{"id":320,"date":"2021-07-23T12:27:44","date_gmt":"2021-07-23T12:27:44","guid":{"rendered":"https:\/\/ssdsunucum.com\/blog\/tailwatch\/"},"modified":"2021-07-23T12:27:44","modified_gmt":"2021-07-23T12:27:44","slug":"tailwatch","status":"publish","type":"post","link":"https:\/\/ssdsunucum.com\/blog\/tailwatch\/","title":{"rendered":"TailWatch"},"content":{"rendered":"<\/p>\n
\n
<\/div>\n
\n

Overview<\/h2>\n

The TailWatch driver monitors a log file for certain activities, and then performs actions for the activity. Driver modules monitor specific services and contain instructions for which actions to perform (for example, which log to monitor and what to do with the information).<\/p>\n

As of cPanel & WHM version 56, we ship the following stock drivers:<\/p>\n

    \n
  • \n

    chkservd<\/code><\/p>\n<\/li>\n

  • \n

    cpbandwd<\/code><\/p>\n<\/li>\n

  • \n

    eximstats<\/code><\/p>\n<\/li>\n

  • \n

    jailmanager<\/code><\/p>\n<\/li>\n

  • \n

    modseclog<\/code><\/p>\n<\/li>\n

  • \n

    recentauthedmailiptracker<\/code><\/p>\n<\/li>\n<\/ul>\n

    \n
    Note:<\/div>\n
    \n

    In cPanel & WHM version 11.52, we removed the antirelayd<\/code> driver and added the recentauthedmailiptracker<\/code> driver.<\/p>\n<\/p><\/div>\n<\/div>\n

    You can enable or disable TailWatch drivers in WHM\u2019s Service Manager<\/em> interface (WHM >> Home >> Service Configuration >> Service Manager<\/em>).<\/p>\n

    The chkservd driver<\/h2>\n

    The chkservd<\/code> driver determines whether a process is online and whether to restart the process via either of the following actions:<\/p>\n

      \n
    • \n

      Connection-based monitoring \u2014 The chkservd<\/code> driver attempts to connect to a service\u2019s specified port, issues a command, and waits for a response. If the driver receives a response, the driver reports the service online. This action uses the restartsrv<\/code> script with the --check<\/code> option.<\/p>\n<\/li>\n

    • \n

      Process-based monitoring \u2014 The chkservd<\/code> driver checks for a specific process and determines the connection status.<\/p>\n<\/li>\n<\/ul>\n

      You can set a service\u2019s monitor process in that service\u2019s configuration file. For more information, read the Add a new monitor section below.<\/p>\n

      By default, the chkservd<\/code> driver checks each service every five minutes to determine the service\u2019s status.<\/p>\n

        \n
      • \n

        If a service is online, the chkservd<\/code> driver will check the next service.<\/p>\n<\/li>\n

      • \n

        If a service is offline, the chkservd<\/code> driver will use one of the restartsrv<\/code> script to attempt to restart the service.<\/p>\n<\/li>\n<\/ul>\n

        You can view the results of the chkservd<\/code> checks in any of the following formats:<\/p>\n

          \n
        • \n

          The \/var\/log\/chkservd.log<\/code> log file contains the results from each check that it performs.<\/p>\n<\/li>\n

        • \n

          WHM\u2019s Server Information<\/em> interface (WHM >> Home >> Server Status >> Server Information<\/em>) displays the results from each check.<\/p>\n<\/li>\n<\/ul>\n

          \n
          Note:<\/div>\n
          \n
            \n
          • \n

            You can configure the system to email you the results from each check.<\/p>\n<\/li>\n

          • \n

            To choose which services the chkservd<\/code> driver will monitor, use WHM\u2019s Service Manager<\/em> interface (WHM >> Home >> Service Configuration >> Service Manager<\/em>).<\/p>\n<\/li>\n

