lfd

  1. G

    lfd on cpanelserver: System Integrity checking detected a modified system file

    Hi guys, Got this alert from one of the cPanel servers (I have 2) Please advise how it should be investigated.
  2. keat63

    lfd blocked too many connections

    In my logs i'm seeing Subject: lfd on my.server.co.uk: xx.xxx.xx.xxx (GB/United Kingdom/xx.xxx.xx.xxx.dsl.in-addr.zen.co.uk) blocked with too many connections I know exactly what this is, it's a database sync between our internal server and web server. My IP is whitelisted in CSF. Any ideas...
  3. eventtex

    LFD - Suspicious process running under user postgres

    Hello, I come to you because I received several notification emails from my VPS server entitled: LFD - Suspicious process running under user postgres Here is the content of the email I wanted to have your opinion on this subject to know if I should take this alert into account or not? Is...
  4. J

    lfd on server.com: Suspicious process running under user username

    Hello, I was wondering if anyone could help me with this. We keep receiving messages like this and I am concerned that something is wrong and if not, how can I stop the notifications? Many thanks Time: Mon May 2 10:04:43 2022 -0400 PID: 2072066 (Parent PID:1951773) Account...
  5. D

    lfd Suspicious process running under user nobody

    my whm version: 100.0.7 apache+nginx+npm+php-fpm I am getting hundredes of alert email from ConfigServer Security & Firewall - csf v14.15 as follows Time: Thu Jan 27 20:29:02 2022 +0530 PID: 2656 (Parent PID:31208) Account: nobody Uptime: 92 seconds Executable: /usr/sbin/nginx...
  6. leonep

    LFD wp-toolkit whitelist commands in /var/log/secure

    Hi, i have a lot of lines in /var/log/secure about wptoolkit commands, like this: /var/log/secure: Dec 9 07:00:00 server sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=myuser ; COMMAND=/bin/cagefs_enter stat -c %a...
  7. K

    LFD Alerts

    Hello, How can i disable this email notification `lfd on xxxxxxxxxxxxxxxxxxxxx: WHM/cPanel root access alert from IP xxxxxx` whenever i switch tabs? I want to receive this email only when I/someone logging in to the WHM interface. If i switch browser tab, and if i click some other menu item...
  8. BlueSteam

    LFD Alerts from CSF about php-fpm Excessive resource usage for Virtual Memory Size

    Hi All, I am aware that the following alert is coming from CSF about the php-fpm pool: The server is a brand new installation of cPanel and this is the first account that has been loaded on to the server. All configs are default for cPanel and PHP as well as CSF. Is this really actually...
  9. C

    How to set "From" email for the server for CSF/LFD alerts?

    Hello, CSF/LFD alerts are not being forwarded to my email which I've set on Home »Server Contacts »Edit System Mail Preferences. Where to set the From email in the WHM? Return-path: <[email protected]> Received: from root by ns1234 with local (Exim 4.94.2) (envelope-from <[email protected] ns1234>) id...
  10. V

    C panel server going down frequently

    Hello folks, I have a C panel hosted on Centos 7 server, it's going down frequently. getting some emails that Clamd, LFD, Spamd failing. Please refer attached screenshots Thanks
  11. R

    WHM access not by me

    Hello, today lfd notified me a new WHM/cPanel root access to my VPS by an IP from Romania (it's not mine). When i saw the email, i logged immediately into WHM and i blocked that IP. I changed also my root password. Apparently it seems that everything works fine. My VPS has CSF installed and...
  12. G

    LFD keeps failing, now I see that /usr/sbin/csf and lfd have been modified

    For the last couple of days I've been getting a TON of emails that lfd has failed. I had a cracker upload a backdoor script on 10/7/20 that I thought was fixed, but maybe I was wrong. I'm running WHM / cPanel v.86.0.29 because I'm still using MySQL 5.5, and no one responded on whether there is...
  13. R

    Using Imunify360, but see this message "CSF is installed, but LFD is not running"

    I have Imunfy360 installed and CSF/LDF seem to be uninstalled. I see this message "CSF is installed, but LFD is not running" in the Security Advisor output. I realize the notice is not accurate and can be safely ignore it ( I double check for CSF/LDF via SSH, not installed ). Anything I can...
  14. inteldigital

    LFD LiteSpeed notification: Suspicious process running under user nobody

    Hi I am having this annoying issue with LFD flagging LiteSpeed as running under nobody and using excessive resources etc. I've tried adding it to ignore list in WHM using the following regex but it isn't taking. Does anybody have any other suggestions? pexe:^/usr/local/lsws/bin/lshttpd.*$
  15. R

    lfd Suspicious File Alert after Acronis installation

    Hello, i recently installed Acronis agent on my VPS for doing backup of the entire server. Everything is ok but, after midnight, lfd sent me many notifications like that lfd on server.vpstest.it: Suspicious File Alert Time: Thu Nov 21 00:05:06 2019 +0100 File...
  16. C

    lfd excessive processes running under user

    I have looked at the few threads regarding this error and none seem to apply to my case Related or unrelated, I started getting the errors for one user: User:lochhavenclubinc PID:8483 PPID:8335 Run Time:3(secs) Memory:309316(kb) RSS:42040(kb) exe:/opt/cpanel/ea-php72/root/usr/bin/php-cgi...
  17. L

    lfd Excessive resource

    Hi, I have an issue and i do not know how to handle. I receive a lot of mails like this Time: Sun Jan 6 13:01:56 2019 +0200 Account: xxxx Resource: Process Time Exceeded: 299479 > 3600 (seconds) Executable: /opt/cpanel/ea-php71/root/usr/bin/lsphp Command Line: lsphp...
  18. USA_Webmaster

    Disable lfd email alerts for whitelisted IP?

    I was trying to reply to this thread but forums locked old post -- Viewing Successful Root Login Log --- Hey @cPanelMichael :-D I just checked WHM >> cPHulk Brute Force Protection Whitelist Management tab for VPS WHMCS IP and it's already listed. Why am I still getting email alert lfg...
  19. T

    SOLVED LFD Hung Task Timeout Error

    Hi everyone INFO: task lfd - (child) p:21289 blocked for more than 120 seconds "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this messages This error is appearing every morning on my server , and web pages are not loaded then Anyone can give me advice
  20. X

    lfd excessive resource usage warnings with litespeed

    Hi, I have been getting excessive resource usage warnings from lfd like this: Time: Tue Apr 24 17:03:54 2018 +0430 Account: kw179 Resource: Process Time Exceeded: 1811 > 1800 (seconds) Executable: /opt/cpanel/ea-php71/root/usr/bin/lsphp Command Line: lsphp...