System Integrity checking detected a modified system file

[s37n]

I got the following message today, and not sure if I should be concerned or not. Any assistance would be greatly appreciated.

Thanks,

[HR][/HR]
The following list of files have FAILED the md5sum comparison test. This means that the file has been changed in some way. This could be a result of an OS update or application upgrade. If the change is unexpected it should be investigated:

/usr/sbin/build-locale-archive: FAILED
/usr/sbin/glibc_post_upgrade.i686: FAILED
/usr/sbin/nscd: FAILED
/usr/sbin/tzdata-update: FAILED
/sbin/cciss_id: FAILED
/sbin/grubby: FAILED
/sbin/kpartx: FAILED
/sbin/ldconfig: FAILED
/sbin/mkinitrd: FAILED
/sbin/multipath: FAILED
/sbin/multipathd: FAILED
/sbin/multipath.static: FAILED
/sbin/nash: FAILED
/sbin/sln: FAILED

 

[s37n]

ok, I think this might be from the cpanel update cron job. I got an email about it running shortly before the System integrity email arrived.

/usr/local/cpanel/scripts/upcp --cron

 

[Infopro]

I got the following message today, and not sure if I should be concerned or not. Any assistance would be greatly appreciated.

Thanks,

[HR][/HR]
The following list of files have FAILED the md5sum comparison test. This means that the file has been changed in some way. This could be a result of an OS update or application upgrade. If the change is unexpected it should be investigated:

/usr/sbin/build-locale-archive: FAILED
/usr/sbin/glibc_post_upgrade.i686: FAILED
/usr/sbin/nscd: FAILED
/usr/sbin/tzdata-update: FAILED
/sbin/cciss_id: FAILED
/sbin/grubby: FAILED
/sbin/kpartx: FAILED
/sbin/ldconfig: FAILED
/sbin/mkinitrd: FAILED
/sbin/multipath: FAILED
/sbin/multipathd: FAILED
/sbin/multipath.static: FAILED
/sbin/nash: FAILED
/sbin/sln: FAILED

That email is from CSF/LFD I believe. If you're sure this was a cPanel Update you should restart CSF/LFD after receiving this sort of email.

 

[quietFinn]

That email is from CSF/LFD I believe. If you're sure this was a cPanel Update you should restart CSF/LFD after receiving this sort of email.

yes it's from LFD (the title of the email should be "lfd on <server's hostname here>: System Integrity checking detected a modified system file".

No need to restart CSF/LFD, that email is only sent once.

 

[cliper]

I get this mail notification everytime when cPanel do an update now.

 

[Infopro]

I get this mail notification everytime when cPanel do an update now.

As you should. The system updated and CSF is letting you know about it.

The following list of files have FAILED the md5sum comparison test. This means that the file has been changed in some way. This could be a result of an OS update or application upgrade. If the change is unexpected it should be investigated

 

[csine]

This is ridiculous... whm should notify lfd, whenever updates are made in OS. Otherwise, how does admin know if these errors are serious or not.

 

[8p-design]

This is ridiculous... whm should notify lfd, whenever updates are made in OS. Otherwise, how does admin know if these errors are serious or not.

Exactly. This is REALLY ridiculous. It's like a dog barking all the time for nothing. Gives thoughts to shoot it down!
The system should register the modified files when an update is done and allow LFD to ignore those.
This is worthless.

 

[cPRex]

It's important to note that cPanel does not develop or distribute the CSF/LFD software, so we don't create any integration with that on our end.

 

[8p-design]

It's important to note that cPanel does not develop or distribute the CSF/LFD software, so we don't create any integration with that on our end.

Sure. But there is no way for CSF/LFD to tell if cpanel did or did not change a file.
So if Cpanel would log which files were modified by its process, then a human or CSF/LFD or any other process could easily detect what is legit from what is not.

I would recommend Cpanel to LOG all modified files somewhere for others to learn about it.

 

[cPRex]

That sounds like it would make an excellent feature request!

 

[8p-design]

That sounds like it would make an excellent feature request!

please support it!

Publish/Log ALL changed files on update

When Cpanel updates, multiple files are changed. This triggers CSF/LFD for integrity checksum change etc. Currently we receive an email from CSF/LFD every

features.cpanel.net

 

[cPRex]

I just approved that on my end as well, so it should be visible soon.