Understanding TailWatch and How to Configure chkservd Monitoring in cPanel & WHM

1. What Is TailWatch?

The TailWatch driver monitors log files for specific activities and performs actions based on those events. Each TailWatch module monitors a particular service and defines which logs to track and what actions to take.

1.1 Default TailWatch Drivers

• chkservd
• cpbandwd
• eximstats
• jailmanager
• modseclog
• recentauthedmailiptracker

You can enable or disable these drivers in:
WHM » Home » Service Configuration » Service Manager

2. The chkservd Driver

The chkservd driver determines whether a service is online and restarts it if necessary. It uses two monitoring methods:

2.1 Connection‑Based Monitoring

The driver connects to a service’s port, sends a command, and waits for a response. If the expected response is received, the service is considered online. This method uses the restartsrv script with the --check option.

2.2 Process‑Based Monitoring

The driver checks for a specific process and determines whether it is running.

2.3 Monitoring Frequency

By default, chkservd checks each service every five minutes:

• If the service is online → move to the next service.
• If the service is offline → attempt to restart it using restartsrv.

2.4 Viewing chkservd Results

• Log file: /var/log/chkservd.log
• WHM interface: WHM » Home » Server Status » Server Information

You can also configure email notifications for service checks.

3. Adding a New Monitored Service

To add a new service for chkservd to monitor, follow these steps:

Step 1 — Edit chkservd.conf

Open the file:

/etc/chkserv.d/chkservd.conf

Add a line for the new service using 1 (monitor) or 0 (ignore):

ftpd:1

Step 2 — Create the Service Configuration File

Create a file in:

/etc/chkserv.d/ftpd

Step 3 — Add Monitoring Instructions

Connection‑Based Monitoring Example:

service[ftpd]=21,QUIT,220,/usr/local/cpanel/scripts/restartsrv_ftpserver

Process‑Based Monitoring Example:

service[ftpd]=x,x,x,/usr/local/cpanel/scripts/restartsrv_ftpserver.service,ftpd,root

Combined Monitoring Example:

service[ftpd]=21,QUIT,220,/usr/local/cpanel/scripts/restartsrv_ftpserver,ftpd,root

Step 4 — Restart chkservd

/etc/init.d/chkservd restart

Step 5 — Confirm in WHM

Check that the service appears in:
WHM » Home » Service Configuration » Service Manager

4. Common chkservd Errors

A common issue occurs when an unmonitored but enabled service appears offline in WHM. To fix it, replace service with the service name:

Remove the run file:

rm -f /var/run/chkservd/service

Remove the chkservd config file:

rm -f /etc/chkserv.d/service

Edit chkservd.conf:

Delete the service’s line from:

/etc/chkserv.d/chkservd.conf

Restart chkservd:

/scripts/restartsrv_chkservd

Save in WHM:

Go to Service Manager and click Save without making changes.

5. Other TailWatch Drivers

These drivers do not have their own configuration files or logs:

• antirelayd
• eximstats
• jailmanager
• cpbandwd
• modseclog

Their activity is logged in:

/usr/local/cpanel/logs/tailwatchd_log

6. Controlling the TailWatch Process

Use command‑line flags with:

/usr/local/cpanel/libexec/tailwatchd

To view all flags:

/usr/local/cpanel/libexec/tailwatchd --help

7. Adding Custom TailWatch Functionality

You can add custom drivers to extend TailWatch. Full documentation is available via PerlDoc:

/usr/local/cpanel/libexec/tailwatchd --perldoc

Place custom drivers in:

/usr/local/cpanel/Cpanel/TailWatch

Then restart TailWatch to load them.

Conclusion

TailWatch is a powerful monitoring system in cPanel & WHM that ensures critical services remain online. With chkservd, administrators can track, restart, and customize service monitoring. Additional drivers, process controls, and customization options make TailWatch a flexible and essential component of server management.