I have a server of my own. Unfortunatlly 20% of the time, the server is down even though my connection to internet always up.
I am checking the event log but cannot see anything odd...
OS:Windows server 2003
Is there any tool to detect why the server is down most of the time?
I can post the event viewer errors that I can find suspeicious if needed.
If i put domain.com on uptime checker,and downtime is detected,downtime will be reported if dns is down or if http server is down.So question is what i need to do to see what exactly went down?For network uptime i can ping ip adress,but for these two i really don't know.
View 3 Replies View RelatedHow does one go about detecting what mail server software you have installed and running on your server?
View 2 Replies View RelatedI am suspecting that we have spyware or virus on our server. How do I detect and remove it from windows 2003 server?
View 6 Replies View RelatedI'm noticed I was getting bounced email errors from a company I was sending email through and I further investigated this by running a dnsreport on my domain.
Turns out that it fails at Acceptance of NULL <> sender, Acceptance of postmaster address, and Acceptance of abuse address. The domain that I ran a test on is using a new IP that I had recently added to my Direct Admin server. None of the other domains on my server are having issues like this.
Is is possible that I need to do something to enable these new IP addresses in exim? I mean, exim obviously responds to that IP address, but it seems to be having some issues with it.
on my new VDS I get this error in one of my php scripts that ran fine on another server.
Fatal error: Call to undefined function: date_default_timezone_set() in /home/board/public_html/forum_testing/Top.php on line 5
I think it's in the settings somewhere in WHM.
im sitting on a VPS with cpanel+exim 4.66 installed. email accounts are working & i can receive/send emails. however im getting a few errors from some servers that i send email to
Code:
asdf@asdf.com.au
SMTP error from remote mail server after RCPT TO:<asdf@asdf.com.au>:
host asdf.mail.asdf.net.au [111.111.111.111]:
550 Reverse DNS is not setup correctly for this host.
At the moment, my VPS has 3 IP addresses, which are (imaginary) 192.168.0.1, 192.168.0.2, 192.168.0.3,
Exim is currently sending emails(webmail, smtp auth'd php scripts) via 192.168.0.3
my domain.com at the top level resolves to 192.168.0.1, mail.domain.com resolves to 192.168.0.3(aname - should this be a cname?) and the MX pointer record points at mail.domain.com
if i do a reverse lookup of my 192.168.0.3, it resolves to:
Code:
192.168.0.3 resolves to
"3.0.168.192-static.reverse.softlayer.com"Top Level Domain: "softlayer.com"
which is my VPS host.
Have i configured something wrong here? should 192.168.0.3 be resolving to my domain.com instead?
Tailed apache logs and found this:
[Sun Apr 20 08:29:34 2008] [debug] proxy_util.c(1778): proxy: initialized single connection worker 0 in child 10308 for (*)
[Sun Apr 20 08:29:34 2008] [debug] proxy_util.c(1670): proxy: grabbed scoreboard slot 0 in child 10309 for worker proxy:reverse
[Sun Apr 20 08:29:34 2008] [debug] proxy_util.c(1670): proxy: grabbed scoreboard slot 0 in child 10310 for worker proxy:reverse
[Sun Apr 20 08:29:34 2008] [debug] proxy_util.c(1689): proxy: worker proxy:reverse already initialized
[Sun Apr 20 08:29:34 2008] [debug] proxy_util.c(1689): proxy: worker proxy:reverse already initialized
[Sun Apr 20 08:29:34 2008] [debug] proxy_util.c(1778): proxy: initialized single connection worker 0 in child 10309 for (*)
[Sun Apr 20 08:29:34 2008] [debug] proxy_util.c(1778): proxy: initialized single connection worker 0 in child 10310 for (*)
[Sun Apr 20 08:29:35 2008] [info] server seems busy, (you may need to increase StartServers, or Min/MaxSpareServers), spawning 8 children, there are 2 idle, and 45 total children
[Sun Apr 20 08:29:35 2008] [debug] proxy_util.c(1670): proxy: grabbed scoreboard slot 0 in child 10311 for worker proxy:reverse
