Resolved Has your Plesk Onyx done something like this?

[larryk]

Hello,

If you are not using Atomicorp ASL, then most likely this thread isn't for you, but thanks for taking a look

CentOS Linux 7.4.1708 (Core)‬
Product Plesk Onyx
Version 17.0.17 Update #35, last updated on Oct 2, 2017 03:32 AM

Below are 4 emails that were sent and I'm trying to under the following:
a) the asl@mydomain.com email address is ONLY entered on the ASL control panel for notifications. To my knowledge, that email is not used anywhere else. The ASL email forwards to my larryk email account.
b) to my knowledge my HOSTING PROVIDER support has disabled updates, kernel care, etc so that no updates are run on ASL.
c) I’m pretty sure some configuration, some issue… (Plesk, nginx, ASL, something-somewhere) … is not correct. Due to the multiple forced hard reboots of my server running Plesk, something is wrong. BUT we can’t find it.
d) do you know who/what is sending these emails?
e) what do these emails mean?
f) why are these emails being sent?
g) I’m sending this email to hosting provider, Atomicorp, and here.
h) I’m planning on upgrading from 17.0.17 to the stable 17.5 version.
i) note: I have ASL 5 on my server, but isn't email 4 for ASL 4 ?

EMAIL 1)

SUBJECT: [psmon/host.mydomain.com] Spawned 'ossec-dbd' with '/sbin/service ossec-hids restart’
TO: asl@mydomain.com
TIME: On Oct 19, 2017, at 3:10 AM, psmon@host.mydomain.com wrote:


Command executed: /sbin/service ossec-hids restart
Exit value: 0
Signal number: 0
Dumped core?: 0

Restarting ossec-hids (via systemctl):  [  OK  ]


EMAIL 2)

SUBJECT: [psmon/host.mydomain.com] Killed PID 23093 (ossec-dbd) because 2 instances exceeds limit of 1
TO: asl@mydomain.com
TIME: On Oct 19, 2017, at 3:08 AM, psmon@host.mydomain.com wrote:


EMAIL 3)

SUBJECT: [psmon/host.mydomain.com] Killed PID 26225 (ossec-dbd) because 2 instances exceeds limit of 1
TO: asl@mydomain.com
TIME: On Oct 19, 2017, at 3:08 AM, psmon@host.mydomain.com wrote:



EMAIL 4)

SUBJECT: <host.mydomain.com> Package Update Manager notification
TO: larryk@mydomain.com
TIME: On Oct 19, 2017, at 2:14 AM, Administrator <larryk@mydomain.com> wrote:


Hello, Administrator
This notification message is a digest from System Updates for your server host.mydomain.com.

The following packages were successfully updated:
- asl 1:5.0-2512.el7.art from asl-4.0 repo (previous version: 1:5.0-2486.el7.art from asl-4.0 repo)
- asl-waf-module 1:5.0-2512.el7.art from asl-4.0 repo (previous version: 1:5.0-2486.el7.art from asl-4.0 repo)
- asl-web 1:5.0-2512.el7.art from asl-4.0 repo (previous version: 1:5.0-2486.el7.art from asl-4.0 repo)
- aum 1:5.0-2512.el7.art from asl-4.0 repo (previous version: 1:5.0-2486.el7.art from asl-4.0 repo)
- xtables-addons 2.10-1.2489.el7.art from tortix-kernel repo (previous version: 2.10-1.2431.el7.art from tortix-kernel repo)


If you don't want to receive these messages, configure notification settings: https://host.mydomain.com:8443/admin/pum/settings

 

[UFHH01]

Hi larryk,

d) It actually points directly to "psmon", a "Process Table Monitoring Script" ( pls. see: => psmon - search.cpan.org )

e) Plesk components and extensions don't use this script. Pls. inform yourself at the above link about the usage and its informations sent to you.

f) Because someone installed it on your server and wants you to be informed about the monitoring results.

Note, that the sender of your eMails 1-3 differs from the 4th, as the 4th eMail is from Plesk ( PUM = Plesk Update manager ), which informs you about automatic updates done recently. Your informations about point b) seems incorrect.

c) I’m pretty sure some configuration, some issue… (Plesk, nginx, ASL, something-somewhere) … is not correct. Due to the multiple forced hard reboots of my server running Plesk,

Well... sorry larryk, but we can't guess issues/errors/probems. Pls. share depending log - files and depending configuration files from your service, that you experience issues/errors/problems with.

 

[larryk]

didn't know that psmon wasn't part of Plesk.... thanks for the link.

question.... so I can post a whole log file and you can "look" at it and maybe spot the issue?
granted I need to be specific (provide enough info) to give a good picture of what happen, etc. etc.

thanks

 

[UFHH01]

Hi larryk,

question.... so I can post a whole log file and you can "look" at it and maybe spot the issue?

Actually, if you don't experience any issues/errors/problems, I can't see the need to spent time on investigating possible log - files. It is YOUR job/task as a system administrator to spot issues/errors/problems and if you need help by solving the issues/errors/problems, the Plesk Community users will jump in to help, if you provide enough informations, so that investigations are possible for people willing to help you.

If you don't want to spent the time to spot issues/errors/problems on your server, pls. consider to hire someone or ask for example for "Professional services" at

=> Professional Services - Plesk migration, setup and configuration

=> Plesk Admin Services​