2

My host mailbox is filled up with 1 GB of lfd notifications like:

  • excessive resource usage notifications
  • Suspicious process running under user XXXX

How can I disable these?

There was no lfd tag and I cannot create one...

PS: I am using Webmin, can I do it from there?

Janne Pikkarainen
  • 31,454
  • 4
  • 56
  • 78
giorgio79
  • 1,747
  • 9
  • 25
  • 36
  • The posted answers say to look for `LF_` directives. However, if you do so, you may end up *turning off* certain protection features of lfd. You don't want to turn off these features, you just want to disable the notifications. So, I'd recommend searching the configuration (either the file or via the web interface) for settings that use the string `_ALERT` instead. – rinogo Oct 31 '17 at 14:00
  • (And if you want to be super strict about it, you'd search for terms that have both `LF` and `_ALERT`. (e.g. naive regex: `LF.*_ALERT.*`) – rinogo Oct 31 '17 at 14:04

3 Answers3

3

Edit /etc/csf/csf.conf and look for LF_ directives. Restart csf (csf -r) once you are done.

devicenull
  • 5,572
  • 1
  • 25
  • 31
3

Edit /etc/csf/csf.conf and find PT_USERMEM and PT_USERTIME and set value 0 for both.

Like this:

PT_USERMEM = "0"

PT_USERTIME = "0"

After save restart CSF by csf -r

also dont forget to restart lfd using # service lfd restart

Shiv Singh
  • 161
  • 9
2

It can be handy to use CSF/LFD UI interface available for Webmin. From it you can manage CSF/LFD settings.

http://www.configserver.com/free/csf/install.txt:

Webmin Module Installation/Upgrade

To install or upgrade the csf webmin module:

Install csf as above Install the csf webmin module in: Webmin > Webmin Configuration > Webmin Modules > From local file > /etc/csf/csfwebmin.tgz > Install Module

lik
  • 166
  • 2
  • Thanks, I have it but there is no way to edit the conf directly it seems from there. – giorgio79 May 15 '12 at 11:54
  • 1
    Have you missed `Firewall Configuration` button which provides feature to edit configuration file for the csf firewall and lfd? – lik May 25 '12 at 06:37