Issue Main.cf suddenly empty

[fliegerhermi]

Server operating system version

Ubuntu 18.04.6 LTS

Plesk version and microupdate number

Version 18.0.46 Update #1

Hi.
Today the main.cf of postfix was suddelny an empty file beeing edited at 11:30.
The mailserver was down shortly after that.
Any idea how this can happen?

Thanks

 

[That reCaptcha sucks]

Hi,
same here on 17. Oct. 2022. The File /etc/postfix/main.cf was emptied at ~16:08
System:
Plesk Obsidian Web Admin Edition Version 18.0.47 Update Nr. 4 on Ubuntu 18.04 LTS

/var/log/syslog

*** anonymized with "example.com"
Oct 17 16:03:30 mail plesk-sendmail[10579]: S10579: from=<[email protected]> to=<=?UTF-8?Q?ACP=20Mail=20Admin?= <[email protected]>>
Oct 17 16:03:30 mail postfix/local[10578]: warning: dict_nis_init: NIS domain name not set - NIS lookups disabled
Oct 17 16:03:30 mail plesk-sendmail[10580]: S10579: add-from: stderr: SKIP
Oct 17 16:03:30 mail postfix/local[10578]: 92F5860770: to=<[email protected]>, orig_to=<[email protected]>, relay=local, delay=0.03, delays=0.02/0.01/0/0, dsn=2.0.0, status=sent (delivered to mailbox)
Oct 17 16:03:30 mail postfix/qmgr[752]: 92F5860770: removed
Oct 17 16:03:30 mail plesk-sendmail[10580]: S10579: py-limit-out: stderr: INFO:__main__:Setting 'X-PPP-Vhost' header to 'mail.example.com'
Oct 17 16:03:30 mail plesk-sendmail[10580]: S10579: py-limit-out: stderr: PASS
Oct 17 16:03:30 mail plesk-sendmail[10580]: S10579: check-quota: stderr: SKIP
Oct 17 16:03:30 mail postfix/pickup[9296]: E3A8A60770: uid=999 from=<psaadm>
Oct 17 16:03:30 mail postfix/cleanup[10313]: E3A8A60770: message-id=<[email protected]>
Oct 17 16:03:30 mail postfix/qmgr[752]: E3A8A60770: from=<[email protected]>, size=13363, nrcpt=1 (queue active)
Oct 17 16:03:30 mail postfix/local[10578]: E3A8A60770: to=<[email protected]>, orig_to=<[email protected]>, relay=local, delay=0.01, delays=0.01/0/0/0, dsn=2.0.0, status=sent (delivered to mailbox)
Oct 17 16:03:30 mail postfix/qmgr[752]: E3A8A60770: removed
*** last entry from running postfix
Oct 17 16:03:30 mail systemd[1]: Started Plesk task: Nginx reconfiguration (example.com,server) (task=1847 process=1847 trace=9876:634d60953e94d).
Oct 17 16:03:30 mail systemd[1]: Started Plesk task: Apache reconfiguration (example.com,server) (task=1846 process=1846 trace=9876:634d60953e94d).
Oct 17 16:03:32 mail systemd[1]: Reloading Startup script for nginx service.
Oct 17 16:03:32 mail nginx[10828]: nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
Oct 17 16:03:32 mail nginx[10828]: nginx: configuration file /etc/nginx/nginx.conf test is successful
Oct 17 16:03:32 mail systemd[1]: Reloaded Startup script for nginx service.
Oct 17 16:03:32 mail systemd[1]: Reloading The Apache HTTP Server.
Oct 17 16:03:32 mail systemd[1]: Stopped Plesk task: Nginx reconfiguration (example.com,server) (task=1847 process=1847 trace=9876:634d60953e94d).
Oct 17 16:03:32 mail systemd[1]: Reloaded The Apache HTTP Server.
Oct 17 16:03:35 mail spamd[3011]: spamd: connection from 127.0.0.1 [127.0.0.1]:54926 to port 783, fd 5
Oct 17 16:03:35 mail systemd[1]: Stopped Plesk task: Apache reconfiguration (example.com,server) (task=1846 process=1846 trace=9876:634d60953e94d).
Oct 17 16:03:35 mail dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, TLS, session=<np8GcTvr9st/AAAB>
Oct 17 16:03:35 mail dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, secured, session=<gLYGcTvr+IZ/AAAB>
Oct 17 16:03:35 mail dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, TLS, session=<yN4GcTvrbNh/AAAB>
Oct 17 16:03:35 mail dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, secured, session=<YvgGcTvrSLl/AAAB>
Oct 17 16:03:37 mail spamd[3010]: prefork: child states: II
Oct 17 16:04:01 mail CRON[10958]: (psaadm) CMD (/opt/psa/admin/bin/php -dauto_prepend_file=sdk.php '/opt/psa/admin/plib/modules/galileo/scripts/galileo-every-hour.php')
Oct 17 16:05:38 mail dovecot: imap-login: Login: user=<[email protected]>, method=DIGEST-MD5, rip=77.64.xx.yy, lip=85.214.xx.yy, mpid=10972, TLS, session=<P/teeDvrduVNQMki>
Oct 17 16:06:09 mail dovecot: service=imap, [email protected], ip=[77.64.xx.yy]. Disconnected: Logged out rcvd=57328, sent=175227
Oct 17 16:06:40 mail postfix/anvil[9825]: statistics: max connection rate 1/60s for (smtp:163.172.108.69) at Oct 17 15:59:26
Oct 17 16:06:40 mail postfix/anvil[9825]: statistics: max connection count 1 for (smtp:163.172.108.69) at Oct 17 15:59:26
Oct 17 16:06:40 mail postfix/anvil[9825]: statistics: max cache size 1 at Oct 17 15:59:26
*** between this timestamps the main.cf was emptied
Oct 17 16:08:02 mail postfix/smtpd[10975]: warning: dict_nis_init: NIS domain name not set - NIS lookups disabled
Oct 17 16:08:02 mail postfix/smtpd[10975]: fatal: in parameter smtpd_relay_restrictions or smtpd_recipient_restrictions, ...
Oct 17 16:08:03 mail postfix/master[750]: warning: process /usr/lib/postfix/sbin/smtpd pid 10975 exit status 1      <========= !!!
Oct 17 16:08:03 mail postfix/master[750]: warning: /usr/lib/postfix/sbin/smtpd: bad command startup -- throttling
*** from now postfix is unable to (re)start

 

[fliegerhermi]

I observed it again when a let's encrypt certificate couldn't be renewed. Maybe that's where it is coming from. I had no time for further troubleshooting, yet.