IMH T1/T1E Field Guide

⌂

Start Here

IMH access tools, role tags, and live-contact workflow.

T1/T1E

jshelp

Jumpstation custom-tool help.

T1/T1E

jump SERVER

Primary SSH wrapper for shared, VPS, dedicated, and internal assets. Supports -p, -v, and -c.

T1

t1ssh VPS_ID

T1 VPS SSH access.

T1E+

havps find VPS_ID

Locate a VPS parent node.

T1E+

havps enter VPS_ID

Create a shell inside a VPS through its host node.

T1E+

havps node VPS_ID

Locate and SSH to the VPS node.

READ

imhsc ip IP

System Center IP lookup.

READ

imhsc vps VPS_ID

System Center VPS lookup.

READ

imhsc dedi SERVER

System Center dedicated lookup.

CHANGE

imhsc dedi SERVER --status STATUS

Change dedicated server status; role/policy dependent.

CHANGE

imhsc dedi SERVER --note 'TEXT'

Add/update dedicated server note; role/policy dependent.

T1/T1E

cloudssh SERVER

SSH wrapper for OpenMetal clouds.

Note: The functional access of IMH tools depends on company role and access restrictions.

Note: Use read-only checks first. A technically valid root command is not automatically authorized for every contact.

◎

DNS / Domain

Fast domain verification, authoritative checks, and DNS-cluster workflows.

READ

check-domain -d DOMAIN

RDAP plus common DNS and mail-authentication records.

READ

check-domain -d DOMAIN -m

Also resolve MX record IPs.

READ

check-domain -d DOMAIN -S

Check DNSSEC status.

READ

check-domain -d DOMAIN -k SELECTOR

Check a specific DKIM selector.

READ

check-domain -d DOMAIN -n NAMESERVER

Use a specific nameserver.

READ

newcall DOMAIN

IMH all-in-one DNS overview.

READ

newcall DOMAIN prop

Propagation check.

READ

newcall DOMAIN spam

Spam-oriented NS/PTR/MX/SPF/DMARC check.

READ

newcall DOMAIN ssl

SSL-oriented checks.

READ

newcall DOMAIN caa

CAA check.

READ

newcall DOMAIN redirect

Redirect check.

READ

dig +short A DOMAIN

IPv4.

READ

dig +short AAAA DOMAIN

IPv6.

READ

dig +short MX DOMAIN

Mail exchangers.

READ

dig +short NS DOMAIN

Authoritative nameservers.

READ

dig +short TXT DOMAIN

TXT/SPF/verification.

READ

dig +short CAA DOMAIN

CAA.

READ

dig @1.1.1.1 DOMAIN A +short

Compare Cloudflare public resolver.

READ

dig @8.8.8.8 DOMAIN A +short

Compare Google public resolver.

READ

dig +trace DOMAIN

Delegation trace.

CHANGE

dns-sync DOMAIN

Attempt IMH DNS-zone sync. Wraps dnscluster synczone and checks cPanel error logs.

CHANGE

dns-sync -s DOMAIN

Force SOA serial update.

Note: newcall is helpful but is not a substitute for dig.

Note: dns-sync 401 = DNS-cluster key/authentication issue. 409 = DNS authority is owned by another server; follow authority policy.

Note: If dns-sync reports no cPanel error-log result, dnsadmin likely did not attempt the synchronization.

↗

HTTP / Website Errors

Reproduce the problem, capture evidence, then follow the correct backend path.

403

Access denied

Check .htaccess, permissions, ModSecurity/WAF, and access restrictions.

404

Not found

Check URL/path, WordPress permalinks/rewrite, and .htaccess.

406

Not acceptable

Content negotiation is possible; on IMH hosting also check ModSecurity/WAF false positives.

500

Internal server error

Check domain PHP log, Apache error log, .htaccess, PHP compatibility/resources, and database failures.

