Log files appearing in /bin and /usr/bin

samgreco

Member
Sep 7, 2008
5
1
51
I have just moved to a new server/provider and I keep getting an LFD checksum error on 2 files. Not sure what process is creating them and they seem to be constant updated. And they obviously don't belong in /usr/bin and /bin. The file name is log_data.txt in borh cases.

Contents is typically like this:

ram_avail:701 ram_total:64090
stor_used:57863 stor_total:231027 proc_load:0.47
uptime:729851 top_cpu:mysqld:2.6
top_mem:bash:0.0
total_proc:227

I'd really like to figure out what process is creating these so I can move them to the logs folder, but at a total loss as to how to figure this out. I have changed the alert time to one hour to try and keep my inbox from running wild. But that is certainly not the answer.

Has anyone seen this? My provider doesn't seem to know where this is coming from either.
 

rpvw

Well-Known Member
Jul 18, 2013
1,092
450
113
UK
cPanel Access Level
Root Administrator
I don't know what might be creating them, and I see a similar question asked (unanswered) in the CSF forum.

You could try adding the following to your /etc/csf/csf.fignore file (don't forget to save [change] and restart CSF/LFD when you are done)
Code:
/bin/log_data.txt
/usr/bin/log_data.txt
It won't stop the files being created/updated, but it should stop the email notifications

CSF/LFD states in the /etc/csf/csf.fignore instructions, that it does not check files owned by root - so since it is clearly checking these files and sending you emails about them, I wonder if the file ownership might give you a clue as to where to start looking for the process that is creating them.
 
Last edited:

samgreco

Member
Sep 7, 2008
5
1
51
I did try that. CSF tells me that you can't ignore anything in those folders, which makes sense. So the only way to fixe this, is to point them to another folder like /var/logs. But I can't do that until I find out what is creating them.
 

samgreco

Member
Sep 7, 2008
5
1
51
Yes, it is what I posted on the OP:

ram_avail:701 ram_total:64090
stor_used:57863 stor_total:231027 proc_load:0.47
uptime:729851 top_cpu:mysqld:2.6
top_mem:bash:0.0
total_proc:227


Except of course, the data keeps changing.
 

samgreco

Member
Sep 7, 2008
5
1
51
Sorry for the long delay. Too many projects clamoring for time.

This is the way OI got this server and no one at my hosting company seems to know where it is coming from. So I had been trying to track it down myself as I had time. It's not a serious problem, but certainly annoying. It had been sending messages every 10 minutes. But I changed that on LFD to every hour just to keep my sanity. But I would really like to get it back to 10 minutes so that if it were a real problem, I would know before too much damaged was caused.