The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

My server started sending me all these emails, why?

Discussion in 'E-mail Discussions' started by fearmydesign, Oct 26, 2009.

  1. fearmydesign

    fearmydesign Well-Known Member

    Joined:
    Aug 24, 2009
    Messages:
    94
    Likes Received:
    0
    Trophy Points:
    6
    Hello everyone. About 4 days ago my server started to send me all these emails with a subject line of;

    "Suspicious process running under user haldaemon"
    or
    Suspicious process running under user mysql

    Approximatley 120 emails per day. It was not doing this before and I only have about 35 customers on my server, and I manage their websites for most of them. Here is part of what the emails say, I didn't want to put everything because it's really long;

     
  2. mtindor

    mtindor Well-Known Member

    Joined:
    Sep 14, 2004
    Messages:
    1,279
    Likes Received:
    36
    Trophy Points:
    48
    Location:
    inside a catfish
    cPanel Access Level:
    Root Administrator
    You need to first verify that there really aren't any "suspicious" processes running as those users.

    Then you need to run over to ConfigServer Services and look in their forums for your answer.... the answer is on their forums. Depending on how you have your CSF configured, you'll have to add some exceptions to a file to stop those warnings from happening.

    If your OS was updated recently or your CSF was updated recently, then the changes may be causing these alerts.

    Take a look at your csf.pignore file (in /etc/csf usually) as well as the readme.txt (for more detail) in /etc/csf.

    Mike
     
    #2 mtindor, Oct 26, 2009
    Last edited: Oct 26, 2009
  3. fearmydesign

    fearmydesign Well-Known Member

    Joined:
    Aug 24, 2009
    Messages:
    94
    Likes Received:
    0
    Trophy Points:
    6
    What is CFS?

    Thank you for your response. Could you tell me what CSF is? and how should it be configured? This is only my first server, and I need as much help as I can get. I will head over to ConfigServer Services to keep searching, thanks for the link.

    Regards,
     
  4. cPanelDon

    cPanelDon cPanel Quality Assurance Analyst
    Staff Member

    Joined:
    Nov 5, 2008
    Messages:
    2,557
    Likes Received:
    7
    Trophy Points:
    38
    Location:
    Houston, Texas, U.S.A.
    cPanel Access Level:
    DataCenter Provider
    Twitter:
    "Config Server Firewall" (CSF) is a third-party product; for more specific information I recommend referring to the vendor web site as provided earlier. Here is a specific page for CSF at the vendor's web site for more verbose details; included below is also a link to the forums, contact, and support pages:
    http://www.configserver.com/cp/csf.html
    http://forum.configserver.com/
    http://www.configserver.com/contact.html
    http://www.configserver.com/support.html
     
Loading...

Share This Page