[Sun Apr 20 08:29:35 2008] [debug] proxy_util.c(1689): proxy: worker proxy:reverse already initialized
[Sun Apr 20 08:29:35 2008] [debug] proxy_util.c(1778): proxy: initialized single connection worker 0 in child 10311 for (*)
[Sun Apr 20 08:29:35 2008] [debug] proxy_util.c(1670): proxy: grabbed scoreboard slot 0 in child 10312 for worker proxy:reverse
[Sun Apr 20 08:29:35 2008] [debug] proxy_util.c(1689): proxy: worker proxy:reverse already initialized
[Sun Apr 20 08:29:35 2008] [debug] proxy_util.c(1778): proxy: initialized single connection worker 0 in child 10312 for (*)
[Sun Apr 20 08:29:35 2008] [debug] proxy_util.c(1670): proxy: grabbed scoreboard slot 0 in child 10313 for worker proxy:reverse
[Sun Apr 20 08:29:35 2008] [debug] proxy_util.c(1689): proxy: worker proxy:reverse already initialized
[Sun Apr 20 08:29:35 2008] [debug] proxy_util.c(1778): proxy: initialized single connection worker 0 in child 10313 for (*)
[Sun Apr 20 08:29:35 2008] [debug] proxy_util.c(1670): proxy: grabbed scoreboard slot 0 in child 10314 for worker proxy:reverse
[Sun Apr 20 08:29:35 2008] [debug] proxy_util.c(1689): proxy: worker proxy:reverse already initialized
[Sun Apr 20 08:29:35 2008] [debug] proxy_util.c(1778): proxy: initialized single connection worker 0 in child 10314 for (*)
[Sun Apr 20 08:29:35 2008] [debug] proxy_util.c(1670): proxy: grabbed scoreboard slot 0 in child 10315 for worker proxy:reverse
[Sun Apr 20 08:29:35 2008] [debug] proxy_util.c(1689): proxy: worker proxy:reverse already initialized
[Sun Apr 20 08:29:35 2008] [debug] proxy_util.c(1778): proxy: initialized single connection worker 0 in child 10315 for (*)
[Sun Apr 20 08:29:35 2008] [debug] proxy_util.c(1670): proxy: grabbed scoreboard slot 0 in child 10316 for worker proxy:reverse
[Sun Apr 20 08:29:35 2008] [debug] proxy_util.c(1689): proxy: worker proxy:reverse already initialized
[Sun Apr 20 08:29:35 2008] [debug] proxy_util.c(1778): proxy: initialized single connection worker 0 in child 10316 for (*)
[Sun Apr 20 08:29:35 2008] [debug] proxy_util.c(1670): proxy: grabbed scoreboard slot 0 in child 10317 for worker proxy:reverse
[Sun Apr 20 08:29:35 2008] [debug] proxy_util.c(1689): proxy: worker proxy:reverse already initialized
[Sun Apr 20 08:29:35 2008] [debug] proxy_util.c(1778): proxy: initialized single connection worker 0 in child 10317 for (*)
[Sun Apr 20 08:29:35 2008] [debug] proxy_util.c(1670): proxy: grabbed scoreboard slot 0 in child 10318 for worker proxy:reverse
[Sun Apr 20 08:29:35 2008] [debug] proxy_util.c(1689): proxy: worker proxy:reverse already initialized
[Sun Apr 20 08:29:35 2008] [debug] proxy_util.c(1778): proxy: initialized single connection worker 0 in child 10318 for (*)
What on earth is all these proxy_util.c errors?
Also, I could not find any details in the httpd.conf file regarding StartServers, or Min/MaxSpareServers.
I'm using Centos 4 / Apache 2.2 / PHP 5 / Cpanel
So we just switched servers, but some people are reporting that they can either not access the site, or are not being displayed the newest content. What is causing this?
View 3 Replies View Relatedsuddendly some of my sites in my server is taking sessions errors...then after a while all its going ok and then again the same problem...the problem still continues.from what might be the problem?a php update?mysql update?any exprerience?
i havent made any change.my server is linux has centos 4.7
I recently got my very own dedicated server, as in bought one and it is sitting in my desk right now.
I've installed Centos 4.4 (that's what my web server uses, so I just use it for continuity), connected it to my router.
I've gone through a lot of different steps and here's where I am right now:
Because I have a dynamic IP address, I use a free service to direct towards my server. [url]. It works just fine.
I also have to port forward port 80 to go to the server, instead of my laptop or the other desktop currently running off of our router.
