Suspicious File Alert mail every night

[thomash]

Hello.

Can someone tell me why I get those mails every night?

What can I do to prevent this, and is it something that I need to worry about?

Time:   Thu Oct  8 00:05:09 2015 +0000
File:   /tmp/apache-build/apr-1.5.1/configure
Reason: Script, starts with #!
Owner:  : (1000:1000)
Action: No action taken

Time:   Thu Oct  8 00:05:09 2015 +0000
File:   /tmp/apache-build/apr-1.5.1/buildconf
Reason: Script, starts with #!
Owner:  : (1000:1000)
Action: No action taken

Time:   Thu Oct  8 00:05:09 2015 +0000
File:   /tmp/apache-build/apr-1.5.1/apr-config.in
Reason: Script, starts with #!
Owner:  : (1000:1000)
Action: No action taken

Time:   Thu Oct  8 00:05:08 2015 +0000
File:   /tmp/apache-build/suphp-0.7.1/config/ltmain.sh
Reason: Script, file extension
Owner:  : (1000:1000)
Action: No action taken

Time:   Thu Oct  8 00:05:08 2015 +0000
File:   /tmp/apache-build/suphp-0.7.1/config/install-sh
Reason: Script, starts with #!
Owner:  : (1000:1000)
Action: No action taken

Time:   Thu Oct  8 00:05:08 2015 +0000
File:   /tmp/apache-build/suphp-0.7.1/configure
Reason: Script, starts with #!
Owner:  : (1000:1000)
Action: No action taken

Time:   Thu Oct  8 00:05:08 2015 +0000
File:   /tmp/apache-build/suphp-0.7.1/config/config.sub
Reason: Script, starts with #!
Owner:  : (1000:1000)
Action: No action taken

Time:   Thu Oct  8 00:05:08 2015 +0000
File:   /tmp/apache-build/suphp-0.7.1/config/config.guess
Reason: Script, starts with #!
Owner:  : (1000:1000)
Action: No action taken

Time:   Thu Oct  8 00:05:08 2015 +0000
File:   /tmp/apache-build/suphp-0.7.1/config/depcomp
Reason: Script, starts with #!
Owner:  : (1000:1000)
Action: No action taken

Time:   Thu Oct  8 00:05:08 2015 +0000
File:   /tmp/apache-build/suphp-0.7.1/config/missing
Reason: Script, starts with #!
Owner:  : (1000:1000)
Action: No action taken

Regards
Thomas.

[Glenn]

Did you re compile Apache ?

[thomash]

No. The crew here at CWP installed and compiled CentOS, and I have not recompiled it afterwords..

/Thomas.

[Administrator]

you can simply delete this files, but you should be careful with this command as you could end-up with your server deleted.

Code Select Expand

rm -Rf /tmp/apache-build/

[misterpat]

Will this work for php-build also in the tmp directory?

File:   /tmp/php-build/php-5.4.45/*

[Administrator]

yes

[crmgddn63]

File:   /tmp/apache-build/httpd-2.2.27/server/core.o
Reason: Linux Binary
Owner:  root:root (0:0)
Action: No action taken

i give this message every hour. how can i fix this ?

[Neo2SHYAlien]

Append at the end of /etc/csf/csf.fignore those 2 rows

Code Select Expand

/tmp/apache-build/.*
/tmp/php-build/.*
After that restart lfd and everything will be ok I prefer this approach will be better if is added as CWP CUSTOM rules as as the rows in /etc/csf/csf.pignore

[crmgddn63]

thank you for your support dude.

[johnhelmer]

Append at the end of /etc/csf/csf.fignore those 2 rows

Code Select Expand

/tmp/apache-build/.*
/tmp/php-build/.*
After that restart lfd and everything will be ok I prefer this approach will be better if is added as CWP CUSTOM rules as as the rows in /etc/csf/csf.pignore

Can you just add these two lines as is to pignore or does it require a different format?

[Neo2SHYAlien]

Can you just add these two lines as is to pignore or does it require a different format?

You should add them to /etc/csf/csf.fignore not ot pignoner file. pigone is for process ignoring respectively fignore for file ignoring rules