imap failing

[omarfilip]

I've gotten several of these today from my dedicated server. Should I investigate more, or is there no reason for concern?

imap failed @ Sun Apr  4 23:17:41 2010. A restart was attempted  automagically.
Service Check Method:  [tcp connect]

Failure Reason: TCP Transaction Log:
<< * OK [CAPABILITY IMAP4rev1 UIDPLUS CHILDREN NAMESPACE  THREAD=ORDEREDSUBJECT THREAD=REFERENCES SORT QUOTA IDLE ACL ACL2=UNION  STARTTLS] Courier-IMAP ready. Copyright 1998-2008 Double Precision, Inc.   See COPYING for distribution information.
>> A001 LOGIN __cpanel__service__auth__imap__9KzSjhNn7HO0INXnmBQCQH8LhWF1WG... jaXjwfqkxnVgCKGC
<<
imap: ** [ != A001 OK]

[sergey]

Change the below setting in WHM > Tweak Settings to 3 (it's supposed to be a default level). Let us know if these emails persist in the same high volumes as before after the changes.

The number of times a ChkServd TCP check must fail before notification is sent and the service is restarted. On heavily loaded systems these types of service checks fail occasionaly producing erroneous indications that services are down. A setting of 0 will disable all notifications and restarts due to TCP checks. Setting this value to 3 or higher is recommended for most systems.

[omarfilip]

It's already at 3, so I'll try 4.

[omarfilip]

Just got another one with the setting at 4. I don't recall getting this message before today.

[Matt]

We have a ticket open with cPanel about it. It seems to be some issue with a recent update. it seems to be false positives and not something that actually affects quality of service, but we are working to have them get the bug resolved.

[omarfilip]

OK, thanks.

[Matt]

Switching to Dovecot mailserver from Courier mailserver seems to have fixed the issue on your server. Let us know if you see more of the same after this update.

[omarfilip]

Ok, thanks for the update, I'll keep an eye on it.

Meanwhile I've received a ton of these, or similar:

Time:    Mon Apr  5 21:11:39 2010 -0500
PID:     29394
Account: nobody
Uptime:  360971 seconds

Executable:

/usr/sbin/proftpd\004bb51641\00\00\00\00\00\00\00\00 (deleted)

The file system shows this process is running an executable file that  has been deleted. This typically happens when the original file has been  replaced by a new file when the application is updated. To prevent this  being reported again, restart the process that runs this excecutable  file. See csf.conf and the PT_DELETED text for more information about  the security implications of processes running deleted executable files.


Command Line (often faked in exploits):

proftpd: (accepting connections)


Network connections by the process (if any):

tcp6: 0.0.0.0:21 -> 0.0.0.0:0

Files open by the process (if any):

/dev/null

Memory maps by the process (if any):
...

[Alexander]

Hi, some modifications have been added into lfd ignore file. This should resolve the issue.

[omarfilip]

Thanks, Alex.