3.03 generates a lot emails please revert back

quarghost · Post by **quarghost** » 20 Jan 2008, 12:29

NTG wrote:Please revert back! As i get every hour a lot emails!

I've had a marked difference in inbound mail too. Went from maybe 4 a day to well over 100. This isn't a problem generally. The problem is that I've added the user and executable associated with the e-mail reports to the ignore lists and yet the e-mails are still flooding in.

quarghost · Post by **quarghost** » 20 Jan 2008, 21:38

The problem is that I've added the user and executable associated with the e-mail reports to the ignore lists and yet the e-mails are still flooding in.

So this is probably on me. I had been restarting the CSF service. I just realized that CSF probably just refers to the firewall. I restarted LFD for the first time. I'm willing to bet this will solve my problem. Doesn't explain the marked increase e-mail, but does answer why mine wouldn't stop. Sorry for the spam...

...of course, if they keep coming in I'll write here again.

Post by **chirpy** » 21 Jan 2008, 17:28

Erm, there's no issue here. If you're getting repeated emails then you're not dealing with the original problem, i.e. the detected processes. You need to either whitelist them in csf.pignore if you're not interested in them or disable the process tracking options.

mitgib · Post by **mitgib** » 21 Jan 2008, 18:09

chirpy wrote:Erm, there's no issue here. If you're getting repeated emails then you're not dealing with the original problem, i.e. the detected processes. You need to either whitelist them in csf.pignore if you're not interested in them or disable the process tracking options.

I hope it is just me overlooking something, but I have 3 processes I've whitelisted on a generic CentOS 5.1 server that continued to send emails, so I whitelisted the user as well, and they still continue, and yes, I did restart lfd.

Time: Mon Jan 21 12:57:35 2008
Account: 68
Resource: Process Time
Exceeded: 53038 > 1800 (seconds)
Executable: /usr/sbin/hald
Command Line: hald
PID: 2281
Killed: No

and 2 others run by haldaemon, so I added the following to csf.pignore

user:haldaemon
exe:/usr/sbin/hald
exe:/usr/libexec/hald-addon-acpi
exe:/usr/libexec/hald-addon-keyboard

But still get emails about the 3 procs. What might I be overlooking?

ckh · Post by **ckh** » 24 Jan 2008, 22:43

NTG wrote:Pitty. Bad support here too.

showthread.php?t=1

arteryplanet · Post by **arteryplanet** » 06 Feb 2008, 20:13

Hi Chirpy,

We are having the same problem after the upgrade (not sure from whcih cersion).
Before we were receiving one email about those alerts and was after csf restart, now we are receiving the same email alert for the same process, user, etc. many times.

Any idea?

Thanx in advance!

Post by **Sarah** » 09 Feb 2008, 11:27

Are these alerts still coming for the exact same processes or users that you have whitelisted in csf.pignore?

arteryplanet · Post by **arteryplanet** » 09 Feb 2008, 14:48

Hi Sarah,

No, i havent whitelisted them....but on previous versions these alerts were sent once and only were sent again if you restart csf. But looks like in the new version the same alert for the same process/user is sent every X minutes.

Thank you!