cPanel Logs

How to view the logs

There are multiple ways to view log files, here are some common ways.

tail the log, shows the 10 most recent log entries.

tail /var/log/messages

tail the log and keep monitoring it for new entries.

tail -f /var/log/messages

Find specific info in log file

cat /var/log/messages | grep texttosearch

cPanel Log Paths

Main log

/var/log/messages

Access logs

/usr/local/cpanel/logs/access_log

Access logs for a specific domain

/home/user/access-logs/domainname.com

Account Transfers/miscellaneous logs

/var/cpanel/logs

Auditing Log (Account creation and deletions)

/var/cpanel/accounting.log

Backup Logs

/usr/local/cpanel/logs/cpbackup

CPHULKD Log

/usr/local/cpanel/logs/cphulkd.log

DNSAdmin, DNS Clustering

/usr/local/cpanel/logs/dnsadmin_log

Task Queue Processing Daemon

/usr/local/cpanel/logs/queueprocd.log

DBMapping

/usr/local/cpanel/logs/setupdbmap_log

Easy Apache Build logs

/usr/local/cpanel/logs/easy/apache/

Error logs

/usr/local/cpanel/logs/error_log
/var/log/cpanel

License log

/usr/local/cpanel/logs/license_log

local database modifications

/usr/local/cpanel/logs/build_locale_database_log

Login errors CPSRVD

/usr/local/cpanel/logs/login_log

Bandwidth History

/var/cpanel/bandwidth/{USERNAME}

Service Status Logs

/var/log/chkservd.log

Tailwatch log

/usr/local/cpanel/logs/tailwatch_log

Update Analysis Reporting

/usr/local/cpanel/logs/updated_analysis/{TIMESTAMP}.log

Update log UPCP

/var/cpanel/updatelogs/updated.{TIMESTAMP}.log

cPanel Email Logs

 

Horde log

/var/cpanel/horde/log/

RoundCube

/var/cpanel/roundcube/log/

Squirrel Mail

/var/cpanel/squirrelmail/

Panic log

/usr/local/cpanel/logs/panic_log

Delivery and receipt log

/var/log/exim_mainlog

Incoming mail queue

/var/spool/exim/input/

Log of messages rejected based on ACLS or other policies

/var/log/exim_rejectlog

Unexpected/Fatal error log

/var/log/exim_paniclog

IMAP, POP login attempts, transactions, fatal errors and spam scoring

/var/log/maillog

Mailman

/usr/local/cpanel/3rdparty/mailmain/logs

MySQL

MySQL error log

/var/lib/mysql/{SERVER_NAME}.err

MySQL slow query log (if enabled in my.cnf)

/var/log/slowqueries

How to Install Zenoss 5 on CentOS 7

Note:

  1. This is not a comprehensive guide, if you need more info, refer to the installation manual here.
  2. This assumes that all your partitions are going to be on one drive

Installing CentOS 7

Note: If you have issues installing CentOS via the default install interface, try using the Fallback graphics mode, found in the Grub boot menu under “trubbleshooting”.

Install CentOS like you normally would, just be sure to leave at least 60GB of free space for Docker/Zenoss

2

You can Select Automatic Partitioning, but you will need to make additional space available.  I just configured it manually.3

 Note that I have about 75GB of free space, this will be used for “/var/lib/docker” and “/opt/serviced/var/volumes”.  We’ll set these up later on.1

You don’t necessarily need to setup a user, but you can if you want to.  4

Once your finished reboot and login.5

 

Configuring CentOS for Zenoss

Setup network

You will need to setup your network settings.  Refer to this post to set a static IP address if needed.

 

Note: In CentOS 7 ifconfig is not installed by default.  If you need to check the IP address use the following command.

ip addr sh

After your connected to the internet you can install ifconfig with

yum install -y net-tools

Setup Hostname

Zenoss seems to have issues if you change the hostname after it is installed so be sure to set up the hostname before you start installing zenoss.

