2

ConfigServer Firewall in cPanel (CSF) sends me a hundred emails a day saying that I have "excessive resource usage" for a file which I am aware of but it is OK to have high usage for that user.

This is intolerable.

Here is one such example:

[SUBJECT]

lfd on server1.evx.ca: Excessive resource usage: myuser (21046 (Parent PID:21014))

[EMAIL]

Time:         Wed Nov  2 14:23:36 2016 -0700
Account:      myuser
Resource:     Process Time
Exceeded:     1819 > 1800 (seconds)
Executable:   /usr/bin/php
Command Line: /usr/bin/php /mnt/home2/myuser/public_html/mywebsite.com/index.php
PID:          21046 (Parent PID:21014)
Killed:       No

I had already added it to the whitelist months ago, but still I continue getting the emails every day adding up to hundreds of thousands of emails. I am sick of it.

Here is what I have in my whitelist currently:

file: /etc/csf/csf.pignore

exe:/mnt/home2/myuser/public_html/mywebsite.com/index.php

Of course, I have restarted CSF numerous times in the past few months.

Why isn't this working, and how can I get it working?

  • Have you tried whitelisting the entire user? – cascer1 Dec 13 '16 at 13:07
  • That is a TERRIBLE suggestion! Basically you are telling me to turn off the firewall? No way! – user7783780 Jan 16 '17 at 15:19
  • No, since you already whitelisted the file but that didn't work, I suggested you could try whitelisting the user to check if the notifications are still sent. Obviously you don't want to disable the excessive usage notifications or CSF entirely. – cascer1 Jan 16 '17 at 15:21
  • No way! I am not turning off my server firewall (not for one or any user)! – user7783780 Jan 16 '17 at 15:23
  • I don't suggest you should disable it permanently, just for a short time (maybe an hour?) just to see if csf even respects your ignore rules or not. – cascer1 Jan 16 '17 at 15:26
5

Adding exe:/mnt/home2/myuser/public_html/mywebsite.com/index.php to the process ignore list won't help because the exe: command only ignores executables.

As you can see in the notification email:

Executable:   /usr/bin/php
Command Line: /usr/bin/php /mnt/home2/myuser/public_html/mywebsite.com/index.php

The executable is /usr/bin/php, which you should not whitelist because it would ignore all of PHP.

Instead, try adding the following line:

cmd:/usr/bin/php /mnt/home2/myuser/public_html/mywebsite.com/index.php

This should properly ignore all php processes executing that specific file.

Another thing you could try is

pcmd:*/mnt/home2/myuser/public_html/mywebsite.com/index.php

This will ignore all commands ending in the path of the file, which includes php processes.

  • I see! I will try this when I get a chance. This may be the answer! Thanks for your answer :) If it works, I will accept. – user7783780 Jan 16 '17 at 15:28
  • Just want to update and let you know I have implemented this just now. I will ket you know if it works. If so then I will accept the solution. – user7783780 Jan 18 '17 at 13:26
  • 1
    Appears to have worked, no more notifications so far today from the whitelisted lines. – user7783780 Jan 18 '17 at 20:41
-1

try to put "exe:/usr/bin/php" without quotes in file: /etc/csf/csf.pignore

  • 3
    Wouldn’t this whitelist all PHP?   Are you saying that it’s impossible to whitelist a single PHP file; you have to whitelist the entire website?   And do you know that this will work, or are you just guessing?  Please do not respond in comments; edit your answer to make it clearer and more complete. – Scott Nov 4 '16 at 3:16
  • @Scott Yes it would whitelist all PHP which is very terrible advice, thanks for pointing that out. – user7783780 Jan 18 '17 at 13:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.