something is killing user processes

[DariuszR]

Hello

I'm running Plesk 9.2.1 on CentOS 5.3. The problem is: each night at 00:36 something is killing user processes left running on screen or started as daemon (psyBNC for example). The only thing that I found in cron starting at 00:36 is "/usr/local/psa/admin/sbin/backupmng" but when I run it manually it doesn't kill anything. There are also strange entries in secure syslog at 00:36: usermod[pid]: lock user `username' password and usermod[pid]: unlock user `username' password for each ftp or shell user in plesk database. But again when I run it manually for user running some processes nothing is killed. Can somebody tell me what's going on here ?

 

[Webroy]

see if this is running: by ps -aux

/usr/local/apache/bin/httpd -DSSL

If so you have a problem , probably a not upgraded site is hacked...

Search for hidden files like

images/.thumbs.db/psybnc
psybnc/bot.pl

Update the scripts on that site and kill all httpd -DSSL processes....

 

[DariuszR]

Server is freshly installed from OVH repos and nothing is hacked. I had fedora 4 with plesk before but I switched to CentOS 5.3 with completly fresh install and problems started right after that. All processes are killed, not psybnc only. You can run whatever you want, even just screen without any program running and it will be killed at 00:36. It looks like some maintenance plesk script but I can't find where is it and how to fix it.

 

[EduardoSilvestre]

Hello DariuszR,

could be a fork caused by lack of memory. Check logs and looking for "Out of Memory".

Regards,

 

[DariuszR]

Now I'm 100% sure that something from Plesk is killing those processes. I have created user account directly from root not Plesk and left screen and psyBNC running over the night. Everything is still running fine and there is no "usermod" log entry for that user on 00:36. So can enybody tell me which Plesk script is doing this usermod changes each night ?

 

[DariuszR]

Hello DariuszR,
could be a fork caused by lack of memory. Check logs and looking for "Out of Memory".
Regards,

It's not that. It's something from Plesk for sure (check my previous reply). Server has 4GB ram and usually ~3GB are free. Processes are killed at 00:36 every time so it's nothing random.

 

[TRANCEMANIAC]

Crontab of the root

Hi DariuszR,

you should ckeck the crontab of the root.

crontab -u root -l

In my crontab i have this crons:

0       5       *       *       1       /opt/psa/libexec/modules/watchdog/cp/secur-check
0       5       *       *       1       /opt/psa/libexec/modules/watchdog/cp/send-report weekly
10      5       *       *       *       /opt/psa/libexec/modules/watchdog/cp/clean-sysstats
15      5       *       *       *       /opt/psa/libexec/modules/watchdog/cp/pack-sysstats day
15      5       *       *       1       /opt/psa/libexec/modules/watchdog/cp/pack-sysstats week
15      5       1       *       *       /opt/psa/libexec/modules/watchdog/cp/pack-sysstats month
15      5       1       *       *       /opt/psa/libexec/modules/watchdog/cp/pack-sysstats year
20      5       *       *       *       /opt/psa/libexec/modules/watchdog/cp/clean-events
0       5       *       *       7       /opt/psa/libexec/modules/watchdog/cp/clean-reports

I have changed the hour from 1 to 5 and the restart of the apache comes every at about 5:00am - 5:20 am. So i think one of this crons is causing it.

Also if you have a running backup task, it could be, that the apache locks the domain / complete apache for the time the backup takes.

Hope it helps you.

TRANCEY