Check current hostname

hostname

Change the hostname.  Replace “newhostname” with your new hostname.

hostnamectl set-hostname newhostname

After you finish configuring the hostname, add it to “/etc/hosts” with the following command.  Change the IP address and the hostname “zenoss” to your systems IP address and hostname.

echo "192.168.56.101   zenoss" >> /etc/hosts

Update your system

yum update -y

Disable Firewall

systemctl stop firewalld && systemctl disable firewalld

Enable persistent log storage

mkdir -p /var/log/journal && systemctl restart systemd-journald

Create two Btrfs file systems

First create two normal linux partitions using your favorite disk utility.  I am using cfdisk.  Each partition should be over 30GB.

cfdisk /dev/sda

6

Create two Primary partitions and put them at the end and then write and exit.

7

Take note of the two new partitions names.  Mine are “sda4” and “sda3”.

After the above changes are made, it would be a good idea to reboot the machine so the partition table can be updated.

reboot

Now we will reformat the two partitions as Btrfs

Create mount point.

mkdir -p /var/lib/docker /opt/serviced/var/volumes

Change “/dev/sda3” and “/dev/sda4” to your partitions names if they are different.

DOCKER_PART=/dev/sda3
APP_PART=/dev/sda4
mkfs -t btrfs --nodiscard $DOCKER_PART
mkfs -t btrfs --nodiscard $APP_PART

Add the new file systems to fstab, so they automatically mount on boot.

APP_PATH="/opt/serviced/var/volumes"
echo "$DOCKER_PART /var/lib/docker btrfs rw,noatime,nodatacow 0 0" >> /etc/fstab
echo "$APP_PART $APP_PATH btrfs rw,noatime,nodatacow 0 0" >> /etc/fstab

Mount the new filesystems, and make sure that they mounted

mount -a
if [[ `mount | egrep 'docker|serviced'` ]]; then echo "Mounted" ; else echo "Not Mounted" ; fi

You can manually check by running the following command.

mount | egrep 'docker|serviced'

you should receive something like the following

/dev/sda3 on /var/lib/docker type btrfs (rw,noatime,seclabel,nodatasum,nodatacow,space_cache)
/dev/sda4 on /opt/serviced/var/volumes type btrfs (rw,noatime,seclabel,nodatasum,nodatacow,space_cache)

Disable SELinux

By default SELinux is installed and enabled.  To disable SELinux either edit the config file “/etc/selinux/config” and change “SELINUX=enforcing” to “SELINUX=disabled”, or you can run the following command.

EXT=$(date +"%j-%H%M%S")
sudo sed -i.${EXT} -e 's/^SELINUX=.*/SELINUX=disabled/g' \
/etc/selinux/config && \
grep '^SELINUX=' /etc/selinux/config

Enable Dnsmasq

systemctl enable dnsmasq && systemctl start dnsmasq

Install and Configure NTP

yum install -y ntp && systemctl enable ntpd

Have NTP start on system boot and then start NTP

echo "systemctl start ntpd" >> /etc/rc.d/rc.local
chmod +x /etc/rc.d/rc.local
systemctl start ntpd

Download and install the Zenoss repository

rpm -ivh http://get.zenoss.io/yum/zenoss-repo-1-1.x86_64.rpm
yum clean all

Final Reboot

reboot

 

Installing Zenoss

 

Once your logged back into the system start installing zenoss

Install the Zenoss-core service and start docker

yum --enablerepo=zenoss-stable install -y zenoss-core-service
systemctl start docker

Add the Btrfs and DNS flags to the Docker startup options

Identify ip for docker

ip addr | grep -A 2 'docker0:' | grep inet

Add the docker startup options.  Change the ip address if needed.  It should match the one from the previous command.

echo 'DOCKER_OPTS="-s btrfs --dns=172.17.42.1"' >> /etc/sysconfig/docker

Change the volume type for application data

You can manually edit the serviced file “/etc/default/serviced” and change the variable “SERVICED_FS_TYPE” from “rsync” to “btrfs” or run the following command.