I don't know how to set up a web account on the server, so I discovered UserDir. I enabled it in the httpd.conf file. But when I try to access it [url]I get a permissions error. I've made sure the directories are CHMOD'd correctly... so I don't know why I can't access it.
i am tring to setup my own nameservers for the past two days but couldn't get them to work.
i hve already created the ns at godaddy.com. and created dns zone file with corress ponding ips in my vps
iam getting the following error on the dns report. can anyone help me fix them......thanks aloot
Errror 1:
FAIL: Lame nameservers
ERROR: You have one or more lame nameservers. These are nameservers that do NOT answer authoritatively for your domain. This is bad; for example, these nameservers may never get updated. The following nameservers are lame:
xxx.xxx.xxx.xxx < -- my ips
xxx.xxx.xxx.xxx
xxx.xxx.xxx.xxx
xxx.xxx.xxx.xxx
Errror 2:
FAIL : Missing nameservers 2
ERROR: One or more of the nameservers listed at the parent servers are not listed as NS records at your nameservers. The problem NS records are:
ns3.mydomain.com.
ns4.mydomain.com.
ns5.mydomain.com.
ns6.mydomain.com.
Error 3:
FAIL : Single Point of Failure
ERROR: Although you have at least 2 NS records, they both point to the same server, resulting in a single point of failure. You are required to have at least 2 nameservers per section 2.2.
Error 4:
FAIL SOA Record
No valid SOA record came back:
is not mydomain.com.
There is 1000MBPS network set up between three computers and server.
Server has files which program saves.
Program is being run in three different computers.
Each computer tries to get into same file (eg last bill) that was created before. First computer goes in within seconds. second minutes and third just crashes. No matter which computer runs it first, last one crashes.
So called "server" is running on Windows XP pro since it just needs to keep one program files. However I cant find out whats causing file sharing over network bug that crashes access to same file if connection from many computers.
I have had my websites hosted with 1and1.fr for nearly 3 years now and have never had the slightest issue with them. I used to host a static average traffic website plus a punBB forum and some low traffic joomla based websites (nothing that needs much power as you can see).
A week ago, I bought a website (wordpress blog) and the guy included two proxies in the sale. I installed the two proxies and had a lot of trouble installing the wordpress blog so I moved it to another host where it now works all right. However, I am still getting 500 Internal Server Errors on my initial host (I thought it was caused by the wordpress blog) on all my websites hosted at 1and1 and it happens almost every other page!
I have many questions:
- are the proxies the cause?
- how can I know my websites have been moved to another server?
- do you think a VPS can solve the problem, or do I need a dedicated server?
- what is the best solution for hosting proxies?
I have sent a ticket to them yesterday and I am still waiting!
How do you know your clients are sending bulk/spam emails?
I don't seem to understand the reports in "Email >> View Mail Statistics" section of WHM.
I have a private vps server works under linux ( centos ), sometimes am getting msg from csf/firewall subject:
lfd on website.com: Suspicious process running under user user account
when i check my cpanel/whm vps ( service status ) its shows that the memory limit 80% - 85% , It's had a good forum works with vb, but am wonder how to check my vps memory, i mean how to detect if there any script, or malware, or anything takes the vps memory out...
Is there any way to check,know what works under my vps, so it's take my memory limit 85%?
i check the tmp folder,
root@www [/home]# cd /tmp
root@www [/tmp]# ls -la
total 364
drwxrwxrwt 6 root root 4096 Jul 25 02:14 ./
drwxr-xr-x 21 root root 4096 Jul 18 02:21 ../
