Log files appearing in /bin and /usr/bin

[samgreco]

I have just moved to a new server/provider and I keep getting an LFD checksum error on 2 files. Not sure what process is creating them and they seem to be constant updated. And they obviously don't belong in /usr/bin and /bin. The file name is log_data.txt in borh cases.

Contents is typically like this:

ram_avail:701 ram_total:64090
stor_used:57863 stor_total:231027 proc_load:0.47
uptime:729851 top_cpu:mysqld:2.6
top_mem:bash:0.0
total_proc:227​

I'd really like to figure out what process is creating these so I can move them to the logs folder, but at a total loss as to how to figure this out. I have changed the alert time to one hour to try and keep my inbox from running wild. But that is certainly not the answer.

Has anyone seen this? My provider doesn't seem to know where this is coming from either.

 

[rpvw]

I don't know what might be creating them, and I see a similar question asked (unanswered) in the CSF forum.

You could try adding the following to your /etc/csf/csf.fignore file (don't forget to save [change] and restart CSF/LFD when you are done)

/bin/log_data.txt
/usr/bin/log_data.txt

It won't stop the files being created/updated, but it should stop the email notifications

CSF/LFD states in the /etc/csf/csf.fignore instructions, that it does not check files owned by root - so since it is clearly checking these files and sending you emails about them, I wonder if the file ownership might give you a clue as to where to start looking for the process that is creating them.

 

[samgreco]

I did try that. CSF tells me that you can't ignore anything in those folders, which makes sense. So the only way to fixe this, is to point them to another folder like /var/logs. But I can't do that until I find out what is creating them.

 

[cPanelLauren]

Hi @samgreco

Any idea what is in the log files? Identifying what is creating them may assist with finding where you need to go to change the log dir.

Though I do find it abnormal that anything would be creating logs in /bin or /usr/bin

Thanks!

 

[samgreco]

Yes, it is what I posted on the OP:

ram_avail:701 ram_total:64090
stor_used:57863 stor_total:231027 proc_load:0.47
uptime:729851 top_cpu:mysqld:2.6
top_mem:bash:0.0
total_proc:227

Except of course, the data keeps changing.

 

[cPanelLauren]

Hi @samgreco

I apologize I didn't realize that was the content of the log file. Have you installed any monitoring software? Or anything on the server recently which has logging?

 

[samgreco]

Sorry for the long delay. Too many projects clamoring for time.

This is the way OI got this server and no one at my hosting company seems to know where it is coming from. So I had been trying to track it down myself as I had time. It's not a serious problem, but certainly annoying. It had been sending messages every 10 minutes. But I changed that on LFD to every hour just to keep my sanity. But I would really like to get it back to 10 minutes so that if it were a real problem, I would know before too much damaged was caused.

 

[cPanelLauren]

Hi @samgreco

At this point you may want to get a system administrator to help, at least identify the source of the log file. If you don't have one you might find one here: System Administration Services | cPanel Forums