How to ignore PHP scripts run from Cron

[mikelegg]

Hi Guys
I've been trying for a month to stop LFD warnings from legitimate PHP scripts that are run from cron, but none of the suggestions I've found are working.

I've tried ...

In /etc/csf/csf.signore
/path/to/script.php

In /etc/csf/csf.pignore
cmd:php /path/to/script.php
exe:/path/to/script.php
exe:/opt/cpanel/ea-php72/root/usr/bin/php-cgi /path/to/script.php
exe:/bin/bash -c /usr/bin/php /path/to/script.php >/dev/null 2>&1

But every day I get " Suspicious process running under user xxxx" emails.

What is the correct syntax to ignore these scripts?

[consultant]

Same issue. Banging my head against a wall. Did you ever figure it out?

[mikelegg]

The warnings have stopped, but it's so long ago, I don't know what finally fixed it.

I can see I have entries in /etc/csf/csf.signore

Maybe these finally worked.

[mikelegg]

They've come back again.

I've found that the path to the PHP CGI has changed, so I've updated csf.pignore to use
exe:/opt/cpanel/ea-phpnn/root/usr/bin/php-cgi /path/to/php/script.php

I'll update this thread if that works

[mikelegg]

Nope that didn't work.

Maybe I can just make a rule to delete the hundreds of emails when they arrive.

[Sergio]

@mikelegg,
in CSF go to pignore and add the following line in there:
exe:/opt/cpanel/ea-php72/root/usr/bin/php-cgi

if you want the rule to be applied to any version of php, you can add:
pexe:/opt/cpanel/ea-php\d+/root/usr/bin/php-cgi

[mikelegg]

We've updated our PHP and now nothing I do suppresses these notifications. I've tried -
pcmd:/opt/cpanel/ea-php83/root/usr/bin/php-cgi -f /path/to/script
pcmd:/opt/cpanel/ea-php83/root/usr/bin/php -f /path/to/script
pexe:/opt/cpanel/ea-php\d+/root/usr/bin/php-cgi -f /path/to/script

Interestingly, ever since the last PHP upgrade I have to specify the PHP version in the path in the crontab which is a pain in the butt because it means I have to update all of our dozens of crons every time we update PHP. I wonder if these 2 issues are related.