EXT=$(date +"%j-%H%M%S")
 sudo sed -i.${EXT} \
 -e 's|^#[^S]*\(SERVICED_FS_TYPE=\).*$|\1btrfs|' \
 /etc/default/serviced

Restart docker

systemctl stop docker && systemctl start docker

Start the control center

systemctl start serviced

you can monitor the process with

journalctl -u serviced -f

Serviced has about 5-10 minutes worth of work to do before you’ll be able to login to the Control Center interface.  If the service fails to start, reboot the server.

Setting up name resolution

To setup name resolution on you local computer just add the following line to your “hosts” file.  On Linux and OS X this is located in “/etc/hosts” On Windows machines it is under “\Windows\Sytem32\Drivers\etc\hosts”

192.168.56.101 hostname zenoss5.hostname hbase.hostname opentsdb.hostname rabbitmq.hostname

Be sure to change the IP address and “hostname”  to the IP address and hostname of your server.  You also might need administrative privileges to edit the hosts file.

10

Logging into the Control Center.

Now open up a web browser and go the following URL.  Change the IP address to your servers IP.

https://192.168.56.101

Login with the Zenoss server root username and password.  If you want to setup a user other then root, please refer to the Zenoss Installation guide here.

11

Change the hostname to your Zenoss server hostname12

Select the check boxes in the next two steps.13 14

Give it a deployment id and deploy it.15 16

Once it is deployed Make sure that it is started.  Once it finishes go log into Zenoss.  It can take awhile for Zenoss to start up, depending on your hardware, so be patient.

The Direct URL for Zenoss is

https://zenoss5.hostname

 

 

How to Install Nagios 4.0.8 on CentOS 6.5

Install the prerequisite packages

yum install gd gd-devel httpd php gcc glibc glibc-common make perl wget

If you want to monitor SNMP you should install net-snmp now

yum install net-snmp net-snmp-utils
service snmpd start
chkconfig snmpd on

Create the Nagios user.

useradd -m nagios
passwd nagios
groupadd nagcmd
usermod -a -G nagcmd nagios
usermod -a -G nagcmd apache

Create a directory to download and build Nagios from

mkdir /root/nagios
cd /root/nagios

Download Nagios and the Nagios plugins

wget http://sourceforge.net/projects/nagios/files/nagios-4.x/nagios-4.0.8/nagios-4.0.8.tar.gz
wget nagios-plugins.org/download/nagios-plugins-2.0.3.tar.gz 

Extract the Nagios zip

tar xvzf nagios-4.0.8.tar.gz
cd nagios-4.0.8

Compile and make it

./configure
make all
make install
make install-init
make install-commandmode
make install-config
make install-webconf

Create a password so you can login to the web interface

htpasswd -c /usr/local/nagios/etc/htpasswd.users nagiosadmin

Enable Nagios on startup

 chkconfig nagios on

Start the service

service nagios start

Install the plugins.

cd ..
tar xvzf nagios-plugins-2.0.2.tar.gz
cd nagios-plugins-2.0.2
./configure
make
make install

Start apache and make sure it starts on boot.

service httpd start
chkconfig httpd on

You should now be able to access Nagios by going to https://nagiosserverip/nagios

If you run into issues check your firewall and make sure SELinux is disabled.

How To Enable/Disable SELinux

Disable SELinux

You can manually edit the SELinux config file in /etc/selinux/config and change the variable SELINUX=enforcing to disabled

vi /etc/selinux/config
...
SELINUX=disabled
...

or you can use this little command

sed -i.bak -e 's/^SELINUX=.*/SELINUX=disabled/g' /etc/selinux/config

Enable SELinux

You can enable SELinux manually the same as above but set SELINUX=disabled to SELINUX=enforcing

vi /etc/selinux/config
...
SELINUX=enforcing
...

or

sed -i.bak -e 's/^SELINUX=.*/SELINUX=enforcing/g' /etc/selinux/config

How to Allow a Port Through Firewalld

Note: If you have SELinux enabled you’ll need to allow the port in semanage.

