Attempts at ignoring mailman notifications don't work what am I doing wrong?

[maestroc]

Via email I get the following notifications (hundreds a day):

Time: Mon Mar 2 02:16:07 2020 +0000
Account: mailman
Resource: Process Time
Exceeded: 17249 > 10000 (seconds)
Executable: /usr/bin/python2.7
Command Line: /usr/bin/python2 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=ArchRunner:0:1 -s
PID: 8576 (Parent PID:8549)
Killed: No

I have added the following lines to my csf pignore file and restarted LFD:

pcmd:/usr/local/cpanel/3rdparty/bin/python /usr/local/cpanel/3rdparty/mailman/bin/qrunner.*
pcmd:/usr/local/cpanel/3rdparty/bin/python /usr/local/cpanel/3rdparty/mailman/bin/mailmanctl.*

Yet I keep getting the emails anyway. What am I doing wrong? What should I put in to prevent CSF from sending me notifications for this process?

[maestroc]

Any help at all on this would be greatly appreciated. I'm still getting them. Same path:

Account: mailman
Resource: Process Time
Exceeded: 10010 > 10000 (seconds)
Executable: /usr/bin/python2.7
Command Line: /usr/bin/python2 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=RetryRunner:0:1 -s

[Annette]

Have you tried ignoring the user account mailman instead of the processes themselves? We've had some better results lately with doing that for system-based accounts versus the command or executable they generate.

[integraserve]

For the entry to work, it has to point to the exact file, and not alias.
Thankfully, the error message contains all we need to construct a valid entry:
Command Line: /usr/bin/python2 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=ArchRunner:0:1 -s

In your case, the entries to the csf.pignore file should be:
pcmd:/usr/bin/python2 /usr/local/cpanel/3rdparty/mailman/bin/qrunner.*
pcmd:/usr/bin/python2 /usr/local/cpanel/3rdparty/mailman/bin/mailmanctl.*

*Don't forget to restart lfd.