Syntax for csf.pignore

[apcinternet]

Hi,

We are getting lots of Process Tracking notifications for an executable and would like to add it to csf.pignore

Code: Select all

/usr/local/cpanel/3rdparty/perl/536/bin/perl

What is the correct syntax to add this to /etc/csf/csf.pignore please?

Thanks very much

Michael

[Sarah]

If you really want csf process tracking to ignore all perl scripts, what exactly have you tried already? What do the Process Tracking notifications give for the exe and cmd?

[apcinternet]

We want to ignore /usr/local/cpanel/3rdparty/perl/536/bin/perl notifications and have not tried anything since we don't know the syntax.

I'm not sure what you mean by "What do the Process Tracking notifications give for the exe and cmd?"

Thanks

[Sarah]

The process tracking notifications should give you a lot of information. If you provide the full subject and contents of one of them it might help.

[cwbob]

Have you tried looking at the existing file for examples? Try adding this to the end of the file:

exe:/usr/local/cpanel/3rdparty/perl/536/bin/perl

If the perl version changes you'll need to update that or you can use:

exe:/usr/local/cpanel/3rdparty/perl/*/bin/perl

I've added several exe's like this with success.

-Bob