Unable to stop exim

Mugoma

• April 20, 2017 23:26

Hello, We want to stop exim to do some housekeeping then restart but not working as expected. We do: # service exim stop # service exim status # ps -aux | grep exim This shows exim is not running. So far so good. But: 1. When we open webmail we can see new emails coming in. 2. WHM service status shows exim is UP 3. Process list (via top or WHM) shows exim running Obviously it appears exim is till running though the command prompt shows otherwise. Why?

• 

  SysSachin

  • April 21, 2017 11:04

  Hello, Go to "Service Manager" in WHM, uncheck exim. Save your changes. Log onto SSH and stop exim using below command service exim stop Once you have disabled in Service Manager, chkservd won't restart it

  0
• 

  cPanelMichael

  • April 21, 2017 16:58

  Hello, The previous post is correct. You can disable the service in "WHM >> Service Manager" to ensure it's not automatically restarted by Chkservd. Let us know if that helps. Thanks!

  0
• 

  Mugoma

  • April 21, 2017 18:03

  The previous post is correct

  
  My understanding is that Chkservd checks and restarts services after 5 minutes. So, that's not the issue. Why would Chkservd start a service after a second or two and why would that not show on command prompt? If Chkservd started the service wouldn't it show status as running on the command prompt? Basically, the question is why there's contradictions between what's happening on the system and what command prompt shows.

  0
• 

  cPanelMichael

  • April 21, 2017 18:56

  . When we open webmail we can see new emails coming in. 2. WHM service status shows exim is UP 3. Process list (via top or WHM) shows exim running

  
  Hello, The status in "WHM >> Server Status" stems from the most recent status report from Chkservd. When stopping Exim manually, do you notice any output in /var/log/chkservd.log before Exim starts running again? Thank you.

  0
• 

  Mugoma

  • April 22, 2017 23:27

  This is still not working. I have exim disabled. On the command prompt exim status shows as stopped. But I can still see exim on the process list.

  0
• 

  24x7server

  • April 23, 2017 14:32

  Hi, You can rename the exim restart script. Make sure you have disabled the exim in the service manager section completely. rename /etc/init.d/exim and also /scripts/restartsrv_eximd. See if that helps.

  0
• 

  Mugoma

  • April 24, 2017 04:16

  You can rename the exim restart script

  
  Wouldn't this interfere with normal operation of exim?

  0
• 

  24x7server

  • April 24, 2017 05:35

  Wouldn't this interfere with normal operation of exim?

  
  It is a service start and stop script, so once you are done with your housekeeping, you can rename it back again.. It is only to make sure that the system monitoring does not track it and restart it when you housekeeping it.

  0
• 

  Mugoma

  • April 24, 2017 06:40

  make sure that the system monitoring does not track

  
  Actually there's nothing wrong with start script. Our suspicion is that there's a spammer who's invoking exim directly. That's why the process shows in process list even if service is stopped. We have tried changing permission on exim to allow allow root to execute but this seems to stops exim altogether. So, at the moment what we need ways to block exim from being directly executed.

  0
• 

  Mugoma

  • April 24, 2017 12:08

  We decided to raise support ticket as it's taking too long to get solution from forum: Support ticket: 8405145

  0

Please sign in to leave a comment.