          • \n

            To modify the chkservd<\/code> driver\u2019s configuration options, use the System<\/em> section of WHM\u2019s Tweak Settings<\/em> interface (WHM >> Home >> Server Configuration >> Tweak Settings<\/em>).<\/p>\n<\/li>\n<\/ul><\/div>\n<\/div>\n

            Add a new monitor<\/h3>\n

            To add a service that you wish for the chkservd<\/code> driver to monitor, perform the following steps:<\/p>\n

              \n
            1. \n

              Open the \/etc\/chkserv.d\/chkservd.conf<\/code> file with a text editor.<\/p>\n<\/li>\n

            2. \n

              Add the service that you want to monitor to the file, a colon (:<\/code>), and a 1<\/code> or a 0<\/code> to indicate whether the system should monitor the new service. In the following example, ftpd<\/code> represents the new service:<\/p>\n

              \n

              Click to view…<\/p>\n

              \n
              \n
              \n
              \n\n\n
              \n
               1\n<\/span> 2\n<\/span> 3\n<\/span> 4\n<\/span> 5\n<\/span> 6\n<\/span> 7\n<\/span> 8\n<\/span> 9\n<\/span>10\n<\/span>11\n<\/span>12\n<\/span>13\n<\/span>14\n<\/span>15\n<\/span>16\n<\/span>17\n<\/span>18\n<\/span>19\n<\/span>20\n<\/span>21\n<\/span>22\n<\/span><\/code><\/pre>\n<\/td>\n
              		\n
              clamd<\/span>:1<\/span>\ncpanel_php_fpm<\/span>:1<\/span>\ncpanellogd<\/span>:1<\/span>\ncpdavd<\/span>:1<\/span>\ncphulkd<\/span>:0<\/span>\ncpsrvd<\/span>:1<\/span>\ncrond<\/span>:1<\/span>\ndnsadmin<\/span>:1<\/span>\ncsf<\/span>:1<\/span>\nexim<\/span>:0<\/span>\nftpd<\/span>:1<\/span>\nhttpd<\/span>:1<\/span>\nimap<\/span>:1<\/span>\nipaliases<\/span>:1<\/span>\nmysql<\/span>:1<\/span>\nnamed<\/span>:1<\/span>\nnginx<\/span>:1<\/span>\npop<\/span>:1<\/span>\nqueueprocd<\/span>:1<\/span>\nrsyslogd<\/span>:1<\/span>\nspamd<\/span>:0<\/span>\nsshd<\/span>:1<\/span><\/code><\/pre>\n<\/td>\n<\/tr>\n<\/table>\n<\/div>\n<\/div><\/div>\n<\/p><\/div>\n<\/div>\n<\/li>\n
            3. \n
              Create the configuration file for the new service in the \/etc\/chkserv.d<\/code> directory.<\/p>\n<\/li>\n
            4. \n
              Open the file and add a line that resembles either of the following examples:<\/p>\n
                \n
              • \n
                Connection-based monitoring:\n<\/p>\n
                \n
                service[ftpd]=<\/span>21<\/span>,QUIT,220<\/span>,\/usr\/<\/span>local\/cpanel\/sc<\/span>ripts\/<\/span>restartsrv_ftpserver<\/code><\/pre>\n<\/div>\n
                \n
                Note:<\/div>\n
                \n
                This example contains the following values:<\/p>\n
                  \n
                • \n
                  ftpd<\/code> represents the service to monitor.<\/p>\n<\/li>\n
                • \n
                  21<\/code> represents the port through which the chkservd<\/code> driver will attempt to connect to the service.<\/p>\n<\/li>\n
                • \n
                  QUIT<\/code> represents the command that the chkservd<\/code> driver will send to check the service\u2019s connection.<\/p>\n<\/li>\n
                • \n
                  220<\/code> represents the server\u2019s expected response to the command.<\/p>\n<\/li>\n
                • \n
                  \/usr\/local\/cpanel\/scripts\/restartsrv_ftpserver<\/code> represents the service\u2019s restart command.<\/p>\n<\/li>\n<\/ul><\/div>\n<\/div>\n<\/li>\n
                • \n
                  Process-based monitoring:\n<\/p>\n
                  \n
                  service[ftpd]=<\/span>x,x,x,\/usr\/<\/span>local\/cpanel\/sc<\/span>ripts\/<\/span>restartsrv_ftpserver.<\/span>service,ftpd,root<\/code><\/pre>\n<\/div>\n
                  \n
                  Note:<\/div>\n
                  \n
                  This example contains the following values:<\/p>\n
                    \n
                  • \n
                    ftpd<\/code> represents the service to monitor.<\/p>\n<\/li>\n