502

Bad gateway

Investigate proxy/upstream communication, NGINX ↔ Apache/PHP-FPM, and backend health.

503

Service unavailable

Check maintenance state, resources, backend/cache/DB availability, and worker limits.

504

Gateway timeout

Check long PHP/DB work, overloaded PHP-FPM/Apache, and upstream timeout conditions.

READ

curl -skI https://DOMAIN/PATH

Status and headers.

READ

curl -ILk https://DOMAIN/PATH

Follow redirect chain.

READ

curl -A 'Mozilla/5.0' -skI https://DOMAIN/PATH

Compare browser-like User-Agent behavior.

READ

curl -sk -o /dev/null -w 'HTTP:%{http_code} TTFB:%{time_starttransfer}s Total:%{time_total}s\n' https://DOMAIN/

Status plus TTFB and total time.

ROOT READ

curl -skI --resolve DOMAIN:443:ORIGIN_IP https://DOMAIN/

Test a specific origin without changing DNS.

Note: InMotion's current HTTP guide notes that WordPress Stack NGINX waits up to 60 seconds for PHP or Apache before returning a 504.

▤

Logs

Current IMH cPanel/CWP log locations. Confirm the platform before searching.

cPanel / EasyApache 4

Use	Path
Global Apache error	`/var/log/apache2/error_log`
Global Apache access	`/var/log/apache2/access_log`
Domain logs (IMH quick ref)	`/var/log/apache2/domlogs/`
Domain logs (cPanel canonical)	`/etc/apache2/logs/domlogs/`
Account raw access	`~/access-logs/`
Archived HTTP	`~/logs/DOMAIN-Mon-YEAR.gz`
Archived SSL	`~/logs/DOMAIN-ssl_log-Mon-YEAR.gz`
ModSecurity audit	`/var/log/apache2/modsec_audit.log`
Domain PHP	`~/logs/DOMAIN_com.php.error.log`
EA-PHP FPM	`/opt/cpanel/ea-phpXX/root/usr/var/php-fpm/error.log`
cPanel internal PHP-FPM	`/usr/local/cpanel/logs/php-fpm/error.log`
Exim main	`/var/log/exim_mainlog`
Exim reject	`/var/log/exim_rejectlog`
Exim panic	`/var/log/exim_paniclog`
Dovecot	`/var/log/maillog`
AutoSSL	`/var/cpanel/logs/autossl/`
cPHulk	`/usr/local/cpanel/logs/cphulkd.log`
SSH / SFTP	`/var/log/secure`
Cron	`/var/log/cron`

CWP

Use	Path
Apache error	`/usr/local/apache/logs/error_log`
Apache access	`/usr/local/apache/logs/access_log`
Domain logs	`/usr/local/apache/domlogs/`
Webserver rebuild	`/var/log/cwp/webservers.log`
PHP mail	`/usr/local/apache/logs/phpmail.log`
CWP PHP Selector / FPM	`/opt/alt/php-fpm*/usr/var/log/php-fpm.log`
ModSecurity audit	`/usr/local/apache/logs/modsec_audit.log`
CWP service access	`/usr/local/cwpsrv/logs/access_log`
CWP service error	`/usr/local/cwpsrv/logs/error_log`
Postfix SMTP	`/var/log/maillog`
Dovecot	`/var/log/dovecot-info.log`
AutoSSL	`/var/log/cwp/autossl.log`
Hostname AutoSSL	`/root/.acme.sh/acme.sh.log`
SSH / SFTP	`/var/log/secure`
Cron	`/var/log/cron`

ROOT READ

grep -i 'DOMAIN' /var/log/apache2/error_log | tail -100

Last 100 cPanel domain-related Apache errors.

ROOT READ

grep -i 'DOMAIN' /usr/local/apache/logs/error_log | tail -100

Last 100 CWP domain-related Apache errors.

ROOT READ

grep -i 'DOMAIN' /var/log/apache2/error_log | grep -Ei 'ModSecurity|403|406' | tail -100

cPanel ModSecurity/access errors.