drwxrwxrwt 2 root root 4096 Jun 30 05:50 .ICE-unix/
drwxrwxrwx 18 root root 4096 Jul 2 17:33 eaccelerator/
lrwxrwxrwx 1 root root 27 Jul 18 02:13 mysql.sock -> ../var/lib/mysql/mysql.sock=
drwxr-xr-x 3 root root 4096 Jun 30 05:29 pear/
drwx------ 3 root root 4096 Jul 5 18:31 spamd-23647-init/
-rw------- 1 root root 343335 Jul 19 02:50 whatis.bk6140
root@www [/tmp]# cd /home
and the df space
root@www [~]# df -h
Filesystem Size Used Avail Use% Mounted on
/dev/simfs 80G 4.1G 76G 6% /
root@www [~]#
and the services running is
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
root 1 0.0 0.0 2060 156 ? Ss Jun30 1:23 init [3]
root 7465 0.0 0.0 2444 156 ? S Jul03 0:00 /bin/sh /usr/bin/mysqld_safe --datadir=/var/lib/mysql --pid-file=/var/lib/mysql/www.website.com.pid
mysql 7491 0.0 2.5 33452 10440 ? Sl Jul03 11:33 /usr/sbin/mysqld --basedir=/ --datadir=/var/lib/mysql --user=mysql --pid-file=/var/lib/mysql/www.website.com.pid --skip-external-locking
root 10236 0.0 6.0 27396 24764 ? Ss Jul24 0:07 /usr/bin/spamd -d --allowed-ips=127.0.0.1 --pidfile=/var/run/spamd.pid --max-children=3 --max-spare=1
root 11447 0.0 1.9 18364 8020 ? S Jul24 0:00 cpsrvd - waiting for connections
root 11865 0.0 0.7 13672 3260 ? S Jul06 0:00 /usr/local/apache/bin/httpd -k start -DSSL
root 13537 0.0 3.1 15092 13064 ? Ss 00:00 0:02 lfd - sleeping
root 13703 0.0 0.3 3808 1284 ? SN Jul06 0:01 cpanellogd - sleeping for logs
root 13739 0.0 0.6 5856 2844 ? Ss Jul06 0:00 cPhulkd - processor
root 13795 0.0 1.5 14760 6304 ? S Jul06 0:00 cpdavd - accepting connections on 2077 and 2078
root 18161 0.0 0.0 1716 380 ? Ss Jun30 0:24 syslogd -m 0
root 18164 0.0 0.0 1668 72 ? Ss Jun30 0:00 klogd -x
dbus 18193 0.0 0.0 2736 212 ? Ss Jun30 0:00 dbus-daemon --system
root 18213 0.0 0.0 2716 172 ? Ss Jun30 0:00 xinetd -stayalive -pidfile /var/run/xinetd.pid
root 18399 0.0 5.9 27604 24404 ? S Jul24 0:06 spamd child
root 19461 0.0 0.1 3228 684 ? Ss Jun30 0:08 crond
root 19616 0.0 0.0 1820 124 ? Ss Jun30 0:00 /usr/sbin/portsentry -
My server run after 10h sevices ftp is down (network error: connection timed out). may be flood ftp.
how to Detect flood ftp.
I have a few incomplete steps to see if I got some intruder in my Linux system.. But i really would like to have all your suggestions to make a good doc about this matter,
1.- Download and run Rkhunter & Chkrootkit
2.- Run "w", and "netstat -nalp |grep "SHPORTHERE" to see whos connected using SSH
3.- Search for ssh and ftp accepted logins.
Code:
last
cat /var/log/secure* | grep ssh | grep Accept
cat /var/log/secure* |grep ftp |grep Accept
less /var/log/messages | grep ftp
4.- Watch current connections and scan your ports.
Code:
netstat -nalp
nmap 1-65535 localhost
5.- Search for suspicious content on common explotable dirs.
Code:
rm -rf /tmp/sess*
rm -rf /var/dos-*
rm -rf /var/tmp/ssh-*
rm -rf /var/tmp/dos-*
ls /tmp -lab
ls /var/tmp -labR
ls /dev/shm -labR
ls /usr/local/apache/proxy -labR
ls /usr/local/samba -labR
6.- Checking for anomalies on this files.
Code:
less /etc/passwd
less /etc/shadow
less /etc/groups
7.- Search for new users at sudoers, check wtmp and telnet is not running.
Code:
cat /etc/sudoers
who /var/log/wtmp
cat /etc/xinetd.d/telnet
8.- Find bash history files
Code:
find '/' -iname .bash_history
9 .- Verify the Crontab table
Code:
crontab -l
10 .- Update the slocate database and search for exploits.
Code:
updatedb &
For cPanel servers:
Code:
egrep -i '(chr(|system()|(curl|wget|chmod|gcc|perl)%20' /usr/local/apache/logs/*
egrep -i '(chr(|system()|(curl|wget|chmod|gcc|perl)%20' /home/*/statistics/logs/*
For Ensim servers:
Code:
egrep -i '(chr(|system()|(curl|wget|chmod|gcc|perl)%20'/home/virtual/site*/fst/var/log/httpd/*
Search for shell code:
Code:
cat /path/of/your/web/logs/* |grep "/x90/"
11.- Search for hidden dirs
Code:
locate "..."
locate ".. "
rlocate " .."
locate ". "
locate " ."
12.- Search for perl-scripts running
Code:
ps -aux | grep perl
13 .- Checking nobody user and open files.