                  • \n
                    x,x,x<\/code> directs the system to use process-based tracking.<\/p>\n<\/li>\n
                  • \n
                    \/usr\/local\/cpanel\/scripts\/restartsrv\/ftpserver<\/code> represents the service\u2019s restart command. To enter more than one restart command, separate each command with a semicolon (;<\/code>) in the order that the chkservd<\/code> driver will execute them.<\/p>\n<\/li>\n
                  • \n
                    ftpd<\/code> represents the service to restart.<\/p>\n<\/li>\n
                  • \n
                    root<\/code> represents the user who owns the monitor process.<\/p>\n<\/li>\n
                  • \n
                    Make certain<\/strong> to separate multiple users with a pipe (|<\/code>) character.<\/p>\n<\/li>\n<\/ul><\/div>\n<\/div>\n<\/li>\n
                  • \n
                    Combined connection-based and process-based monitoring:\n<\/p>\n
                    \n
                    service[ftpd]=<\/span>21<\/span>,QUIT,220<\/span>,\/usr\/<\/span>local\/cpanel\/sc<\/span>ripts\/<\/span>restartsrv_ftpserver,ftpd,root<\/code><\/pre>\n<\/div>\n
                    \n
                    Note:<\/div>\n
                    \n
                    This example contains the following values:<\/p>\n
                      \n
                    • \n
                      ftpd<\/code> represents the service to monitor.<\/p>\n<\/li>\n
                    • \n
                      21<\/code> represents the port through which the chkservd<\/code> driver will attempt to connect to the service.<\/p>\n<\/li>\n
                    • \n
                      QUIT<\/code> represents the command that the chkservd<\/code> driver will send to check the service\u2019s connection.<\/p>\n<\/li>\n
                    • \n
                      220<\/code> represents the server\u2019s expected response to the command.<\/p>\n<\/li>\n
                    • \n
                      \/usr\/local\/cpanel\/scripts\/restartsrv_ftpserver<\/code> represents the service\u2019s restart command.<\/p>\n<\/li>\n
                    • \n
                      ftpd<\/code> represents the service to restart.<\/p>\n<\/li>\n
                    • \n
                      root<\/code> represents the user who owns the monitor process. Make certain<\/strong> to separate multiple users with a pipe (|<\/code>) character.<\/p>\n<\/li>\n<\/ul><\/div>\n<\/div>\n<\/li>\n<\/ul>\n<\/li>\n
                    • \n
                      After you enter the service\u2019s configuration information, restart the chkservd<\/code> driver. To do this, run the following command:\n<\/p>\n
                      \n
                      \/etc\/i<\/span>nit.<\/span>d\/<\/span>chkservd restart<\/code><\/pre>\n<\/div>\n<\/li>\n
                    • \n
                      Confirm that the service appears in WHM\u2019s Service Manager<\/em> interface (WHM >> Home >> Service Configuration >> Service Manager<\/em>).<\/p>\n<\/li>\n<\/ol>\n
                      Common errors<\/h3>\n
                      One common chkservd<\/code> driver error occurs when an unmonitored, enabled service appears as offline in WHM\u2019s Service Manager<\/em> interface (WHM >> Home  >> Service Configuration >> Service Manager<\/em>). To fix this error, perform the following steps, where service<\/code> represents the name of the service with which you experience problems:<\/p>\n
                        \n
                      1. \n
                        To remove the run file, run the following command:\n<\/p>\n
                        \n
                        rm -<\/span>f \/var\/<\/span>run\/chkservd\/s<\/span>ervice<\/code><\/pre>\n<\/div>\n<\/li>\n
                      2. \n
                        To remove the chkservd<\/code> configuration file, run the following command:\n<\/p>\n
                        \n