USER READ

tail -100 ~/logs/DOMAIN_com.php.error.log

Recent domain PHP errors.

ROOT READ

grep -i 'USERNAME\|IP' /var/log/secure | tail -100

SSH/SFTP authentication evidence.

ROOT READ

grep -i 'USERNAME\|IP' /usr/local/cpanel/logs/cphulkd.log | tail -100

cPHulk evidence.

ROOT READ

grep -Ri 'DOMAIN' /var/cpanel/logs/autossl/ | tail -100

AutoSSL evidence.

◆

Permissions / Files

Inspect first; use IMH fixperms instead of blanket recursive permission changes.

READ

pwd; whoami

Confirm execution context.

READ

ls -lah

Files, owner/group, permissions, hidden files.

READ

stat FILE

Exact owner, group, mode, and timestamps.

READ

namei -l /FULL/PATH

Permissions/ownership for every component in the path.

READ

find . -type f -perm /002 -print

World-writable files.

READ

find . -type d -perm /002 -print

World-writable directories.

READ

fixperms -v -n USER

IMH verbose no-op preview. Run on the target server.

CHANGE

fixperms USER

IMH cPanel-user permission repair.

CHANGE

fixperms --skip-mail USER

Skip mailperm on etc/mail.

CHANGE

fixperms --skip PATH USER

Skip selected paths.

CAUTION

fixperms --no-preserve-exec USER

Do not preserve execute bits; not a routine repair option.

READ

du -sh .; du -sh * 2>/dev/null | sort -h

Current directory and child sizes.

READ

df -h; df -i

Filesystem space and inode usage.

Note: Do not normalize blanket recursive chmod/chown as a routine cPanel fix when IMH fixperms is available.

W

WordPress

WP-CLI checks and safe troubleshooting sequence.

USER READ

wp core version

WordPress version.

USER READ

wp core verify-checksums

Core integrity.

USER READ

wp plugin list

Plugin state and versions.

USER READ

wp theme list

Theme state and versions.

USER READ

wp user list

Users and roles.

USER READ

wp option get home; wp option get siteurl

Canonical URLs.

USER READ

wp cron event list

Cron events.

USER READ

wp db check

Database table check.

USER READ

wp config get DB_NAME

Configured WordPress DB name.

USER READ

wp search-replace 'OLD' 'NEW' --all-tables-with-prefix --dry-run

Serialized-safe preview.

CHANGE

wp plugin deactivate PLUGIN

Plugin isolation.

CHANGE

wp cache flush

Flush WordPress object cache.

CHANGE

wp rewrite flush

Flush rewrite rules.

CHANGE

wp cron event run --due-now

Run due cron events.

CHANGE

wp option update home 'https://DOMAIN'

Change WordPress home URL.

CHANGE

wp option update siteurl 'https://DOMAIN'

Change WordPress site URL.

Note: Run ordinary WP-CLI from the WordPress document root as the cPanel user unless an approved workflow explicitly requires otherwise.

⚙

PHP / PHP-FPM / Services

Current cPanel-supported PHP-FPM and service checks.

USER READ

php -v

CLI PHP version.

USER READ

php -m | sort

Loaded CLI PHP modules.

ROOT READ

ps aux | grep '[p]hp-fpm'

FPM processes/pools.

ROOT READ

/usr/local/cpanel/scripts/php_fpm_config --check

Official cPanel PHP-FPM configuration consistency check.

ROOT READ

/usr/local/cpanel/scripts/php_fpm_config --check --json

JSON FPM check output.

CHANGE

/usr/local/cpanel/scripts/php_fpm_config --rebuild --domain=DOMAIN

Rebuild one domain's FPM configuration.

CHANGE

/usr/local/cpanel/scripts/php_fpm_config --rebuild

Rebuild all FPM configuration.

