I was reading through my logs and came across about 100 attempts to login to my server via ssh. They were all blocked, but should I get these IPs blacklisted or what? I've already blocked em from the server, but should I try and blacklist them?
View 7 RepliesI have problem with exim in my dedicated. All days I have more tham 1000 messages in queue. I delete frozen messages and run exim -v -q and after delete all message. Next day I have more that 1000 message in queue.
I see that some local emails was not delivered. So I saw in exim log errors messages as:
===
Message 1K5SHE-0001LE-LS is not frozen
delivering 1K5SHE-0001LE-LS
LOG: MAIN
== dadinho@xx.org R=virtual_user T=virtual_userdelivery defer (13): Permission denied: while opening or reading /home/levarte/mail/xx.org/dadinho/maildirsize
===
But I have not any file called "/home/levarte/mail/xx.org/dadinho/maildirsize"
What means this error message?
While reviewing a Webalizer log of one of my clients' accounts, I found unknown users under "Top Usernames" table.
They kept appearing since 7 months ago, every month..
Names include persistent users:
setup
username
2661
other user names appear and go.
I am a hosting reseller and worried about being hacked.
Warning!
This is a very positive--well, basically a rave--about my experience with a web hosting service today.
Please, read no further if you only like to focus on the negative in life!
After being with relio.com for about a year and a half, turns out I needed help transitioning some domains to a new account. And turns out, weberz.com is now who I have to contact for support because they bought relio. Turns out there were some things I just couldn't do for myself, and I ended up on the phone with Rob, the system admin today. Talk about great help! He stayed on the phone, patiently working through all of my issues until they were resolved. Afterwards I decided to poke through their support forums to learn more about a company that has this level/quality of service, and I was even more confident that I am with a good web hosting service that can grow with me over time.
I logged into my email to check for my nightly logwatch report (at 12am).
Nothing.
So I log into ssh and manually run it, get greeted with this:
You have old files in your logwatch tmpdir (/var/cache/logwatch):
logwatch.zcTV3hC0
The directories listed above were most likely created by a
logwatch run that failed to complete successfully. If so, you
may delete these directories.
I last ran logwatch around 10:30pm, it worked fine.
I try to run logwatch again, same error.. except now there's another temp file showing beneath the first.
I go ahead and delete both of them, run logwatch again...it worked. I also got the other reports from when I tried running logwatch manually and was stopped with this error.
I've never had this happen before, so I'm curious as to what caused it? Logwatch is in cron.daily and has never missed a single report.
Just typical data corruption (as can happen with any computer file) or could something have interfered with its processing at 12?
After all the exploration I decided order from LiquidWeb..
I am really excited .
I am gonna order today...will report how it all went!
I used to recommend Hostway.com to other companies, as they host our eCommerce site as a shared hosting site and their uptime and customer service were very good.
But, NEVER AGAIN. Today, they have been down ALL DAY since around 10:30 am (they would not give me the exact time) and so has our business site! I called twice and the wait time the first time for a tech support person was over 1 hour! IN-FRIGGING-CREDIBLE! The 2nd call a few hours later was at least a 45 minute wait.
The answer I got was that they had a hard drive crash and my site is unlucky enough to live on that drive. Understandable, but their explanation that it takes ALL DAY to restore a hard drive from tape is incredible (or havent they heard of RAID systems??). In any case, our site came back up for a few minutes and is back down again. Downtime since 10:30 or so is approaching 6 hours now!
So, I will no longer recommend HOSTWAY to anyone for any reason. The incredible wait times on the phone line are ridiculous and we have lost $$$ today due to this outage and associated loses from adwords, too.
Finally, it seems that Hostway's other problem is that they are trying to offer too many other kinds of services besides just hosting (which they used to be good at), and now they suck at their core basic service. That's my two cents.
Any recommendations for a replacement hosting service that is reliable and well known?
I think I pay about $50/3 months for Hostway.
is it possiable to delete these files in the server access_logs and errors_logs
View 1 Replies View RelatedWhat does green and blue color mean? is my total amount of traffic the total of both colors?
View 4 Replies View Relatedcss $ ls -l /san
ls: reading directory /mountfd: Too many open files
total 0
I have a DELL LTO-4 Drive, which is brand new, less than 2 weeks old.
I am trying to read an LTO-3 Tape, using TAR, and saving it to a USB harddrive.
The first time i read the tape i filled a 200GB usb harddrive overnight, and now im trying to read the tape again (because we originally thought there was only 172GB on the tape).
The problem now is, im using the exact same command to extract the tape but its going painfully slow. For example, over a 12 hour period it extracted 1.1GB
What could have caused this huge slow down.