                        rm -<\/span>f \/etc\/c<\/span>hkserv.<\/span>d\/<\/span>service<\/code><\/pre>\n<\/div>\n<\/li>\n
                      3. \n
                        Open the \/etc\/chkserv.d\/chkservd.conf<\/code> configuration file with a text editor and delete the service\u2019s line.<\/p>\n<\/li>\n
                      4. \n
                        To restart the chkservd<\/code> driver, run the following command:<\/p>\n
                        \n
                        \/scripts\/<\/span>restartsrv_chkservd<\/code><\/pre>\n<\/div>\n<\/li>\n
                      5. \n
                        Navigate to WHM\u2019s Service Manager<\/em> interface (WHM >> Home  >> Service Configuration >> Service Manager<\/em>).<\/p>\n<\/li>\n
                      6. \n
                        Click Save<\/em> at the bottom of the interface without any additional changes.<\/p>\n<\/li>\n<\/ol>\n
                        Other drivers<\/h2>\n
                        Unlike the chkservd<\/code> driver, these other TailWatch drivers do not<\/strong> possess their own log files or configuration:<\/p>\n
                          \n
                        • antirelayd<\/code><\/li>\n
                        • eximstats<\/code><\/li>\n
                        • jailmanager<\/code><\/li>\n
                        • cpbandwd<\/code><\/li>\n
                        • modseclog<\/code><\/li>\n<\/ul>\n
                          \n
                          Note:<\/div>\n
                          \n
                          The system records these drivers\u2019 activities in the main \/usr\/local\/cpanel\/logs\/tailwatchd_log<\/code> log file.<\/p>\n<\/p><\/div>\n<\/div>\n
                          Process control and status<\/h2>\n
                          To control the TailWatch process, pass command line flags to the \/usr\/local\/cpanel\/libexec\/tailwatchd<\/code> file.<\/p>\n
                          For a full list of available flags, run the following command:\n<\/p>\n
                          \n
                          \/usr\/<\/span>local\/cpanel\/<\/span>libexec\/<\/span>tailwatchd --<\/span>help<\/code><\/pre>\n<\/div>\n
                          Custom functionality<\/h2>\n
                          To add custom functionality to TailWatch, add a new driver. The PerlDoc for the TailWatch Module contains full documentation and examples for customizations.<\/p>\n
                          To access this documentation, run the following command:\n<\/p>\n
                          \n
                          \/usr\/<\/span>local\/cpanel\/<\/span>libexec\/<\/span>tailwatchd --<\/span>perldoc<\/code><\/pre>\n<\/div>\n
                          Place your new drivers in the \/usr\/local\/cpanel\/Cpanel\/TailWatch<\/code> directory, then restart TailWatch to load the new drivers.<\/p>\n<\/p><\/div>\n","protected":false},"excerpt":{"rendered":"
                          Overview The TailWatch driver monitors a log file for certain activities, and then performs actions for the activity. Driver modules monitor specific services and contain instructions for which actions to perform (for example, which log to monitor and what to do with the information). As of cPanel & WHM version 56, we ship the following …<\/p>\n","protected":false},"author":1,"featured_media":321,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[1],"tags":[],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/posts\/320"}],"collection":[{"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/comments?post=320"}],"version-history":[{"count":0,"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/posts\/320\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/media\/321"}],"wp:attachment":[{"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/media?parent=320"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/categories?post=320"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/tags?post=320"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}