How to disable LFD excessive resource usage alert?

Login Failure Daemon(LFD) is a daemon process which runs on VPS or Dedicated servers that uses Config Server Firewall(CSF) for server security. LFD scans the server logs and sends notifications every time when the process uses more memory or takes more time than the value assigned in your CSF configuration file. LFD considers recent failed login attempts as ‘Brute Force Attacks’ and blocks those IPs using CSF. CSF is a firewall configuration script commonly used in cPanel.

You can access the CSF configuration in WHM by using the following steps.

  • Login to your WHM
  • Go to Home >> select Plugins
  • Click ‘ConfigServer Security & Firewall’
  • Choose ‘Firewall Configuration’

LFD excessive resource usage alert

LFD service sends excessive resource usage alerts to the email address which is assigned to it, normally to root user account. This notification points out a particular process or service using excessive server resources. This helps in identifying the resource eating process/service. We can either kill/stop the process/service to free the resource or allocate more resource to it, if necessary.

Example email alert from LFD when memory is exceeded

Time: Mon Nov 14 19:41:10 2016 +0530
Account: xxxxxx
Resource: Virtual Memory Size
Exceeded: 205 > 200 (MB)
Executable: /usr/bin/php
Command Line: /usr/bin/php /home/xxxxxx/public_html/index.php
PID: 26953 (Parent PID:24974)
Killed: No

This alert is sent by LFD when a process uses more memory resources than defined in the CSF configuration file.

Example email alert from LFD when the time is exceeded

Time: Mon Nov 14 19:41:10 2016 +0530
Account: xxxxxx
Resource: Virtual Memory Size
Exceeded: 125389 > 1800 (seconds)
Executable: /usr/bin/php
Command Line: /usr/bin/php /home/xxxxxx/public_html/index.php
PID: 28429 (Parent PID:26561)
Killed: No

This alert is sent by LFD when a process takes more time to execute than defined in the CSF configuration file.

Disabling Alerts

Method 1: Permanently Disable

This method will permanently disable the LFD excessive resource usage alert. Performing this method will pose a security issue.

  • Login to your WHM
  • Open the CSF Firewall configuration
  • Modify the value of directives PT_USERMEM and PT_USERTIME to 0.

PT_USERMEM = 0
PT_USERTIME = 0

  • Save the settings.

Method 2:Increase the threshold

In this method, we will increase the values of both memory and time to disable the LFD alerts. This method is a temporary one. If any process/service uses more resources than defined, you will continue to receive the LFD alerts.

  • Login to your WHM
  • Open the CSF Firewall configuration
  • Modify the value of directives PT_USERMEM and PT_USERTIME to desired.

PT_USERMEM = 500
PT_USERTIME = 150000

  • Save the settings

Method 3: The pignore of CSF

This method is a standard technique to disable the LFD alerts. In this method, we will include the particular process/service in pignore of CSF. The pignore of CSF will ignore the particular process/service included in it and hence disables the LFD alerts.

  • Login to your server as root user.
  • Using your favorite editor open pignore of CSF. The common location of pignore is /etc/csf/csf.pignore.
  • Add the command line path specified in the alert to the pignore of CSF.
  • Save changes.

By the time, you complete performing these methods the LFD excessive resource usage alert will be disabled.

If you need any further assistance please contact our support department.

  • 0 A felhasználók hasznosnak találták ezt
Hasznosnak találta ezt a választ?

Kapcsolódó cikkek

How addon domain parked outside public_html dir

There's an option to disable this here:WebHost Manager »Server Configuration »Tweak Settings,...

Fix cPanel Error “IP Address Has Changed!”

This document will cover how to disable the security for Cookie + IP Authentication.  Step 1:...

How to Install Imagick on cPanel Server

Install ImageMagick on the server. SSH into your server Install it by typing: yum install...

How to Exclude Files from Backups?

Overview To exclude files or directories from your user backups, perform either of the following...

Fix Automatic Disconnects from WHM & cPanel

The fix is simply changing an option in the settings of WHM. To do this, log into WHM and find...