From configserver.com
Process Tracking
This option enables tracking of user and nobody processes and examines them for suspicious executables or open network ports. Its purpose is to identify potential exploit processes that are running on the server, even if they are obfuscated to appear as system services. If a suspicious process is found an alert email is sent with relevant information. It is then the responsibility of the recipient to investigate the process further as the script takes no further action. Processes (PIDs) are only reported once unless lfd is restarted.
There is an ignore file /etc/csf/csf.pignore which can be used to whitelist either usernames or full paths to binaries. Care should be taken with ignoring users or files so that you don’t force false-negatives.
You must use the following format:
The command line as reported in /proc has the trailing null character removed and all other occurrences replaced with a space. So, the line you specify in the file should have space separators for the command line arguments, not null characters. It is strongly recommended that you use command line ignores very carefully as any process can change what is reported to the OS. Don’t list the paths to perl or php as this will prevent detection of suspicious web scripts.
Process Tracking and csf.pignore
1. If you’re seeing spamd being reported after the latest update and want to ignore it, the following can be added to /etc/csf/csf.pignore (ensure that you ONLY use linux linefeeds, not WIN or MAC ones when editing Linux files):
cmd:spamd child
Then restart lfd.
2. If you’re seeing awstats.pl being reported after the latest update and want to ignore it, the following can be added to /etc/csf/csf.pignore:
pcmd:.*/usr/local/cpanel/3rdparty/bin/awstats\.pl.*
pcmd:.*/usr/local/cpanel/base/awstats\.pl.*
Then restart lfd.
3. If you’re seeing (deleted) processes being reported then you need to read the information provided in csf.conf for the PT_DELETED option. Currently this reads:
# lfd will report processes, even if they're listed in csf.pignore, if they're
# tagged as (deleted) by Linux. This information is provided in Linux under
# /proc/PID/exe. A (deleted) process is one that is running a binary that has
# the inode for the file removed from the file system directory. This usually
# happens when the binary has been replaced due to an upgrade for it by the OS
# vendor or another third party (e.g. cPanel). You need to investigate whether
# this is indeed the case to be sure that the original binary has not been
# replaced by a rootkit or is running an exploit.
#
# To stop lfd reporting such process you need to restart the daemon to which it
# belongs and therefore run the process using the replacement binary (presuming
# one exists). This will normally mean running the associated startup script in
# /etc/init.d/
#
# If you don't want lfd to report deleted binary processes, set to 0
PT_DELETED = "1"
If, for example, you still want to ignore pure-ftpd deleted executable reports, the following can be added to csf.pignore:
pexe:/usr/sbin/pure-ftpd.*
or, if you want to ignore deleted executable processes, set the following in csf.conf:
PT_DELETED = "0"
if you want to stop lfd notification about excessive resource usage and suspicious scripts, the following can be added to csf.pignore:
user:wmpanel
In any case, restart lfd after making any changes.
Please Note: Deleted executable file names will become more corrupted the longer they are left running, so even the pure-ftpd part of the name may no longer match over time. This is a symptom of the Linux file system and the way Linux handles processes that are running executables that no longer exist at the inode they originally ran from, this is simply what lfd is reporting.
Also please note that investigating Process Tracking reports is the responsibility of the server administrator and going into the detail of such work is beyond the scope of this forum. lfd simply reports the information it finds for a process within the /proc/PID/ file system.