Even if i just list the contents of the archive.... it still reads slow, so its not the device its saving too thats slow.
im using just tar -xf <tape device> to extract and tar -tvf <tape device> to list the contents... both take ages to read something though should be read in a few seconds.
The tape drive reads the first 3MB within 1/2 a second... then i hear the tape mech slow down.
This is using a mandriva livecd since the only machine which has this tape drive connected is our windows 2003 server (tape drive is on a SAS Controller which none of our linux machines have).
What could have possibly caused this slowdown if im using the same tape drive, tape, controllers & livecd and what could i do to speed this process up, as i need to read this tape within 12 hours while the server is not being used.
although mod_rewrite is active but htaccess i not read why?
and how can i know mod_rewrite is active or not?
(Plesk 7.x)
A weird thing happents once on few days on my server, and it's not a regular thing or on exact time.
When I have this problem no page can be loaded in the browser, but WHM is working, i think because it's accessed by IP .
In apache status page I can see lots of ..reading.. requests which are there even for 10 - 20 seconds sometimes.
Usualy the server has 10 - 20 requests/s :
CPU Usage: u35146 s2297.05 cu2.74 cs4.5 - 6.97% CPU load
11.2 requests/sec - 83.0 kB/second - 7.4 kB/request
10 requests currently being processed, 8 idle servers
But when the ..reading.. requests appear it goes much higher like 100 to 200
11.5 requests/sec - 85.3 kB/second - 7.5 kB/request
200 requests currently being processed, 0 idle servers
after 3 minutes :
160 requests currently being processed, 30 idle servers
When I logged on to SSH I saw that there are ~150 conection from a single IP .
In the forum [url]suddenly we got Internal Server Error. Our host claims it is because of corrupted database accorind the logs:
081128 11:44:38 [ERROR] Got error 126 when reading table './lykman_clubcento/lykman11_members'
Repairing the database from cpanel didnt work. Old available backups are not available.
As you can see my apache is full of Reading connections..... they are filling up my server dening legitimate users to browse trought the websites hosted there... I think this is what is happening to me:
http://mail-archives.apache.org/mod_...l.gmail.com%3E
Im using apache 1.3.3.7 on RHES 3 with latest patches and kernel.
930 requests currently being processed, 6 idle servers
RRRRRRRRWRRRRRWRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR
RRRRRRRRRRRRRRRRRRWRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR
RRRWRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRWRRRRRRRRRRRRR
RRRRRRRRRWRRRWRRRRRRRRRRRRRRRWRRRRRRRRRRRRRRRRRRRWRRRRRRRRRRRRRR
RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR_RRRRRRRRRRRRR_RRRRRRR
RRRRRRRRRRRRRRRRRRRRRRWRRRWRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR
R_WRRRRRRRRRRRRRRRRRRRRWWRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR
RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRWRRRRRRR
RRRRRRRRRRRRRWRR_RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR_
RRRRRRRRRRRRRRRRRRRRRRWRRRRRRRRRRRRWRRRRRRRRRRRRRRRRRRRRRRRRRRRR
RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRWRRRRRRRRRRRRRRRRRRRRRRRRRRRR
RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR
RRRRRRRRRRRRRRRRRRRRRRRRR_RRRRRRRRWRRRRRRRRRRRRRRRRRRRRRRRRRRRRR
RRRRRRRRRRRRRRWRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRWRRRRR
RRRRRRRRRRWRRRRRRRRRRRRRRRRRRRRRRRRRR.RRR.......................
1-044940/40/40R 0.33340.00.060.06 ??..reading..
2-044950/55/55R 0.47330.00.110.11 ??..reading..
3-044960/35/35R 0.31330.00.050.05 ??..reading..
4-044970/38/38R 0.13210.00.090.09 ??..reading..
5-045410/40/40R 0.16360.00.130.13 ??..reading..
6-046190/28/28R 0.12110.00.030.03 ??..reading..
7-046220/34/34R 0.35320.00.100.10 ??..reading..
8-051640/34/34R 0.135100.00.300.30 ??..reading..
Also, here is the top output of the top command:
top - 12:46:21 up 10 min, 1 user, load average: 1.40, 2.03, 1.06
Tasks: 1063 total, 2 running, 1060 sleeping, 0 stopped, 1 zombie
Cpu(s): 4.9% us, 1.6% sy, 0.0% ni, 93.1% id, 0.3% wa, 0.0% hi, 0.0% si
Mem: 2073516k total, 2001984k used, 71532k free, 42384k buffers
Swap: 2048276k total, 0k used, 2048276k free, 178096k cached
Server seems to be fine, but total tasks are always between 1060 and 1124... thats very rare too..
how to avoid this attack?
