What the alert means

cPanel runs a service monitor called chkservd. Every few minutes it checks that services such as Apache, Exim, MySQL and SSH respond. When a check fails, it tries to restart the service and emails the server contact with a message such as sshd has failed, please contact the sysadmin. It can mean that SSH really stopped, or that the check itself fails.

Step 1: get access to the server

If you can still log in over SSH, use that. If not, use the console in your provider’s control panel (VNC, KVM or IPMI). Console access does not depend on SSH, so it works even when sshd is down. WHM’s Terminal page is another option while WHM still works.

Step 2: check the SSH service

systemctl status sshd --no-pager
journalctl -u sshd -n 50 --no-pager     # recent SSH log lines
ss -tlnp | grep sshd                    # which port SSH listens on

If the service is active (running) and listens on the port you expect, SSH is fine and the alert is about the monitor. Go to Step 4. If it is stopped or failed, continue with Step 3.

Step 3: fix a stopped SSH service

The most common cause is a mistake in /etc/ssh/sshd_config, often after changing the port or login settings. Test the file:

sshd -t

No output means the file is valid. Otherwise, the message names the line with the problem. Fix it, then restart SSH:

/scripts/restartsrv_sshd
# or
systemctl restart sshd

Keep your current session open, and test a new login in a second window before you close it. Other causes include a full disk (df -h), missing host keys (regenerate them with ssh-keygen -A), or another program using the SSH port.

Step 4: fix false alerts after a port change

If you moved SSH to a different port, the monitor and the firewall must both know about it:

1. Open the new port in the firewall before you restart SSH. With CSF, add it to TCP_IN in /etc/csf/csf.conf and run csf -r.
2. In WHM, open Service Configuration > Service Manager and check that monitoring is enabled for the SSH daemon.
3. Read the monitor’s log to see why the check fails: tail -n 50 /var/log/chkservd.log.
4. If the check still uses the old port, restart the monitor with /scripts/restartsrv_chkservd after the SSH change, and contact support if the alerts continue.

Our CSF firewall guide shows how to open ports safely.

Change the SSH port safely

1. Open the new port in the firewall first.
2. Edit /etc/ssh/sshd_config and set Port 2222 (or your chosen port).
3. Run sshd -t to test the file.
4. Restart SSH with /scripts/restartsrv_sshd.
5. In a second window, log in with ssh -p 2222 root@your-server-ip.
6. Only when the new login works, close the old port in the firewall.

A different port reduces automated login attempts, but it is not real protection on its own. SSH keys and turning off password logins matter more.

Prevent SSH lockouts

• ✓ Always test sshd -t before restarting SSH.
• ✓ Keep one session open while you test changes in another.
• ✓ Make sure you know how to reach the console in your provider’s control panel.
• ✓ Add your own IP address to the firewall allow list, so login protection never blocks you.
• ✓ Use the safe SSH practices in our SSH commands guide.