Unexplained failures

[Eric Pretorious]

In the past two weeks our Plesk Panel server (PP 11.0.9 [Update #60] on CentOS 6.4 [x86_64]) has unexpectedly killed all network daemons and others (e.g., cron) three times, leaving only Apache listening on TCP/7080:

[root@www log]# netstat -tanp
tcp        0      0 :::7080                     :::*                        LISTEN      1462/httpd          
tcp        0      0 :::7081                     :::*                        LISTEN      1462/httpd

I've looked through the log files...

• dmesg
• mysqld.log
• boot.log
• secure
• messages
• cron

...and haven't found anything suspicious except this (just before the gap in logfile entries):

Nov 11 08:24:03 www ntpd[1006]: ntpd exiting on signal 15
Nov 11 08:24:04 www kernel: type=1305 audit(1384158244.151:283034): audit_pid=0 old=902 auid=4294967295 ses=4294967295 res=1
Nov 11 08:24:04 www kernel: type=2404 audit(1384158244.447:283035): user pid=990 uid=0 auid=4294967295 ses=4294967295 msg='op=destroy kind=server fp=97:6d:3e:f1:26:82:9e:99:ff:
7c:95:fb:c2:80:e3:ed direction=? spid=990 suid=0  exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
Nov 11 08:24:04 www kernel: type=2404 audit(1384158244.452:283036): user pid=990 uid=0 auid=4294967295 ses=4294967295 msg='op=destroy kind=server fp=da:7d:4f:70:fb:9b:36:0c:a2:
51:d4:79:f0:74:5e:76 direction=? spid=990 suid=0  exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
Nov 11 08:24:04 www kernel: Kernel logging (proc) stopped.
Nov 11 08:24:04 www rsyslogd: [origin software="rsyslogd" swVersion="5.8.10" x-pid="927" x-info="http://www.rsyslog.com"] exiting on signal 15.
Nov 11 17:36:15 www kernel: imklog 5.8.10, log source = /proc/kmsg started.

Any idea what might be causing these failures? Ideas? Suggestions?

 

[IgorG]

Really not enough information. Reasons can be different. Check output of 'last' command for Nov 11 at least.

 

[Eric Pretorious]

Really not enough information. Reasons can be different. Check output of 'last' command for Nov 11 at least.

Thanks, Igor: The only unusual entry in /var/log/lastlog is the reboot on Monday, November 11 @ 17:36.

 

[IgorG]

Really not enough information. Reasons can be different. Check output of 'last' command for Nov 11 at least.

Do you know who has initiated this reboot?

 

[Eric Pretorious]

Do you know who has initiated this reboot?

Yes -- I rebooted the server after all the services stopped.

 

[Eric Pretorious]

In the past two weeks our Plesk Panel server (PP 11.0.9 [Update #60] on CentOS 6.4 [x86_64]) has unexpectedly killed all network daemons and others (e.g., cron) three times, leaving only Apache listening on TCP/7080:

[root@www log]# netstat -tanp
tcp        0      0 :::7080                     :::*                        LISTEN      1462/httpd          
tcp        0      0 :::7081                     :::*                        LISTEN      1462/httpd

The same failure occurred again today -- This time it occurred after attempting to provision a subscription and register a domain name (renoeyeglassrepair.com) simultaneously using WHMCS w/ the OpenSRS Domains Pro module. The lasting effect of the error seems to have been configuration errors in /etc/named.conf that prevented BIND from starting. (The OpenSRS Domains Pro module [for WHMCS] was able to successfully complete the registration of the domain.)

[root@www named]# /etc/init.d/named status
WARNING: key file (/etc/rndc.key) exists, but using default configuration file (/etc/rndc.conf)
rndc: connect failed: 127.0.0.1#953: connection refused
named is stopped

[root@www named]# /etc/init.d/named start
Starting named: 
Error in named configuration:
zone 0.0.127.IN-ADDR.ARPA/IN: loaded serial 20010622
...
zone example.com/IN: loaded serial 1386577415
zone example.org/IN: loaded serial 1386578246
zone example.net/IN: loaded serial 1386578248
zone 23.236.173.in-addr.arpa/IN: loaded serial 1386647298
zone[COLOR="#FF0000"] renoeyeglassrepair.com[/COLOR]/IN: loading from master file renoeyeglassrepair.com failed: file not found
zone [COLOR="#FF0000"]renoeyeglassrepair.com[/COLOR]/IN: not loaded due to errors.
_default/[COLOR="#FF0000"]renoeyeglassrepair.com[/COLOR]/IN: file not found         [FAILED]

Unfortunately, I'm not able to determine the root cause of the error, but I did find this in sw-cp-server/error_log:

2013-12-10T05:37:28+00:00 ERR (3): DNS Connector: error during commit (PleskMultipleException): Error during [COLOR="#FF0000"]renoeyeglassrepair.com[/COLOR] update: dnsmng failed: Empty error message from utility.
2013-12-10 05:37:28: (server.c.1543) server stopped by UID = 0 PID = 30214

Thoughts? Ideas? Suggestions?