Command Line (often faked in exploits):

why error :
Command Line (often faked in exploits):

/usr/sbin/mysqld --basedir=/usr --datadir=/var/lib/mysql --plugin-dir=/usr/lib64/mysql/plugin --user=mysql --log-error=/var/lib/mysql/xxxx.xxxx.err.com.err --pid-file=/var/lib/mysql/xxxx.xxxx.com.pid --wsrep_start_position=00000000-0000-0000-0000-000000000000:-1

regular_text: /dev/null
regular_text: /var/lib/mysql/xxxx.xxxx.err
regular_text: /var/lib/mysql/xxxx.xxxx.com.err
regular_text: /var/lib/mysql/ibdata1
regular_text: /tmp/ibOrSrco (deleted)
regular_text: /tmp/ibmSAwg0 (deleted)
regular_text: /tmp/ib2SrBkC (deleted)
regular_text: /tmp/ib2cdVtQ (deleted)
regular_text: /var/lib/mysql/ib_logfile0

and this notifications is where ?

The notification sent in my email report

you should check with your system admin if that is a valid mysql process and if it is then you can whitelist it in
/etc/csf/csf.pignore

I have to check the directory / usr / sbin / mysqld but not in /etc/csf/csf.pignore
if I could ask for a description of the details because I am still a newbie, please help thanks before

Hello.

He is meant you should the line /usr/sbin/mysqld in your /etc/csf.pignore .
Also can you write here full message?