1. Excessive resource usage alert
From: root
To: root
Subject: lfd on [hostname]: Excessive resource usage: [user] ([pid])
Time: [time]
Account: [user]
Resource: [resource]
Exceeded: [level]
Executable: [exe]
Command Line: [cmd]
PID: [pid]
Killed: [kill]
Time: Mon Nov 14 09:41:10 2016 +0530
Account: xxxxxx
Resource: Virtual Memory Size
Exceeded: 205 > 200 (MB)
Executable: /usr/bin/php
Command Line: /usr/bin/php /home/xxxxxx/public_html/index.php
PID: 26953 (Parent PID:24974)
Killed: No
Time: Mon Nov 14 09:41:10 2016 +0530
Account: xxxxxx
Resource: Virtual Memory Size
Exceeded: 125389 > 1800 (seconds)
Executable: /usr/bin/php
Command Line: /usr/bin/php /home/xxxxxx/public_html/index.php
PID: 28429 (Parent PID:26561)
Killed: No
exe:/full/path/to/file
user:username
cmd:command line
csf -r or service lfd restart
From: root
To: root
Subject: lfd on [hostname]: System Integrity checking detected a modified system file
Time: [time]
The following list of files have FAILED the md5sum comparison test. This means that the file has been changed in some way. This could be a result of an OS update or application upgrade. If the change is unexpected it should be investigated.
[text]
From: root
To: root
Subject: lfd on [hostname]: Suspicious process running under user [user]
Time: [time]
PID: [pid]
Account: [user]
Uptime: [uptime] seconds
Executable:
[exe]
Command Line (often faked in exploits):
[cmdline]
Network connections by the process (if any):
[sockets]
Files open by the process (if any):
[files]
Memory maps from the process (if any):
[maps]
csf -r or service lfd restart
Login Failures:
From: root
To: root
Subject: lfd on [hostname]: blocked [ip]
Time: [time]
IP: [ip]
Failures: [ipcount]
Interval: [iptick] seconds
Blocked: [block]
Log entries:
[text]
From: root
To: root
Subject: lfd on [hostname]: [ip] blocked permanently
Time: [time]
IP: [ip]
Temporary Blocks: [count]
Temporary blocks that triggered the permanent block:
[blocks]
From: root
To: root
Subject: lfd on [hostname]: Email queue size alert
Time: [time]
[text]
From: root
To: root
Subject: lfd on [hostname]: Script Alert for [path]
Time: [time]
Path: [path]
Count: [count] emails sent
Sample of the first 10 emails:
[emails]
Possible Scripts:
[scripts]
From: root To: root Subject: lfd on [hostname]: Excessive processes running under user [user] Time: [time] Account: [user] Process Count: [number] Process Information: User: [user] PID: [pid] PPID: [ppid] Run Time: [secs] Memory: [kb] RSS: [kb] Executable [exe] Command Line: [cmd]If the traffic you have on the websites is legitimate, the notifications may be false-positive.
Need help? We're always here for you.