Control panels simplify server management, but they do not replace the Linux operating system underneath. Every cPanel/WHM server ultimately runs on a Linux distribution — typically AlmaLinux, Rocky Linux, or CloudLinux — and when WHM/cPanel becomes slow, unstable, or unreachable, the command line is where recovery happens.
This guide is intentionally bookmark‑worthy: it focuses on commands and checks you use when you are under pressure (panel down, high load, mail queue runaway, disk full, license errors, services flapping). It also includes cPanel-native service scripts that are safer than “blind restarts.”
Related reading:
- Comparing Hosting Control Panels: Architecture, Security & Operational Tradeoffs
- Your Guide to Fixing Common MySQL Server Problems
1) First 90 Seconds: Triage Checklist (Before You Touch Anything)
Goal: confirm what is failing and avoid making it worse.
- Confirm you are on the right server:
hostname -f; uname -r; date- Is the server alive / responsive?
uptime- Is load caused by CPU, memory, or disk I/O?
top -o %CPU
free -h- Is the disk full or inodes exhausted?
df -h
df -i- Quick “what changed?” context:
last -n 5
journalctl -p err -n 50 --no-pagerRule: If disk is 100% full or inodes are 100% used, fix that first. Many services break when they cannot write logs, temp files, or sockets.
2) When WHM/cPanel Is Down: The Core Services to Check
The panel relies on cPanel services and OS services.
A) Check cPanel’s main service (cpsrvd)
systemctl status cpsrvd --no-pagerIf it is down, restart the cPanel way:
/usr/local/cpanel/scripts/restartsrv_cpsrvdB) Check key backend services
systemctl status httpd --no-pager
systemctl status nginx --no-pager
systemctl status mariadb --no-pager || systemctl status mysqld --no-pager
systemctl status exim --no-pager
systemctl status dovecot --no-pager
systemctl status named --no-pagerTip: Use cPanel’s restartsrv scripts when available:
/usr/local/cpanel/scripts/restartsrv_httpd
/usr/local/cpanel/scripts/restartsrv_mysql
/usr/local/cpanel/scripts/restartsrv_exim
/usr/local/cpanel/scripts/restartsrv_dovecot
/usr/local/cpanel/scripts/restartsrv_named(These scripts are part of cPanel’s service management tooling.)
3) The Logs You Actually Need (Not Random /var/log Guessing)
A) cPanel/WHM application logs
ls -lh /usr/local/cpanel/logs/Common high-signal logs:
error_log(cPanel application errors)access_log(requests hitting cPanel)login_log(login activity)license_log(license verification issues)tailwatchd_log(service monitoring actions)
B) Service health monitoring logs
chkservd is a cPanel service monitor (TailWatch driver). Review:
tail -n 200 /var/log/chkservd.logTailWatch driver output:
tail -n 200 /usr/local/cpanel/logs/tailwatchd_logC) System logs (service failures, kernel issues)
journalctl -u cpsrvd -n 200 --no-pager
journalctl -u httpd -n 200 --no-pager
journalctl -u mariadb -n 200 --no-pager || journalctl -u mysqld -n 200 --no-pager4) License Errors That Break WHM: Fast Recovery Commands
Symptoms you might see:
- “Invalid License File”
- “License file is for the future”
- WHM shows trial mode / license warnings
A) Force license refresh
/usr/local/cpanel/cpkeycltB) If the error hints at time drift
Verify server time and time sync:
date
timedatectl statusThen restart cpsrvd and run license refresh:
/usr/local/cpanel/scripts/restartsrv_cpsrvd
/usr/local/cpanel/cpkeyclt5) High Load on cPanel Servers: Find the Real Cause (Fast)
A) Identify top CPU consumers
ps aux --sort=-%cpu | head -n 20B) Identify top memory consumers
ps aux --sort=-%mem | head -n 20C) Find “too many processes” per user (common in shared hosting)
ps -eo user= | sort | uniq -c | sort -nr | headD) Find web server overload
Apache status (if enabled) + logs:
tail -n 200 /usr/local/apache/logs/error_logE) Confirm whether disk I/O is the bottleneck
If available:
iostat -x 1 5If WHM is slow but SSH is fast, it is often a cPanel internal task or a service monitor loop — check TailWatch / chkservd logs.
6) Disk Full / Inodes Full: The Top cPanel Culprits
A) Quick disk and inode check
df -h; df -iB) Find the largest directories (safe overview)
du -xhd1 /home /var /usr/local 2>/dev/null | sort -hC) Common culprits on cPanel servers
- Backups and archives
- Massive mail directories
- Logs
- Temporary files
Quick checks:
du -sh /usr/local/cpanel/logs 2>/dev/null
du -sh /var/log 2>/dev/null
du -sh /home/*/mail 2>/dev/null | sort -h | tailSafety note: Do not delete randomly. Identify first, then clean with a plan.
7) Mail Queue Runaway (Spam / Bounces / Stuck Delivery)
A) Check queue size
exim -bpcB) Inspect recent queue activity
exim -bp | head -n 50C) Look for the top sending domains/users
grep -E "<= .* U=" /var/log/exim_mainlog | tail -n 200If a server is blacklisted or mail is delayed, queue health is often the first clue.
8) DNS Problems: Quick Verification
A) Is named running?
systemctl status named --no-pagerB) Test resolution from the server
dig +short example.com
dig +short @127.0.0.1 example.comIf local resolution fails but external works, named config / zone issues may exist.
9) MySQL/MariaDB Under Pressure: Minimal Safe Commands
A) Confirm service health
systemctl status mariadb --no-pager || systemctl status mysqld --no-pagerB) Quick connections and threads snapshot
mysqladmin processlistFor deeper recovery and safe repair flows, use our dedicated guide: Diagnosing MySQL server issues.
10) When Services Keep Restarting: chkservd / TailWatch Controls
cPanel uses TailWatch and its chkservd driver to monitor services and attempt restarts.
A) Restart chkservd cleanly
/usr/local/cpanel/scripts/restartsrv_chkservdB) Review why it is restarting services
tail -n 200 /var/log/chkservd.logC) TailWatch main log
tail -n 200 /usr/local/cpanel/logs/tailwatchd_logIf services are flapping, logs will show what chkservd observed and what it attempted.
11) Safe Session Management (Because SSH Drops)
On production servers, never risk losing a long repair session.
screen -S rescue
# or
tmux new -s rescue12) Practical Decision: When CLI Beats WHM
Use CLI when:
- WHM UI is unresponsive
- High load blocks GUI
- Disk is full and services can’t write
- License errors lock you out
- Mail queue is exploding
- You need fast log correlation
Panels provide convenience — but the OS retains authority.
Final Thoughts
If you manage Cloud or dedicated infrastructure, command‑line proficiency is not an optional skill — it is your recovery toolkit.
This guide is designed to be the “first bookmark” you open when something breaks.