I had do a backup with the plesk 11.5, the backup includes sites, configuration and emails. The restore of the backup don't create all the emails and email folders. There was a way to read or convert the .msg files that exists inside the backup files? A way to convert that msg files to pst or other format that can read by an email client.
View 1 Replies View RelatedI am running apache 2.0 on CentOS 4.4 with PHP5 and mysql 5. I am wondering why the following is happening with apache:
if I goto to [url]
This does not work, it times out. But if I goto:
[url]
With the trailing slash it works. That is annoying, anyway to take care of that so it works with or without the trailing slash? Below is my httpd.conf folder and virtual host settings:
---------------------------------------------------------------------------------------------------------------
<VirtualHost *>
ServerAdmin myemail@mydomain.com
DirectoryIndex index.php index.html index.htm index.shtml
<Directory "/var/www/html/">
Options ExecCGI FollowSymLinks Includes IncludesNOEXEC SymLinksIfOwnerMatch
AllowOverride none
</Directory>
</VirtualHost>
#
# Each directory to which Apache has access can be configured with respect
# to which services and features are allowed and/or disabled in that
# directory (and its subdirectories).
#
# Note that from this point forward you must specifically allow
# particular features to be enabled - so if something's not working as
# you might expect, make sure that you have specifically enabled it
# below.
#
<Directory "/">
Options FollowSymLinks
AllowOverride None
</Directory>
<Directory "/var/www/html">
Options Indexes Includes FollowSymLinks
AllowOverride None
Allow from all
Order allow,deny
</Directory>
<Directory "/var/www/icons">
Options Indexes MultiViews
AllowOverride None
Allow from all
Order allow,deny
</Directory>
<Directory "/var/www/cgi-bin">
Options ExecCGI
AllowOverride None
Allow from all
Order allow,deny
</Directory>
I have this System Debain 7.x Whyzee, 64 Bit Version, 16 GB Ram with 8 x 3.2 GHZ. I have update plesk von version 11 to version 12 he say any failure in error.logs by costumer
Code:
[Sat Jul 19 20:58:23 2014] [warn] [client xx.xx.xx.xx] (104)Connection reset by peer: mod_fcgid: error reading data from FastCGI server
[Sat Jul 19 20:58:23 2014] [error] [client xx.xx.xx.xx] Premature end of script headers: index.php
We are currently using Apache 2.2.10 as the reverse proxy for the SAP portal server 7.3.1. The SAP applications are built based on webdynpro abap technology.2 of the apps are getting intermittent spinning circles. The Apache server will ultimately timeout and give the "bad request" and HTTP 400. We were never able to reproduce the problem except we do see users are running into them. Obviously, the problems occur very randomly, but often enough to generate a lot of support tickets. No error was generated in the sap system log.
Here is what I see from the apache access log and error log:
[31/Jul/2014:23:50:26 -0400] TLSv1 AES128-SHA "POST /sap/bc/webdynpro/sap/ZR_SSEPP_OPERATIONAL_SCHEDULE;sap-ext-sid=VcFRQjFOvu8TJYp9gDoeAA--4x1GQAg0MPPjCUEQif5iWQ--?sap-contextid=SID%3aANON%3asapprd_PR3_03%3aezUnW-FXtaYVyXREaAD7rxW0k8o5pk_n9RfjPfcB-NEW HTTP/1.1" 400 3004 "https://xxxxx/sap/bc/webdynpro/sap/ZR_SSEPP_OPERATIONAL_SCHEDULE;sap-ext-sid=VcFRQjFOvu8TJYp9gDoeAA--4x1GQAg0MPPjCUEQif5iWQ--" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)" 706345611
[Fri Aug 01 14:19:07 2014] [error] [client 10.4.53.198] (70014)End of file found: proxy: error reading status line from remote server xxxxxx, referer: https://xxxxx/sap/bc/webdynpro/sap/ZR_SSEPP_OPERATIONAL_SCHEDULE;sap-ext-sid=RaH2yjQlV6o7wVaj6wv6zA--LXTMFzjjKvcuwT*DXWoBmA--
I found bug 37770 and went to see the apache admin. But he thinks that the parameter(proxy-initial-not-pooled=1) that fixes the bug only applies to mod_proxy_http. However, we are using mod_proxy.
i have plesk 11.5.3 on Linux centOS 6, I created a ftp user on a domain folder, I need to deny this user to read a specific file .php, how can I do?