Code:
service httpd stop
lsof -u nobody
I moved over a 400mb ish forum database for VBB to another server and ran into
MySQL Error : Duplicate entry '0' for key 1
Which I imagine would have to do with auto incriment? What can I do about this? Is there a way I can bring it over and not hit this? Way to fix it? In the meantime all of the viewers cannot use the forum because I was forced to put it into maintenance mode so that no one can run into errors etc.
After upgrade to Parallels plesk v 12.0.18 update #5 we were getting a blank screen. We have managed to get logged into the server but have errors - plus all the websites are down with a 404 error Apache Server at gardenbuildings.domainame.co.uk Port 443.
On the Plesk management it is showing: New configuration files for the Apache web server were not created due to the errors in configuration templates:
mkdir: cannot create directory `/var/www/vhosts/system/domainname.com/conf': No such file or directory mktemp: failed to create file via template `/var/www/vhosts/system/domainname.com/conf/httpd.conf.XXXXXX': No such file or directory Can not create temporary file .
Detailed error descriptions were sent to you by email. Please resolve the issues and click here to generate broken configuration files once again or here to generate all configuration files.
Also when trying to resolve the issues and generating all configuration files I am getting this error:
Unable to configure the web server: Execution failed. Command: httpdmng Arguments: Array ( [0] => --reconfigure-all )
Details: Execution failed. Command: httpdmng Arguments: Array ( [0] => --reconfigure-domains [1] => addisonousebank.co.uk,blog.addisonousebank.co.uk,garages.addisonousebank.co.uk,
[Code] ....
is there any proved method to determine what kind of attack you are under? Our server has been under attack for more than a day now but so far we have not been able to find out what kind of attack it is exactly. The server maintence company we are using says it's a DDoS attack but they don't say how they found this out. Also, they are not telling us what kind of DDoS attack it is.
View 14 Replies View Relatedi have some issue,
sometimes,a user may be banned by our firewall,
or the dns of his pc does not work well,...and so on,
by the way,
they can not link to server,
and it spend a lot of time to check where is wrong from his pc aside.
i want to ask if it is possible i use a php script or a exe let him to execute,
and it will help me detect user's pc configuation,
it include his IP/DNS/fateway/trace and ping result,...and so on.
Is there any way to distinguish a dedicated server from VPS using Linux commands and detect the implemented virtualization technology like XEN and OpenVZ, ...?
I have received a dedicated server and in cPanel its written Virtuozzo but they tell me it's XEN , beside this what's the reason to implement a virtualization technic while they give me a dedicated server? Maybe to obtain cheaper cPanel license,
Do web hosts have the means to self-detect or self-correct problems with people's websites? If so, is there a name for this ability?
Seems that every host I've used has to be *told* about major problems, such as the server or database being down completely. I'm tired of going out of town fearing a site crash. I don't expect them to catch every problem, but when the failure is so blatant, it would be nice if they caught it...
How would I find a host who does this?
how i can detect and disable C99 shell and another shell script exp:r57 ....
View 9 Replies View RelatedI know the ISP is RADIGRAFICA COSTARRICENSE, and the server location is San José in Costa Rica.
I googled the ISP name RADIGRAFICA COSTARRICENSE, trying to find out the company site which offer's web hosting service, but I can only find racsa.co.cr; however, this doesn't look like a web hosting company.
On one server which i have sometime appear very high load up to 70,and that causing downtime of few minutes(i have historic data webmin module where i saw high load and downtime time matches,but it doesn't show what causing it).That server also have hardware raid in mirror mode.(copies exact data from one disk to another).
View 14 Replies View RelatedSometime ago the DC told me there was too many files on server and I started to investigate what is was and i got info that some one hacked the server and was sending spam from it.
When I looked at the accounts in Direct Admin some of them had the contact email to some hacker so i deleted the emails and changed password on the DA account and the email of those accounts.
Still I got too many files all the time so the server goes down so i have to delete the spoolfile all the time like 10 times a day
Please help how do I detect from what account do the hacker operate?
Can I detect that somehow?
Is it possible to do some small script to detect this?
Is there any advanced module to DA that gives me the info?
Everything I found is the type of RAID controller installed. It's Adaptec 4800SAS SA-SCSI RAID-10. Nothing in /proc about types of HDDs.
View 7 Replies View RelatedMy server running centOS4 and cPAnel.
Can anyone let me know how to auto detect a hack local file ? eg: review cgi-telnet, c99sell ....