Page 1 of 1

No Alerts from CSF with CloudLinux 9.4 and AlamLinux 9

Posted: 14 Aug 2024, 15:27
by raistlfiren
Hi, we do not see any CSF email alerts in the exim_mainlog, and we aren't receiving any either. The server is also running cPanel and WHM. We have taken the following steps to check that everything is set:
  • Testing = 0 in the configuration
  • LF_ALERT_TO AND X_ARF_TO are set to the correct email
  • Alerts are turned on in the configuration
  • LF_EMAIL_ALERT is set to 1 or true
  • /etc/aliases root is set to the correct email address
  • echo "test mail" | sendmail <email> works just fine
  • mail <email> works just fine
Output of csftest.pl
Testing ip_tables/iptable_filter...OK
Testing ipt_LOG...OK
Testing ipt_multiport/xt_multiport...OK
Testing ipt_REJECT...OK
Testing ipt_state/xt_state...OK
Testing ipt_limit/xt_limit...OK
Testing ipt_recent...OK
Testing xt_connlimit...OK
Testing ipt_owner/xt_owner...OK
Testing iptable_nat/ipt_REDIRECT...OK
Testing iptable_nat/ipt_DNAT...OK

RESULT: csf should function on this server

Any other ideas on how to get alerts working and sent out through email?

Thanks!

Re: No Alerts from CSF with CloudLinux 9.4 and AlamLinux 9

Posted: 21 Aug 2024, 15:51
by raistlfiren
Further investigation: I did a grep -

Code: Select all

grep WHM/cPanel /var/log/lfd.log
I see the data being logged in the file - "Aug 21 10:36:15 host lfd[1599569]: *WHM/cPanel root access* from <IP>"

Although, there isn't any email being sent or recorded in exim_mainlog -

Code: Select all

grep WHM/cPanel /var/log/exim_mainlog
My country isn't being ignored to verify. I am also using a different device to login as root instead of the whitelisted IP address.

Code: Select all

CC_IGNORE=""
Any other ideas? I am running this on WHM/cPanel.