz7x7jnl0cakojckwtrgolf9ez9sehazltt_ranlidthmyqk_nalafq@axxxxxxxxx.fr) 2016-07-25 12:56:57 dovecot_plain authenticator failed for localhost [127.0.0.1]:46024: 535 Incorrect authentication data (set_id=__cpanel__service__auth__exim__3aeqfltplu3oaytwetcscizqeuasghguabhkefp8uicebutufnorudetpxlbjwkd@xxxxxxxxxxs.fr)

Comments

6 comments

Date Votes
  • cPanelMichael
    Hello, Could you verify if the system has sufficient disk space and inodes? You can check this with the following commands:
    df -h df -i
    Also, what are the permission and ownership values on /var/cpanel/serviceauth and it's subdirectories (e.g. exim, imap)? Thank you.
    0
  • Ippo13
    Hello Michael, Thanks a lot for your answer. df -h and df -i gave : Filesystem Size Used Avail Use% Mounted on /dev/root 77G 15G 59G 20% / devtmpfs 32G 0 32G 0% /dev tmpfs 32G 0 32G 0% /dev/shm tmpfs 32G 1.3G 31G 4% /run tmpfs 32G 0 32G 0% /sys/fs/cgroup /dev/sda2 361G 258G 85G 76% /home tmpfs 6.3G 0 6.3G 0% /run/user/0 root@nxxxxxxx9 [/etc/firewalld]# df -i Filesystem Inodes IUsed IFree IUse% Mounted on /dev/root 5120000 176114 4943886 4% / devtmpfs 8231574 1518 8230056 1% /dev tmpfs 8239950 1 8239949 1% /dev/shm tmpfs 8239950 1670 8238280 1% /run tmpfs 8239950 13 8239937 1% /sys/fs/cgroup /dev/sda2 24027136 1001603 23025533 5% /home tmpfs 8239950 1 8239949 1% /run/user/0
    ls -al : drwx--x--x 10 root root 4096 Jul 24 20:57 serviceauth/ subdir : total 64 drwx--x--x 10 root root 4096 Jul 24 20:57 ./ drwx--x--x 94 root root 12288 Jul 26 17:07 ../ drwx------ 2 root root 4096 May 19 15:39 cpdavd/ drwx------ 2 root root 4096 May 19 15:39 cpsrvd/ drwx------ 2 root root 4096 Jun 3 02:57 dnsadmin/ drwxr-x--- 2 root mail 4096 Jul 24 20:57 exim/ drwxr-x--- 2 root mail 4096 Jul 24 20:15 exim_old/ drwx------ 2 root root 4096 May 19 15:37 ftpd/ drwx------ 2 root root 4096 Jul 24 20:24 imap/ drwx------ 2 root root 4096 Jul 24 20:01 imap_old/ -rw-r--r-- 1 root root 64 Jul 26 17:07 recv -rw-r--r-- 1 root root 64 Jul 24 20:18 recv_old -rw-r--r-- 1 root root 64 Jul 26 17:07 send -rw-r--r-- 1 root root 64 Jul 24 20:18 send_old we have some "old" files because we tried to delete /exim/ and /imap/ folders then reboot to resolve the problem (i saw this on another topic). Thanks a lot
    0
  • cPanelMichael
    Could you open a support ticket using the link in my signature so we can take a closer look? You can post the ticket number here so we can update this thread with the outcome. Thank you.
    0
  • Mysticeti
    Was there any resolution to this issue? Just wondering as I've started seeing "The service "exim" appears to be down" alerts every few days lately. Disk space would not seem to be an issue on my VPS. Thanks.
    0
  • cPanelMichael
    New Was there any resolution to this issue? Just wondering as I've started seeing "The service "exim" appears to be down" alerts every few days lately. Disk space would not seem to be an issue on my VPS.

    Is there any particular output to /var/log/exim_mainlog or /var/log/exim_paniclog at the times when Chkservd detects it as down? Thank you.
    0
  • Mysticeti
    There wasn't anything at all in exim_paniclog (it was empty) and I didn't see anything obvious in exim_mainlog. But the good news is the problem seems to have gone away as I haven't seen any "exim appears to be done" messages in a week. Cheers.
    0

Please sign in to leave a comment.

Didn't find what you were looking for?

New post