maldet doesn't work after restart server

Usif Nasirov · Feb 21, 2020

cPanelLauren · Feb 21, 2020

How were you running it previously?

There are a few different ways

You can run it through a cron - if this was how it was done previously you'd need to check the crontab to ensure it's still there and ensure that it's not giving you an error
You can also run it in "monitor" mode as is explained in the help for maldet when you run maldet --help:

Code:

    -m, --monitor USERS|PATHS|FILE|RELOAD
       Run maldet with inotify kernel level file create/modify monitoring
       If USERS is specified, monitor user homedirs for UID's > 500
       If FILE is specified, paths will be extracted from file, line spaced
       If PATHS are specified, must be comma spaced list, NO WILDCARDS!
       e.g: maldet --monitor users
       e.g: maldet --monitor /root/monitor_paths
       e.g: maldet --monitor /home/mike,/home/ashton

you might also check to see what's in maldet --log

Usif Nasirov · Mar 25, 2020

No, dont't have any problem with manual run. just maldet every day scan . and I get mail about scannig. if I did maldet --report list I saw what is scannet today. jsut after restart server maldet stopped checking. so when I run this command maldet --report list I saw only old information.

cPanelLauren · Mar 25, 2020

You might check for the corn being present. Per their README:

Code:

.: 10 [ CRON DAILY ]

The cronjob installed by LMD is located at /etc/cron.daily/maldet and is used
to perform a daily update of signatures, keep the session, temp and quarantine
data to no more than 14d old and run a daily scan of recent file system changes.

The daily scan supports a variety of control panel systems or standard Linux
/home*/user paths.

If you are running monitor mode, the daily scans will be skipped and instead a
daily report will be issued for all monitoring events.

If you need to scan additional paths, you should review the cronjob and use one
of the customization hook files, such as '/usr/local/maldetect/cron/custom.cron',
to write in custom scanning execution. For configuration based cron changes, you
can redefine any conf.maldet variables at '/etc/sysconfig/maldet' or
'/usr/local/maldetect/cron/conf.maldet.cron'.

You may want to check with them specifically for further information, this isn't something that cPanel provides or maintains. Their site can be found here: Linux Malware Detect – R-fx Networks

Usif Nasirov · Mar 30, 2020

maybe I can't explain ))
I do nothing, but if I reboot server the maldet stop scannig auto, cron and everything is ok.
If I reinstall maldet agai is good work untill reboot server. If I can't explain, I will not try again )
Have a nice day!

cPanelLauren · Apr 1, 2020

Hello,

I understand what's happening and that does definitely sound like an issue but what I am trying to explain is that is not something cPanel manages. I am not sure why this is occurring but you would need to check the configuration for maldet and ensure that it is always running in monitor mode. Most likely it might be that when the server reboots, maldet is not restarted in that mode.

Thread starter	Similar threads	Forum	Replies	Date
J	maldet with clamav confusion	Security	7	Oct 30, 2021
M	Maldetect Report Issue	Security	2	May 24, 2019
D	Automating Maldet scan question	Security	3	Aug 16, 2018
M	Maldet is Saving Signatures to Root?	Security	1	Jul 10, 2017
W	Anacron job 'cron.daily' Maldet	Security	4	May 28, 2017

Search

Search

maldet doesn't work after restart server

Usif Nasirov

Active Member

cPanelLauren

Product Owner II

Usif Nasirov

Active Member

cPanelLauren

Product Owner II

Usif Nasirov

Active Member

cPanelLauren

Product Owner II