Page 1 of 1

Syntax for csf.pignore

Posted: 12 Sep 2024, 08:11
by apcinternet
Hi,

We are getting lots of Process Tracking notifications for an executable and would like to add it to csf.pignore

Code: Select all

/usr/local/cpanel/3rdparty/perl/536/bin/perl
What is the correct syntax to add this to /etc/csf/csf.pignore please?

Thanks very much

Michael

Re: Syntax for csf.pignore

Posted: 17 Sep 2024, 11:51
by Sarah
If you really want csf process tracking to ignore all perl scripts, what exactly have you tried already? What do the Process Tracking notifications give for the exe and cmd?

Re: Syntax for csf.pignore

Posted: 18 Sep 2024, 03:28
by apcinternet
We want to ignore /usr/local/cpanel/3rdparty/perl/536/bin/perl notifications and have not tried anything since we don't know the syntax.

I'm not sure what you mean by "What do the Process Tracking notifications give for the exe and cmd?"

Thanks

Re: Syntax for csf.pignore

Posted: 18 Sep 2024, 08:51
by Sarah
The process tracking notifications should give you a lot of information. If you provide the full subject and contents of one of them it might help.

Re: Syntax for csf.pignore

Posted: 30 Sep 2024, 22:35
by cwbob
Have you tried looking at the existing file for examples? Try adding this to the end of the file:

exe:/usr/local/cpanel/3rdparty/perl/536/bin/perl

If the perl version changes you'll need to update that or you can use:

exe:/usr/local/cpanel/3rdparty/perl/*/bin/perl

I've added several exe's like this with success.

-Bob