View 7 Replies View RelatedI changed to a new server with plesk 12 and every php that worked with Plesk 11.5 and php 5.4 doesn't work in the new server with fstcgi and php 5.4. They run fine if I config subdomain with FastCgi php5.3 but don't with php 5.4.35. I get this error message in error_log of subdmain using this versión of php (104)Connection reset by peer: mod_fcgid: error reading data from FastCGI server. Premature end of script headers: test.php
there is no error in /var/log/httpd/suexec_log phpini seems OK.My system uses Centos 6.4 and
I get "502 Bad Gateway" errors in browser and found this in logs:
- upstream prematurely closed connection while reading response header from upstream
- failed (111: Connection refused) while connecting to upstream
restarting Apache solves the problem temporarily.I tried tweaking both nginx and php-fpm config files without success.
PleskLog File
104)Connection reset by peer: mod_fcgid: error reading data from FastCGI server
[Mon Jun 22 15:33:11 2015] [error] [client 176.10.112.11] Premature end of script headers: import_cop.php
and Apache Log
[Mon Jun 22 11:06:57 2015] [error] server reached MaxClients setting, consider raising the MaxClients setting
[Mon Jun 22 15:46:17 2015] [error] (12)Cannot allocate memory: fork: Unable to fork new process
PHP Warning: Module 'zip' already loaded in Unknown on line 0
How can I fix this problem? The Script is 100% i/O because it has worked onder PHP 5.2 and its comp. whit 5.4.
I have an issue with running of the php-scripts. It runs via Cron (as it consumes a lot of memory), after aprox. 10 minutes after the start-time of the script the following error appears in the error-log file (path - /var/www/vhosts/system/subdomain.domain.tld/logs/error_log)
[Tue Feb 17 19:46:57.003326 2015] [fcgid:warn] [pid 28629] (104)Connection reset by peer: [client XX.XXX.XXX.XXX:48450] mod_fcgid: error reading data from FastCGI server
[Tue Feb 17 19:46:57.003368 2015] [core:error] [pid 28629] [client XX.XXX.XXX.XXX:48450] End of script output before headers: Name_of_the_script.php
For a very strange reason another PHP-script, that has the same code, but just runs less arrays, and therefore consumes less memory and can be run via browser - works perfectly from both browser and the cron. The php.ini for this domain set up correctly (see the attachment)...
I have this error.
Code:
[Mon Mar 23 20:53:14 2015] [warn] [client xxx.xxx.xxx.xxx] (104)Connection reset by peer: mod_fcgid: error reading data from FastCGI server
[Mon Mar 23 20:53:14 2015] [error] [client xxx.xxx.xxx.xxx] Premature end of script headers: index.php
My VPS
OSDebian 7.8
Plesk version12.0.18 Update #38
Code:
<IfModule mod_fcgid.c>
<IfModule !mod_fastcgi.c>
AddHandler fcgid-script fcg fcgi fpl
[Code] .....
I'm trying to add multiple PHP version (current version installed: 5.5.13), using the official documentation. I always get 500 Internal Server Error after switching to the new version, with the following error_log content:
Code:
[Sat Jun 07 00:49:35 2014] [warn] [client XXX.XXX.XXX.XXX] (104)Connection reset by peer: mod_fcgid: error reading data from FastCGI server
[Sat Jun 07 00:49:35 2014] [error] [client XXX.XXX.XXX.XXX] Premature end of script headers: index.php
Here you can view phpinfo() obtained running php54-cgi index.php from the command line. Same script doesn't work as FastCGI.
I'm trying to add PHP 5.4.29. Here is how I compiled it:
Code:
./configure
--prefix=/usr/local/php54
--with-bz2
--with-config-file-path=/usr/local/php54/etc
--with-config-file-scan-dir=/usr/local/php54/etc/php.d
--with-curl
[code]....
Switching back to PHP 5.5.13 and the script works fine (a simple phpinfo() output).How can I try to understand/debug what's wrong with the installation?
We have been using Apache 2.2.x with reverse proxy modules for our clients to access their OWA servers for over a year. I want to get us to Apache 2.4.x so I setup a test box with latest 2.4 on it. I fixed the config file issues since 2.4 has changes in it. OWA proxy is working on my test server with Apache 2.4. But with 2.4 I do have an issue I cannot figure out. Note that this does NOT occur with Apache 2.2. I get the following errors when using ActiveSync through reverse proxy:
[Thu Oct 17 12:19:11.670665 2013] [proxy_http:error] [pid 748:tid 8440] (OS 10060)A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond. : [client x.x.x.x:20311] AH01102: error reading status line from remote server mail.nameredacted.net:443
[Thu Oct 17 12:19:11.670665 2013] [proxy:error] [pid 748:tid 8440] [client x.x.x.x:20311] AH00898: Error reading from remote server returned by /Microsoft-Server-ActiveSync
So somehow with Apache 2.4 there is some sort of timeout that was not there with 2.2.
