My Ignore File is not taking effect.

[ashiftoday]

I copied the example ignore file and renamed it cxs.ignore
and have added a rule in the file :

hdir:/public_html/wp-content/wflogs

but still in email i am getting this warning :

Aug 26 10:03:51 home cxswatch[45543]: WARNING: '/home/******/public_html/wp-content/wflogs/config.php' scanned 6 times in the last 30 seconds, you might want to ignore this resource
Aug 26 10:03:51 home cxswatch[45543]: Ignoring resource for the next 300 seconds: '/home/********/public_html/wp-content/wflogs/config.php'
Aug 26 10:03:51 home cxswatch[45543]: WARNING: '/home/*******/public_html/wp-content/wflogs/ips.php' scanned 6 times in the last 30 seconds, you might want to ignore this resource
Aug 26 10:03:51 home cxswatch[45543]: Ignoring resource for the next 300 seconds: '/home/********/public_html/wp-content/wflogs/ips.php'
Aug 26 10:03:51 home cxswatch[45543]: WARNING: '/home/***********/public_html/wp-content/wflogs/attack-data.php' scanned 6 times in the last 30 seconds, you might want to ignore this resource
Aug 26 10:03:51 home cxswatch[45543]: Ignoring resource for the next 300 seconds: '/home/*********/public_html/wp-content/wflogs/attack-data.php'
Aug 26 10:04:00 home cxswatch[45543]: WARNING: '/home/**********/public_html/error_log' scanned 6 times in the last 30 seconds, you might want to ignore this resource

i dont know why its not ignoring the directory, ive stopped and started the cxs service a couple times as well.

i've searched alot but unable to find the fix.

[Sarah]

Did you add

Code: Select all

--ignore /etc/cxs/cxs.ignore 

to your cxs command in /etc/cxs/cxswatch.sh and then restart cxswatch?

Regards,
Sarah

[ashiftoday]

that what i was thinking, i had to :

1. disable the restricted mode
2. Go to other files page in whm->cxs->other files
3. Modify the cxswatch file
4. added : --ignore /etc/cxs/cxs.ignore
5. then restarted cxs
6. (just restarted, so awaiting if this works )

[ashiftoday]

also : pls advise, i removed the MDSUM from ignore file.
was it required ?

[Sarah]

No, it is not required. It is an example.

[ashiftoday]

thanks
its fixed.