ROOT READ

/usr/local/cpanel/scripts/restartsrv_httpd --check

Check Apache service.

CHANGE

/usr/local/cpanel/scripts/restartsrv_httpd --restart

Soft restart Apache using cPanel script.

CHANGE

/usr/local/cpanel/scripts/restartsrv_apache_php_fpm --restart

Restart Apache PHP-FPM service.

CHANGE

/usr/local/cpanel/scripts/restartsrv_exim --restart

Restart Exim.

CHANGE

/usr/local/cpanel/scripts/restartsrv_dovecot --restart

Restart Dovecot.

CHANGE

/usr/local/cpanel/scripts/restartsrv_mysql --restart

Restart MySQL/MariaDB through cPanel wrapper.

Note: Current cPanel documentation prefers restartsrv_* scripts; direct systemctl restart is a fallback when cPanel cannot restart the service.

✉

Email

Exim/Dovecot investigations, IMH mail diagnostics, and high-risk actions.

ROOT READ

exim -bpc

Outgoing queue count. IMH internal guide notes VPS+ context.

ROOT READ

exim -bp

Queue listing.

ROOT READ

exim -bp | exiqsumm

Queue summary.

ROOT READ

exigrep 'ADDRESS' /var/log/exim_mainlog

Trace an address.

ROOT READ

exigrep 'MESSAGE_ID' /var/log/exim_mainlog

Trace a message ID.

ROOT READ

grep -F 'ADDRESS' /var/log/exim_rejectlog | tail -100

Recent rejects.

READ

sudo cat /etc/mailips

Shared mail-IP mapping where sudo is allowed.

CHANGE

addlocaldomain DOMAIN

Set local routing when diagnosis supports it.

CHANGE

rmlocaldomain DOMAIN

Remove local routing for remote MX.

ROOT READ

/opt/dedrads/check_imap --mailbox

IMAP connections by mailbox.

ROOT READ

/opt/dedrads/check_imap --userconns

IMAP connections by user.

ROOT READ

/opt/dedrads/check_imap --login_failed

Failed login IPs.

ROOT READ

/opt/dedrads/check_imap --login_ip | sort -nr | head -10

Email logins by IP.

ROOT READ

/opt/dedrads/check_exim --queuebybounceback | sort -nr | head -10

Bounce destinations.

ROOT READ

/opt/dedrads/check_boxtrapper --logs

BoxTrapper-war check.

USER CHANGE

find . -name 'dovecot.*' -ls -delete

Delete Dovecot indexes from the correct cPanel-user mail scope.

APS/T1E DESTRUCTIVE

find /var/spool/exim/input -type f -exec rm -f {} +

Clear ALL pending outgoing Exim messages.

Note: Do not clear the entire Exim queue to solve one sender or one compromised script.

Note: IMH internal documentation marks whole-queue removal and retry-DB reset as root/T1E or APS escalation operations.

◈

SSL / AutoSSL

DNS → CAA → certificate → DCV → CDN/origin → application.

READ

check-domain -d DOMAIN

DNS and registration baseline.

READ

newcall DOMAIN caa

CAA check.

READ

newcall DOMAIN ssl

IMH SSL checks.

READ

dig +short A DOMAIN; dig +short AAAA DOMAIN; dig +short CAA DOMAIN

Manual DCV prerequisites.

READ

openssl s_client -connect DOMAIN:443 -servername DOMAIN </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates

Certificate actually presented.

READ

curl -ILk http://DOMAIN; curl -ILk https://DOMAIN

HTTP/HTTPS redirect behavior.

ROOT READ

grep -Ri 'DOMAIN' /var/cpanel/logs/autossl/ | tail -100

AutoSSL evidence.

Note: A valid certificate does not prove the application is correctly configured for HTTPS.

Note: With Cloudflare/CDN, distinguish edge certificate behavior from origin certificate and DCV behavior.

▦

Server / Database / Network

Resource checks, MySQL/MariaDB, ports, and connectivity.

