Getting Script Name on Notification / Log

[consultant]

When a process exceeds the maximum execution time, the notification doesn't tell me what script was running. Anyway to get LFD to include the information? If not, any suggestions (other than modifying all my scripts) to log the execution time of all PHP scripts being executed on the server and include the script pathname?

[BallyBasic79]

Exactly which alert are you referring to? Will you post an example with subject line and content? (Feel free to censor sensitive info.)

It's been 2013 that I last received a script alert, but it had the same format as the current scriptalert.txt, including possible scripts:

Code: Select all

From: root
To: root
Subject: lfd on [hostname]: Script Alert for [path]

Time:  [time]
Path:  [path]
Count: [count] emails sent

Sample of the first 10 emails:

[emails]

Possible Scripts:

[scripts]

csf.conf describes how this feature works, including the option to run a custom script with the offending passed as parameters.

Code: Select all

# This setting will then send an alert email if more than LF_SCRIPT_LIMIT lines
# appear with the same cwd= path in them within an hour. This can be useful in
# identifying spamming scripts on a server, especially PHP scripts running
# under the nobody account. The email that is sent includes the exim log lines
# and also attempts to find scripts that send email in the path that may be the
# culprit
LF_SCRIPT_ALERT = "1"

# The limit afterwhich the email alert for email scripts is sent. Care should
# be taken with this value if you allow clients to use web scripts to maintain
# pseudo-mailing lists which have large recipients
LF_SCRIPT_LIMIT = "100"

# If an LF_SCRIPT_ALERT event is triggered, then if the following can contain
# the path to a script, it will be run in a child process and passed the
# following information as parameters which also appears in the email alert:
#   Path to the directory containing the script that is sending the email
#   Count of emails sent
#   Sample of the first 10 emails
#   List of possible email scripts within Path
#
# The action script must have the execute bit and interpreter (shebang) set
LF_SCRIPT_ACTION = ""

Is it possible you may be referring to a different alert, or is it this one?

[consultant]

Time: Wed May 16 07:01:43 2018 -0700
Account: cptest
Resource: Process Time
Exceeded: 22283 > 1800 (seconds)
Executable: /usr/local/cpanel/3rdparty/perl/526/bin/perl
Command Line: spamd child
PID: 15690 (Parent PID:14162)
Killed: No

[BallyBasic79]

What is the subject line?