System Integrity checking detected a modified system file

s37n

Active Member
May 22, 2011
36
0
56
I got the following message today, and not sure if I should be concerned or not. Any assistance would be greatly appreciated.

Thanks,

[HR][/HR]
The following list of files have FAILED the md5sum comparison test. This means that the file has been changed in some way. This could be a result of an OS update or application upgrade. If the change is unexpected it should be investigated:

/usr/sbin/build-locale-archive: FAILED
/usr/sbin/glibc_post_upgrade.i686: FAILED
/usr/sbin/nscd: FAILED
/usr/sbin/tzdata-update: FAILED
/sbin/cciss_id: FAILED
/sbin/grubby: FAILED
/sbin/kpartx: FAILED
/sbin/ldconfig: FAILED
/sbin/mkinitrd: FAILED
/sbin/multipath: FAILED
/sbin/multipathd: FAILED
/sbin/multipath.static: FAILED
/sbin/nash: FAILED
/sbin/sln: FAILED
 

s37n

Active Member
May 22, 2011
36
0
56
ok, I think this might be from the cpanel update cron job. I got an email about it running shortly before the System integrity email arrived.

/usr/local/cpanel/scripts/upcp --cron
 

Infopro

Well-Known Member
May 20, 2003
17,090
519
613
Pennsylvania
cPanel Access Level
Root Administrator
Twitter
I got the following message today, and not sure if I should be concerned or not. Any assistance would be greatly appreciated.

Thanks,

[HR][/HR]
The following list of files have FAILED the md5sum comparison test. This means that the file has been changed in some way. This could be a result of an OS update or application upgrade. If the change is unexpected it should be investigated:

/usr/sbin/build-locale-archive: FAILED
/usr/sbin/glibc_post_upgrade.i686: FAILED
/usr/sbin/nscd: FAILED
/usr/sbin/tzdata-update: FAILED
/sbin/cciss_id: FAILED
/sbin/grubby: FAILED
/sbin/kpartx: FAILED
/sbin/ldconfig: FAILED
/sbin/mkinitrd: FAILED
/sbin/multipath: FAILED
/sbin/multipathd: FAILED
/sbin/multipath.static: FAILED
/sbin/nash: FAILED
/sbin/sln: FAILED

That email is from CSF/LFD I believe. If you're sure this was a cPanel Update you should restart CSF/LFD after receiving this sort of email.
 

quietFinn

Well-Known Member
Feb 4, 2006
1,394
179
193
Finland
cPanel Access Level
Root Administrator
That email is from CSF/LFD I believe. If you're sure this was a cPanel Update you should restart CSF/LFD after receiving this sort of email.
yes it's from LFD (the title of the email should be "lfd on <server's hostname here>: System Integrity checking detected a modified system file".

No need to restart CSF/LFD, that email is only sent once.
 

Infopro

Well-Known Member
May 20, 2003
17,090
519
613
Pennsylvania
cPanel Access Level
Root Administrator
Twitter
I get this mail notification everytime when cPanel do an update now.
As you should. The system updated and CSF is letting you know about it.
The following list of files have FAILED the md5sum comparison test. This means that the file has been changed in some way. This could be a result of an OS update or application upgrade. If the change is unexpected it should be investigated
 

8p-design

Well-Known Member
Mar 25, 2006
48
1
158
This is ridiculous... whm should notify lfd, whenever updates are made in OS. Otherwise, how does admin know if these errors are serious or not.
Exactly. This is REALLY ridiculous. It's like a dog barking all the time for nothing. Gives thoughts to shoot it down!
The system should register the modified files when an update is done and allow LFD to ignore those.
This is worthless.
 

8p-design

Well-Known Member
Mar 25, 2006
48
1
158
It's important to note that cPanel does not develop or distribute the CSF/LFD software, so we don't create any integration with that on our end.
Sure. But there is no way for CSF/LFD to tell if cpanel did or did not change a file.
So if Cpanel would log which files were modified by its process, then a human or CSF/LFD or any other process could easily detect what is legit from what is not.

I would recommend Cpanel to LOG all modified files somewhere for others to learn about it.