CXS and W3-Total-Cache

[Shami]

Hello,

I am running CXS on my server and II have setup few WP blog with W3-Total-Cache. I am getting these alerts. Should I be concerned.
---------------------------------------------------------------------------
# Regular expression match = [PHP Agent]:
'plugins/w3-total-cache/inc/widget/new_relic.php'
# Regular expression match = [PHP Agent]:
'plugins/w3-total-cache/lib/NewRelic/NewRelicWrapper.php'
# Regular expression match = [PHP Agent]:
'plugins/w3-total-cache/lib/W3/NewRelicService.php'
---------------------------------------------------------------------------

Thanks

[nNhJoQF]

A [PHP Agent] is often included in a web script exploit.
If you were to find a php agent in a file that has no right to have one then you should be concerned.
New relic is a Application performance monitoring and management platform.
If you have an account with them and you enable its use within W3TC, then W3TC would use its [PHP Agent] to send application (Wordpress) performance data to the New Relic web site.
This is a legitimate use of a [PHP Agent]
To prevent these alerts for W3TC then on your server you would find the file,

Code: Select all

/etc/cxs/cxs.ignore.example

,copy it, then rename the copy to

Code: Select all

/etc/cxs/cxs.ignore

Then add the following to its contents,

Code: Select all

#
### w3-total-cache/inc/widget/new_relic.php
md5sum:ce45408aaa7203acebe69ba6d8ca472c
#
### w3-total-cache/lib/NewRelic/NewRelicWrapper.php
md5sum:66114e81559857b81e73e47a7feabcca
#
### w3-total-cache/lib/W3/NewRelicService.php
md5sum:73b2a931ebe0f4f588328ce8cd039dbe

then save

Code: Select all

csx.ignore

The lines with # at the start are comments so you can determine which checksum is for which file in the future.
If in the future these W3TC files are updated, these md5 checksums would also need to be updated.
I wouldn't expect that to happen very often though.