Control Web Panel

Security => CSF Firewall => Topic started by: meek2100 on February 12, 2020, 03:45:02 AM

Title: lfd on hostname: Excessive resource usage: redis after adding to whitelist.
Post by: meek2100 on February 12, 2020, 03:45:02 AM

I'm still getting these emails even after following the instructions on http://wiki.centos-webpanel.com/csflfd-firewall-configuration and added "exe:/usr/bin/redis-server" and "exe:/usr/bin/memcached" to the bottom of the /etc/csf/csf.pignore.

What else can I do? Getting 2 emails every hour is getting really annoying.

Time:         Wed Feb 12 03:00:29 2020 +0000
Account:      memcached
Resource:     Process Time
Exceeded:     12863 > 1800 (seconds)
Executable:   /usr/bin/memcached
Command Line: /usr/bin/memcached -u memcached -p 56861 -m 64 -c 1024
PID:          1625 (Parent PID:1625)
Killed:       No

Time:         Wed Feb 12 03:00:29 2020 +0000
Account:      redis
Resource:     Process Time
Exceeded:     12863 > 1800 (seconds)
Executable:   /usr/bin/redis-server
Command Line: /usr/bin/redis-server 127.0.0.1:6379                     
PID:          1637 (Parent PID:1637)
Killed:       No

Title: Re: lfd on hostname: Excessive resource usage: redis after adding to whitelist.
Post by: rcschaff on February 12, 2020, 05:47:12 AM

did you restart csf after adding them to pignore?

Title: Re: lfd on hostname: Excessive resource usage: redis after adding to whitelist.
Post by: ejsolutions on February 12, 2020, 10:08:29 AM

Try

Code: [Select]

user: memcached
exe: /usr/bin/memcached
cmd: /usr/bin/memcached -u memcached -p 56861 -m 64 -c 1024

user: redis
exe: /usr/bin/redis-server
cmd: /usr/bin/redis-server 127.0.0.1:6379                     


Title: Re: lfd on hostname: Excessive resource usage: redis after adding to whitelist.
Post by: meek2100 on February 12, 2020, 06:00:54 PM

@rcschaff
Yes, I did restart csf after making the changes and I did stop getting email for rpcbind, so it does seem like it worked for that just not redis or memcached.

Here is what I currently added in /etc/csf/csf.pignore.
exe:/usr/sbin/rpcbind
exe:/usr/sbin/redis-server
exe:/usr/sbin/memcached


@ejsolutions
Thanks for that suggestion.  I'll try this now, fingers crossed.

Title: Re: lfd on hostname: Excessive resource usage: redis after adding to whitelist.
Post by: meek2100 on February 13, 2020, 05:33:21 PM

@ejsolutions
Your suggestion worked great! No more emails.

Title: Re: lfd on hostname: Excessive resource usage: redis after adding to whitelist.
Post by: ejsolutions on February 13, 2020, 06:17:17 PM

Good to know. ;)
Can be hit/miss.