Basic syntax

 firewall-cmd --zone=public --add-port=(port number)/(protocal)

So the command to allow port 80 through the firewall would be

firewall-cmd --zone=public --add-port=http/tcp
or
firewall-cmd --zone=public --add-port=80/tcp

The above command only works for the running instance of firewalld.  If you want to add the port permanetely you need to run the above command and then run it again with “–permanent” added to the end of the command.

example:

firewall-cmd --zone=public --add-port=http/tcp
firewall-cmd --zone=public --add-port=http/tcp --permanent

How To Install Zenoss 4.2.5 on CentOS 6.5

First you need to remove mysql-libs

yum remove mysql-libs

Install wget

yum install -y wget

Download the Zenoss install script archive

wget https://github.com/zenoss/core-autodeploy/tarball/4.2.5 -O auto.tar.gz

Extract the archive

tar zxvf auto.tar.gz

and execute the install script

cd zenoss-core-autodeploy-*
./core-autodeploy.sh

Follow the prompts and when it’s finished navigate to http://yourserverip:8080 to complete the install.

Install Wireless Broadcom Driver for Fedora 21

Run the following commands as root

rpm -Uvh http://download1.rpmfusion.org/free/fedora/rpmfusion-free-release-stable.noarch.rpm
rpm -Uvh http://download1.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-stable.noarch.rpm

Update the system and then download the driver.

yum update
yum install kmod-wl

When the above commands finish reboot the computer

reboot

How To “Unblock” an IP from cPHulk from the Command Line

cPHulk uses a MySQL database to keep track of different IP’s to block, white list, black list, etc.

When there have been X amount of failed login attempts from an IP, cPHulk adds an entry for the IP in the brutes table.

To “unblock” the IP we need to delete the entry.

open up the cPHulk MySQL database.

root@localhost [~]# mysql cphulkd

If your interested you can view all tables that cPHulk uses.

show tables;

Take a look at all the IP’s in the brutes table.

SELECT IP FROM brutes;

example:

mysql> SELECT IP FROM brutes;
+---------------+
| IP            |
+---------------+
| 30.134.41.221 |     <--  IP we want to unblock
| 31.134.40.251 |
+---------------+
2 rows in set (0.00 sec)

mysql>

To unblock the IP we just need to delete the row that has the IP address we want.

mysql> DELETE FROM brutes WHERE IP="30.134.41.221";

It should return the following.

mysql> DELETE FROM brutes WHERE IP="30.134.41.221";
Query OK, 1 row affected (0.00 sec)

mysql>

Exit MySQL.

mysql> exit
Bye
root@localhost [~]#

 

How To Install Ubiquiti mFi controller on Debain(7.5.0) Linux

Add the following line to /etc/apt/sources.list

deb http://dl.ubnt.com/mfi/distros/deb/debian debian ubiquiti

Add GPG keys

sudo apt-key adv --keyserver keyserver.ubuntu.com --recv C0A52C50
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv 7F0CEB10

Update the system

sudo apt-get update

Install the mFi software

sudo apt-get install mfi

Once it is finished installing you should be able to browse to https://yourserverip:6443 to access the mFi web page.

How To Install Ubiquiti’s UniFi Controller on Debian Linux

First add the following line to /etc/apt/sources.list

deb http://www.ubnt.com/downloads/unifi/distros/deb/debian debian ubiquiti

Next add the GPG key for UniFi and mongo-10

sudo apt-key adv --keyserver keyserver.ubuntu.com --recv C0A52C50
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv 7F0CEB10

Update the system

sudo apt-get update

Install the UniFi software

sudo apt-get install unifi-rapid

Once it is finished installing you should be able to browse to https://yourserverip:8443 to access the UniFi web page.