Domain gets suspended every night

S

Soneritics

New member
Joined
Dec 22, 2024
Messages
10
Hi,

I have a new DirectAdmin installation (version ).

The problem is that a domain is being suspended every night.
This server is setup mainly for this domain and it has quite some resources. The main focus is to keep this one online, other domains are just supportive to that one.
The main domain has been added under the admin user.

Some longer running (PHP) scripts are running every night, which consume quite some CPU power.


I have a message in DA stating that the load average is high (15+)
Also a mail has been sent: lfd on *****: Excessive resource usage: admin (709433 (Parent PID:709421))



Under User -> 'Domain setup', my domain status is suspended every morning/night.
There is not much bandwidth/disk usage.

The domain's bandwidth and disk usage are set to 0, so it should be unlimited.


In Admin -> Server Manager -> Administrative settings -> Admnistrator settings:
- Overselling allowed
- Suspend a reseller and users -> inactive


In Admin -> Server Manager -> Administrative settings -> Server settings
- I disabled 'check usage' (did not solve the problem)


How can I prevent DA from suspending my domain?
 
Check usage is not for CPU usage if not resource of the account.

If you have CSF installed check it and find about load usage.
 
CSF is installed, but I already disabled PT_USERKILL.
In the logs, only some processes are being killed and some ssh failed logins are blocked.

But even when a user would be disabled by CSF, would that also disable a domain (not a user) in DirectAdmin?


Also, going to through the logs, I found the /var/log/directadmin/system.log file with some interesting log lines:

2024:12:22-00:10:57: Tally All Begin
2024:12:22-00:10:57: Tally Reseller admin Begin
2024:12:22-00:10:57: Tally User admin Begin
2024:12:22-00:10:57: Domain *** has been suspended for user admin with 154.653838 used of 0.000000
2024:12:22-00:11:07: Tally User admin Complete
2024:12:22-00:11:07: Tally Reseller admin Complete
2024:12:22-00:11:07: Tally All Complete
2024:12:22-00:11:56: httpd reloaded

I am not sure what Tally does?
 
CSF not going to suspend anyuser just kill the problematic process.

Check system.log and errortaskq.log if you see anything strange.

Bash: 
tail -n 100 /var/log/directadmin/system.log
Bash: 
tail -n 100 tail -n 10 /var/log/directadmin/errortaskq.log

Also Investigate brute force log entries.

Bash: 
ls -lah /usr/local/directadmin/data/admin/brute_*

If the brute_log_entries.list file is large then delete it.
 
Soneritics said:
2024:12:22-00:10:57: Domain *** has been suspended for user admin with 154.653838 used of 0.000000
Click to expand...
To me this looks as if the "unlimited" is not working. Try to set the unlimited to 9999999 and see if it suspends again or if it keeps working.
If it keeps working then it seems like a bug and you might want to send in a support ticket.
 
As 2 Unlimited once said 🎶No no, no no no no, no no no no, no no there's no limit🎶- but in this case, there was.... A big, fat, 0! D'oh
 
Ohm J said:
Not just set as "0", you must tick in checkbox ("unlimited").
Click to expand...
I checked that yesterday, but oddly enough I only see that checkbox in the enhanced skin. Or I'm looking at the wrong place.
Was already wondering why this box was not in Evo. So I'm probably not looking correctly.
 
Thanks, I don't know where I was looking yesterday. I've seen only 0 and MB at the end not in front.
Can't find it anymore but indeed I can find unlimited now, thanks.

But unlimited should be ticked indeed.
 
Yes indeed, it is not 0 but done with the checkbox. I checked the checkboxes for unlimited everything, and unchecked the checkbox for 'suspend at limit'.

The problem is also not the bandwidth or disk usage. This is well below any limits. It seems to be all about the load.

Interesting thing is that the message this night was:
Domain *** has been suspended for user admin with 833.555176 used of 0.000000

And at the moment this is the overview:
1735070446160.png

So possibly there is something with the unlimited (bandwidth) setting that does not work correct.
I'm gonna see what happens this night, so I can check tomorrow i it's again around the currently used bandwidth.
 
Kurogane said:
CSF not going to suspend anyuser just kill the problematic process.

Check system.log and errortaskq.log if you see anything strange.

Bash: 
tail -n 100 /var/log/directadmin/system.log
Bash: 
tail -n 100 tail -n 10 /var/log/directadmin/errortaskq.log

Also Investigate brute force log entries.

Bash: 
ls -lah /usr/local/directadmin/data/admin/brute_*

If the brute_log_entries.list file is large then delete it.
Click to expand...
system.log contains the blocking lines, but no reason where the numbers are coming from, eg:
2024:12:24-00:10:21: Tally All Begin
2024:12:24-00:10:22: Tally Reseller admin Begin
2024:12:24-00:10:22: Tally User admin Begin
2024:12:24-00:10:22: Domain ordersverwerken.nl has been suspended for user admin with 833.555176 used of 0.000000
2024:12:24-00:10:32: Tally User admin Complete
2024:12:24-00:10:32: Tally Reseller admin Complete
2024:12:24-00:10:32: Tally All Complete
2024:12:24-00:11:22: httpd reloaded
2024:12:24-00:11:22: php-fpm74 reloaded
2024:12:24-00:11:22: php-fpm84 reloaded
Click to expand...

errortask.log contains a few errors while restarting spamd, but other then that nothing special. I will look into that later.

The brute force logs also don't show too much, they're pretty empty.
 
LawsHosting said:
You could check the user.conf of the user

/usr/local/directadmin/data/users/<user>/user.conf
Click to expand...
This looks all good. Most important settings that can have something to do with this issue seem to me:

account=ON
additional_bandwidth=0
bandwidth=unlimited
demo=no
inode=unlimited
quota=unlimited
suspend_at_limit=OFF
suspended=no
sysinfo=ON
Click to expand...

So far everything looks fine , if you ask me.
 
Soneritics said:
interesting thing is that the message this night was:
Domain *** has been suspended for user admin with 833.555176 used of 0.000000
Click to expand...
I think you might want to check message #5 again where I both mentioned this -and- provided a test to see if something is wrong with the unlimited setting.;)
 
Richard G said:
I think you might want to check message #5 again where I both mentioned this -and- provided a test to see if something is wrong with the unlimited setting.;)
Click to expand...
That's indeed the next step. Thanks for pointing out :)

The logs tell me:
2024:12:25-00:10:49: Domain ordersverwerken.nl has been suspended for user admin with 1041.803246 used of 0.000000
Click to expand...
Which is indeed the bandwidth.

I now changed the bandwidth, I will check tomorrow if it helped.

Just as a reference for myself, here the steps :-)
I modified the settings for the admin user. This means it overwrites the settings of the chosen package (which has everything set to unlimited).
1735120538324.png

This is shown in the domain overview:
1735120676068.png
 
right of those boxes is a simple checkbox, why not press it? Now you make the limit high, yet still it’s officially not unlimited.
 
You must log in or register to reply here.
Back
Top