ROOT READ

uptime

Load averages.

ROOT READ

free -m

Memory and swap.

ROOT READ

df -h; df -i

Disk and inodes.

ROOT READ

ps aux --sort=-%cpu | head -20

Top CPU consumers.

ROOT READ

ps aux --sort=-%mem | head -20

Top memory consumers.

ROOT READ

journalctl -p err -n 100 --no-pager

Recent systemd errors.

READ

mysql --version

MySQL/MariaDB client/version.

ROOT READ

mysqladmin status

Database server status.

ROOT READ

mysql -e 'SHOW FULL PROCESSLIST;'

Active queries.

USER READ

mysqldump -u DBUSER -p DBNAME > DBNAME-$(date +%F).sql

Logical database backup.

CHANGE

mysql -u DBUSER -p DBNAME < backup.sql

Database import/restore.

READ

ss -lntup

Listening TCP/UDP sockets; process detail may require root.

READ

nc -vz HOST PORT

TCP connectivity.

READ

traceroute HOST

Network path.

READ

ping -c 4 HOST

Basic ICMP reachability.

↑

Escalation

IMH best-practice escalation gate and concise handoff format.

Replicate the issue and identify the exact URL/service/error. Include machine evidence: relevant log line, HTTP result, DNS output, or application error. Do your own basic troubleshooting and state what each test showed. Check WHOIS/RDAP and DNS when relevant; verify the domain points to the expected server. Reference the Help Center/internal resource used. Verify the correct ticket, account, service, and escalation target. Keep it simple; omit extraneous information. End with a specific technical question or requested action.

Escalation template

Agent Role	T1 / T1E
Quick Copy	account / server / domain
Platform	cPanel / CWP / UltraStack
Affected Address	exact URL or service
PP Link	correct account
Verified	True / False
Contact Type	Chat / Phone / etc.
Issue or Request	one concise statement
Troubleshooting	replication + DNS + logs + tests + results
Escalation Question	specific technical action/decision needed

§

Sources & verification

Source hierarchy used to build this site.

Accuracy standard: IMH-specific syntax and role boundaries come only from the internal help/documentation supplied for this project. Older script inventories are discovery-only unless separately documented.

Source	Reference
IMH internal	Jumpstation Custom Tools Quickstart and live --help output — jump, t1ssh, havps, imhsc, newcall, check-domain, cloudssh
IMH internal	fixperms --help — server-side cPanel permission repair syntax
IMH internal	dns-sync --help — DNS sync behavior, 401/409 diagnostics, Shared/VPS+ notes
IMH internal	Quick Reference Guide - Logs — updated Jul 22, 2026 — cPanel and CWP operational log paths
IMH internal	Quick Reference Guide - Email — IMH email scripts and explicit T1E/APS boundaries
IMH internal	Escalations - Best Practices — updated Jul 7, 2026 — escalation workflow
InMotion	HTTP Error Codes — updated Dec 31, 2025
InMotion	SSL & AutoSSL Guide
InMotion	SSH and Root Access
cPanel	The cPanel Log Files
cPanel	WHM Scripts
cPanel	restartsrv Script
cPanel	php_fpm_config Script

Log-path reconciliation: The supplied IMH log guide lists cPanel domain logs at /var/log/apache2/domlogs/. Current cPanel documentation lists the EasyApache 4 canonical location under /etc/apache2/logs/domlogs/. This site preserves both instead of guessing that one is universally wrong.

T1 / T1E SSH Field Guide

Live-contact first pass

Start Here

DNS / Domain

HTTP / Website Errors

Access denied

Not found

Not acceptable

Internal server error

Bad gateway

Service unavailable

Gateway timeout

Logs

cPanel / EasyApache 4

CWP

Permissions / Files

WordPress

PHP / PHP-FPM / Services

Email

SSL / AutoSSL

Server / Database / Network

Escalation

Escalation template

Sources & verification