The vps has
256MB(512 burstable) of memory
10GB of HardDisk space
Using Lighttpd, PHP and MySQL
ControlPanel is LXAdmin
top - 05:59:24 up 36 min, 1 user, load average: 0.42, 0.60, 0.62
Tasks: 31 total, 1 running, 29 sleeping, 0 stopped, 1 zombie
Cpu(s): 0.0%us, 0.0%sy, 0.0%ni,100.0%id, 0.0%wa, 0.0%hi, 0.0%si, 0.0%st
Mem: 1048576k total, 55216k used, 993360k free, 0k buffers
Swap: 0k total, 0k used, 0k free, 0k cached
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
1 root 15 0 1964 660 568 S 0 0.1 0:00.46 init
3922 root 15 0 7824 2104 1720 S 0 0.2 0:00.01 sshd
9868 root 15 0 2352 1272 1064 S 0 0.1 0:00.00 bash
11693 root 18 0 2104 1020 820 R 0 0.1 0:00.10 top
17861 root 16 0 1632 620 520 S 0 0.1 0:00.00 syslogd
17918 dbus 25 0 2636 468 328 S 0 0.0 0:00.00 dbus-daemon
17955 root 18 0 5116 956 644 S 0 0.1 0:00.00 sshd
18093 tinydns 18 0 1544 304 252 S 0 0.0 0:00.00 tinydns
18106 root 23 0 1596 372 308 S 0 0.0 0:00.00 tcpserver
18131 apache 18 0 8452 4276 812 S 0 0.4 0:02.27 lighttpd
18132 admin 15 0 38704 24m 6652 S 0 2.4 2:58.37 php-cgi
18224 addons 20 0 22024 8456 4572 S 0 0.8 0:00.01 php-cgi
18278 root 15 0 2348 1112 968 S 0 0.1 0:00.00 sh
19519 root 15 0 4032 1432 1172 S 0 0.1 0:00.00 lxadmin.exe
19557 root 17 0 2608 884 712 S 0 0.1 0:00.00 xinetd
19594 lxlabs 18 0 5364 2220 1160 S 0 0.2 0:00.13 lxadmin.httpd
19879 root 18 0 2344 1124 964 S 0 0.1 0:00.00 mysqld_safe
19921 mysql 15 0 13688 5240 3904 S 0 0.5 0:17.51 mysqld
20250 qmails 15 0 1804 476 372 S 0 0.0 0:00.00 qmail-send
20256 qmaill 18 0 1564 472 404 S 0 0.0 0:00.00 splogger
20260 root 22 0 1576 344 268 S 0 0.0 0:00.00 qmail-lspawn
20261 qmailr 15 0 1572 372 296 S 0 0.0 0:00.00 qmail-rspawn
20275 qmailq 18 0 1560 352 284 S 0 0.0 0:00.00 qmail-clean
21824 root 18 0 6200 1296 960 S 0 0.1 0:00.00 authdaemond
21828 root 15 0 1596 376 312 S 0 0.0 0:00.00 tcpserver
21834 root 25 0 1592 368 308 S 0 0.0 0:00.00 tcpserver
21838 root 18 0 6200 460 124 S 0 0.0 0:00.00 authdaemond
21842 root 18 0 1592 372 312 S 0 0.0 0:00.00 tcpserver
21861 root 25 0 1592 368 308 S 0 0.0 0:00.00 tcpserver
21890 root 18 0 3184 1108 576 S 0 0.1 0:00.00 crond
I just got an email from my vps saying that a BFD attack was stopped and the ip was banned after 40 failed attempts of logging into ftpdpro. I logged in and started looking around and I noticed that in my apf log file there was:
Code:
Jan 15 00:54:07 s1 apf(22290): {glob} firewall initalized
Jan 15 00:54:07 s1 apf(22290): {glob} fast load snapshot saved
Jan 15 00:58:06 s1 apf(32425): {glob} uptime less than 5 minutes, going full load
Jan 15 00:58:06 s1 apf(32425): {glob} activating firewall
Jan 15 00:58:06 s1 apf(32500): {glob} unable to load iptables module (ip_tables), aborting.
Jan 15 00:58:06 s1 apf(32425): {glob} firewall initalized
Jan 15 00:58:06 s1 apf(32425): {glob} fast load snapshot saved
Jan 15 01:00:04 s1 apf(3950): {glob} uptime less than 5 minutes, going full load
My concern is that it says "unable to load iptables module (ip_tables), aborting.