Preventing CSF from killing a certain process

[KyleT]

Hi there,

We are trying to SCP a large file from one of our servers, however CSF appears to be killing the SCP process after around 55 minutes.

In /var/log/lfd.log we see the following messages:
------------------------------------------------------------------------------------------------------------------------------------------------------------------

Code: Select all

/var/log/lfd.log-20141214:Dec 12 12:20:20 hostname lfd[653099]: *User Processing* PID:517054 Kill:0 User:<username> Time:1843 EXE:/usr/local/cpanel/3rdparty/perl/514/bin/perl CMD:sshcontrol child: <ip address> - waiting on pid 517051
/var/log/lfd.log-20141214:Dec 12 12:21:19 hostname lfd[664824]: *Suspicious Process* PID:652751 PPID:652750 User:<username> Uptime:95 secs EXE:/usr/bin/ssh CMD:ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o ServerAliveInterval=10 -x2MN -o NumberOfPasswordPrompts=1 -o PreferredAuthentications=keyboard-interactive,password -S /home/<username>/.libnet-openssh-perl/atabackups-<ip address>-652750-484994 -l atabackups -p 22 <ip address> --

------------------------------------------------------------------------------------------------------------------------------------------------------------------

In /etc/csf/csf.pignore we already have all SSH binaries listed:

exe:/usr/sbin/sshd
exe:/usr/sbin/ssh
exe:/usr/bin/ssh

And we have restarted CSF, but the process is still killed after the same amount of time.

Does anyone know how we can ensure that the SCP process is *not* killed by CSF?

[ForumAdmin]

csf is not killing that process:

/var/log/lfd.log-20141214:Dec 12 12:20:20 hostname lfd[653099]: *User Processing* PID:517054 Kill:0 User:<username> Time:1843 EXE:/usr/local/cpanel/3rdparty/perl/514/bin/perl CMD:sshcontrol child: <ip address> - waiting on pid 517051

You'll need to look elsewhere as to why the process is terminating.

[KyleT]

Thanks but are you sure it's not CSF (or LFD)?

Based on this log entry, and the fact it says "suspicious process", it seems like it's definitely being killed:

Dec 12 12:21:19 hostname lfd[664824]: *Suspicious Process* PID:652751 PPID:652750 User:ataorgau Uptime:95 secs EXE:/usr/bin/ssh CMD:ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o ServerAliveInterval=10 -x2MN -o NumberOfPasswordPrompts=1 -o PreferredAuthentications=keyboard-interactive,password -S /home/ataorgau/.libnet-openssh-perl/atabackups-0.0.0-652750-484994 -l atabackups -p 22 <IP address> --

Would you happen to have any suggestions on where to look for what is killing this process?

[jcats]

You can see in the log you originally posted:

"Kill:0" meaning it was not killed by LFD

You can always completely disable CSF to ensure its not killing it until the transfer completes.

# csf -x

Did you check /var/log/messages as there may be an indication in here as to what is happening to the process