WARNING: services not running

[md@waw.co.uk]

At 02:30am my server started sending me WARNING messages

Warning: service httpd not running (server: ns1.serverxxx.com)!

A little later this changed to

Warning: service httpd not running (server: ns1.serverxxx.com)!

Warning: service ftpd not running (server: ns1.serverxxx.com)!

The services appear to be working, I can FTP to the server & both websites & ISPConfig (on port :81) appear to be working as expected.

Does anyone have any idea what might be wrong?

thanks

[till]

Please check if apache is listening on localhost too.

[md@waw.co.uk]

I'm not certain how to check that - I looked in the Apache config file & that just has port 80 (listen)

I tried to restart Apache & it failed

then I did this
[root@ns1 ~]# /etc/init.d/httpd start
Starting httpd: (98)Address already in use: make_sock: could not bind to address [::]:80
(98)Address already in use: make_sock: could not bind to address 0.0.0.0:80
no listening sockets available, shutting down
Unable to open logs
[FAILED]

I rebooted the server & manually started Apache - it's working (thankfully) but I'm still getting the Warning: service httpd not running (server: ns1.serverxxx.com)!

BTW the warning about FTP not working stopped all by itself several hours ago.

This server has been running for a long time without this problem & I have not done any system updates. It uses Fedora 8 64bit.

thanks (in advance)

[md@waw.co.uk]

One of my resellers uses Joomla & all hiw joomla websites have not been working from about the same time the WARNING email started, the error message when you try to access one of the websites is...

PHP Warning: Unknown: open_basedir restriction in effect. File(/usr/share/pear/suhosin.php) is not within the allowed path(s): (/var/www/web???/) in Unknown on line 0

... some issue with suhosin.php

he has started to delete the websites & re-install them & that appears to have fixed his problem.

And finally (for now) the bandwidth usage has increased enormously.

[falko]

What's the output of netstat -tap?

[md@waw.co.uk]

Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 *:mysql *:* LISTEN 2231/mysqld
tcp 0 0 *:sunrpc *:* LISTEN 1865/rpcbind
tcp 0 0 *:ndmp *:* LISTEN 2912/perl
tcp 0 0 ns1.wawhost.co.uk:http baiduspider-220-181-1:65327 SYN_RECV -
tcp 0 0 *:hosts2-ns *:* LISTEN 2738/ispconfig_http

[falko]

Hm, Apache is listening on all interfaces, so this is not the problem. What's the output of iptables -L?

[md@waw.co.uk]

Chain INPUT (policy ACCEPT)
target prot opt source destination
fail2ban-SSH tcp -- anywhere anywhere tcp dpt:ssh

Chain FORWARD (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

Chain fail2ban-SSH (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere

[till]

Thats ok too. Please post the content of the /etc/hosts file.

[md@waw.co.uk]

Do not remove the following line, or various programs
# that require network functionality will fail.
127.0.0.1 localhost.localdomain localhost
217.72.98.213 localhost.localdomain localhost
78.129.111.11 ns1.xxxxxx.co.uk ns1
#78.129.111.11 ns2.xxxxxxxx.co.uk ns2
::1 localhost6.localdomain6 localhost6


NB. I'm not certain about 217.72.98.213 - so I have commented it out & then I restarted the network services but the WARNING messages continue

[falko]

What's the output of ifconfig?

[md@waw.co.uk]

[root@ns1 ~]# ifconfig
eth0 Link encap:Ethernet HWaddr 00:14:5E:82:12:76
inet addr:78.129.111.11 Bcast:78.129.111.255 Mask:255.255.255.0
inet6 addr: fe80::214:5eff:fe82:1276/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:6519019 errors:0 dropped:0 overruns:0 frame:0
TX packets:6222695 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:2835268391 (2.6 GiB) TX bytes:1877438833 (1.7 GiB)
Interrupt:16

eth0:0 Link encap:Ethernet HWaddr 00:14:5E:82:12:76
inet addr:78.129.111.11 Bcast:78.129.175.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
Interrupt:16

eth1 Link encap:Ethernet HWaddr 00:14:5E:82:12:77
inet addr:78.129.122.22 Bcast:78.129.122.222 Mask:255.255.255.0
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)
Interrupt:17

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:1225269 errors:0 dropped:0 overruns:0 frame:0
TX packets:1225269 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:336474529 (320.8 MiB) TX bytes:336474529 (320.8 MiB)

[md@waw.co.uk]

The HTTP server stopped (and strangely so did the warning messages)

I can not get it to re-start

[root@ns1 ~]# /etc/init.d/httpd start
Starting httpd: (98)Address already in use: make_sock: could not bind to address [::]:80
(98)Address already in use: make_sock: could not bind to address 0.0.0.0:80
no listening sockets available, shutting down
Unable to open logs

I have tried re-booting the server but Apache does not want to start

the problem appears to have been faults with missing LOG files - now resolved

many thanks