LFD csf.fignore working in CentOS 6, not in CentOS 7

[bl333]

Hi,

I have two servers:
1) CentOS 6, CLOUDLINUX 6.7, x86_64, xenhvm, WHM 56.0 (build 18), CSF v8.25
2) CentOS 7, CLOUDLINUX 7.2, x86_64 kvm, WHM 56.0 (build 18), CSF v8.25

In both servers I have a added a regex in "/etc/csf/csf.fignore" for emails from JetBackupManager. They provide the regex themselves:

http://wiki.jetbackupmanager.com/lfd-alert-virtualenv
regex:
/tmp/tmp[a-zA-Z0-9]+/virtualenv\-[\d\.]+/.*

The problem is that in CentOS 6, this works just fine, but in CentOS 7, it doesn't. As a result, we get dozens of emails each day, with content like this:

Time: Tue May 24 19:10:36 2016 +0300
File: /tmp/tmpZ3MRCu/virtualenv-13.0.3/virtualenv_embedded/activate.sh
Reason: Script, file extension
Owner: :games (501:20)
Action: No action taken

Looks like for some reason, CSF is not reading(?) the fignore file? Any ideas?

[ForumAdmin]

Just tested this on CentOS v6/7 and as expected the regex worked fine on both. This would suggest that you have something typed incorrectly in your /etc/csf/csf.fignore on the server where it is not working as we have tested it successfully.

[bl333]

The actual regex, is this:

/tmp/tmp[^/]{5,10}/virtualenv\-[\d\.]+/.* # JetBackupManager aws ignore
/tmp/tmp[a-zA-Z0-9]+/virtualenv\-[\d\.]+/.* # JetBackupManager aws ignore http://wiki.jetbackupmanager.com/lfd-alert-virtualenv

In CentOS 6 the comment at the end of each line, is disregarded (as it should).
In CentOS 7 the rule does not work with the comment. As soon as you remove the comment from the end of each line, then it works.

I don't know if it's a CSF or CentOS issue

[ForumAdmin]

It's neither, it is whatever you actually have in your csf.fignore file. As I said, I tested the regex on CentOS 6 and 7 and as expected it worked on both as the OS it runs on is not relevant to the use of the file.

You cannot use the regexes as you posted in your last update as you cannot have trailing spaces and comments on the regex line in csf.fignore.

[bl333]

You cannot use the regexes as you posted in your last update as you cannot have trailing spaces and comments on the regex line in csf.fignore.

Looks like we have a winner. We were so used of commenting inline in e.g. IP whitelist in CSF, we never thought it would be a problem in csf.fignore. Maybe you would consider adding a note in all LFD files, warning users for spaces and inline comments?