After a recent cPanel update, I'm not getting as many LOCALRELAY events in my lfd logs.. None of the thresholds have changed and I know of a few times the system should have tripped that alert. So, has anyone else experienced this?
Box : CentOS 6.8
cPanel 60.0.* and LOCALRELAY alerts
Re: cPanel 60.0.* and LOCALRELAY alerts
Same thing on our cpanel servers, running centos 6.8.
The scripts being reported in my situation do not use localrelay, Many of them don't even send mail at all, but they all do use imap functions to check mailboxes and all are run silently using cron.
Are the ones you're seeing run from cron or are they cron output emails? I'm having a hard time determining if the ones being reported in the localrelay alert are the actual scripts or the cron process itself.
The scripts being reported in my situation do not use localrelay, Many of them don't even send mail at all, but they all do use imap functions to check mailboxes and all are run silently using cron.
Are the ones you're seeing run from cron or are they cron output emails? I'm having a hard time determining if the ones being reported in the localrelay alert are the actual scripts or the cron process itself.
Re: cPanel 60.0.* and LOCALRELAY alerts
So we put in a ticket and in our case the localrelay alerts were related to cron script. Specifically the cron scrips weren't sending emails but weren't fully suppressing output either.
Basically had:
/path/to/script > /dev/null &
Apparently in pre-CentOS 7 these are causing CSF LOCALRELAY alerts.
Changed all cron scripts to:
/path/to/script > /dev/null 2>&1
And we're not getting any more localrelay alerts.
I honestly do not know why CentOS 6 is different on this issue than CentOS 7. Our csf installation and server setup is essentially identical on all our servers, but the CentOS 6 ones behave differently in this case. If yours are unrelated to cron, I'm not sure if this will be any help, but see what is supposedly sending the emails. In our case no actual emails were being sent by cron on either server. Not sure if this is a bug or not but it happened after a cpanel or CSF update and never in years before that, so it's definitely something introduced by an update.
Basically had:
/path/to/script > /dev/null &
Apparently in pre-CentOS 7 these are causing CSF LOCALRELAY alerts.
Changed all cron scripts to:
/path/to/script > /dev/null 2>&1
And we're not getting any more localrelay alerts.
I honestly do not know why CentOS 6 is different on this issue than CentOS 7. Our csf installation and server setup is essentially identical on all our servers, but the CentOS 6 ones behave differently in this case. If yours are unrelated to cron, I'm not sure if this will be any help, but see what is supposedly sending the emails. In our case no actual emails were being sent by cron on either server. Not sure if this is a bug or not but it happened after a cpanel or CSF update and never in years before that, so it's definitely something introduced by an update.