imap failing

[omarfilip]

Had 3 of these this morning:

imap failed @ Wed Apr 7 06:01:33 2010. A restart was attempted automagically.
Service Check Method: [check command]

Cmd Service Check Raw Output: dovecot is not running

[Matt]

I've updated your case at cPanel.

[omarfilip]

Thanks for keeping it on the front burner, Matt.

[Matt]

Sure thing.

We've increased the max connections for IMAP on your server. Please give this some time and if it persists let us know.

[omarfilip]

How much time is "some time?"

Just got another:

imap failed @ Wed Apr 7 15:46:40 2010. A restart was attempted automagically.
Service Check Method: [check command]

Cmd Service Check Raw Output: dovecot is not running

[Matt]

Hmm, well, is it affecting email service?

If not, and they are just buggy emails, a day or two?

[omarfilip]

I don't think mail is affected - at least nobody has complained yet. I'll give it a few days; who knows, maybe an automatic update from cPanel will fix it.

Meanwhile, I'm still getting the suspicious process for proftp emails:

Time: Wed Apr 7 16:07:47 2010 -0500
PID: 29394
Account: nobody
Uptime: 515537 seconds


Executable:

/usr/sbin/proftpd\004bb51641\00\00\00\00\00\00\00\00 (deleted)

The file system shows this process is running an executable file that has been deleted. This typically happens when the original file has been replaced by a new file when the application is updated. To prevent this being reported again, restart the process that runs this excecutable file. See csf.conf and the PT_DELETED text for more information about the security implications of processes running deleted executable files.


Command Line (often faked in exploits):

proftpd: (accepting connections)

[omarfilip]

Failed to mention - the ftp server seems to be working fine.

[Matt]

Try changing back to pure now, it is more reliable and we only recommend pro as a workaround if there is a problem with pure.

[omarfilip]

OK, I'm back to pure. Even sftp works now when it didn't before.