Page 1 of 1

CXS and W3-Total-Cache

Posted: 04 Sep 2013, 07:17
by Shami
Hello,

I am running CXS on my server and II have setup few WP blog with W3-Total-Cache. I am getting these alerts. Should I be concerned. :confused:
---------------------------------------------------------------------------
# Regular expression match = [PHP Agent]:
'plugins/w3-total-cache/inc/widget/new_relic.php'
# Regular expression match = [PHP Agent]:
'plugins/w3-total-cache/lib/NewRelic/NewRelicWrapper.php'
# Regular expression match = [PHP Agent]:
'plugins/w3-total-cache/lib/W3/NewRelicService.php'
---------------------------------------------------------------------------

Thanks

Re: CXS and W3-Total-Cache

Posted: 15 Oct 2013, 07:23
by nNhJoQF
A [PHP Agent] is often included in a web script exploit.
If you were to find a php agent in a file that has no right to have one then you should be concerned.
New relic is a Application performance monitoring and management platform.
If you have an account with them and you enable its use within W3TC, then W3TC would use its [PHP Agent] to send application (Wordpress) performance data to the New Relic web site.
This is a legitimate use of a [PHP Agent]
To prevent these alerts for W3TC then on your server you would find the file,

Code: Select all

/etc/cxs/cxs.ignore.example
,copy it, then rename the copy to

Code: Select all

/etc/cxs/cxs.ignore
Then add the following to its contents,

Code: Select all

#
### w3-total-cache/inc/widget/new_relic.php
md5sum:ce45408aaa7203acebe69ba6d8ca472c
#
### w3-total-cache/lib/NewRelic/NewRelicWrapper.php
md5sum:66114e81559857b81e73e47a7feabcca
#
### w3-total-cache/lib/W3/NewRelicService.php
md5sum:73b2a931ebe0f4f588328ce8cd039dbe
then save

Code: Select all

csx.ignore
The lines with # at the start are comments so you can determine which checksum is for which file in the future.
If in the future these W3TC files are updated, these md5 checksums would also need to be updated.
I wouldn't expect that to happen very often though.