LFD stands for Login Failure Daemon. It's an application on the server with CSF firewall for security. It always runs on the server. It checks server logs regularly. Sometimes, you get emails about excessive resource use. With LFD, you can set resource limits. LFD sends notifications when processes use a lot of memory or time, and
you can adjust settings in the CSF configuration. Alerts might include warnings about too much virtual memory or process time being used.
Example “Excessive Resource Usage” Email:
Virtual Memory Size Excessive Resource Usage Alert
- Time: Tue Jul 15 06:23:10 2014 +0100
- Account: demovpstest
- Resource: Virtual Memory Size
- Exceeded: 280 > 200 (MB)
- Executable: /usr/bin/php
- Command Line: /usr/bin/php /home/demovpstest/public_html/owncloud/remote.php
- PID: 20571 (Parent PID:20435)
- Killed: No
Process Time Excessive Resource Usage Alert
- Time: Tue Jul 15 10:01:22 2014 +0530
- Account: demovpstest
- Resource: Process Time
- Exceeded: 129399 > 1800 (seconds)
- Executable: /usr/bin/php
- Command Line: /usr/bin/php /home/demovpstest/public_html/news/rewrite.php
- PID: 28929 (Parent PID:26541)
- Killed: No
How To Disable These Alerts?
Turning off these warnings isn't a good idea. These emails help keep track of how much server resources users are using. If we want a certain process or service to keep using server resources but don't want LFD alerts, we can do that.
There are three ways to prevent LFD from sending warnings about using too much memory. We'll explain each method below. We can adjust CSF settings through WHM or the terminal.
How to Stop LFD from sending alerts about high resource usage in WHM/Terminal:
Method 1:
We'll permanently turn off the LFD high resource use alert. But remember, this might make your server less secure.
Step 1: Log in to WHM.
Step 2: Go to "ConfigServer Security & Firewall" under the "Plugin" section.
Step 3: Click on "Firewall Configuration" to edit the CSF configuration file.
Step 4: Set PT_USERMEM and PT_USERTIME to 0.
PT_USERMEM = 0
PT_USERTIME = 0
Step 5: Click "Change" to save the changes.
Step 6: To apply the changes, restart both csf and lfd services by clicking on "Restart csf+lfd."
Method 2
To stop LFD notifications temporarily, we'll adjust memory and time limits.
Step 1: Log in to WHM.
Step 2: Go to "ConfigServer Security & Firewall" under the "Plugin" section.
Step 3: Click on "Firewall Configuration" to edit the CSF configuration file.
Step 3: Change PT_USERMEM and PT_USERTIME values.
PT_USERMEM = 512
PT_USERTIME = 1800
Step 4: Click "Change" to save the changes. But remember, you'll still get alerts if any process uses more resources than these limits.
Step 5: Restart both csf and lfd services to apply the changes by clicking on "Restart csf+lfd."
Method 3
This method ignores specific processes/services in CSF to stop LFD alerts.
Step 1: Log in to WHM.
Step 2: Go to the search box and type terminal.
Step 3: In the terminal, open CSF ignore with any text editor, like Pignore in /etc/csf/csf.pignore.
Step 4: Add the command line path from the alert to the CSF ignore list.
Step 5: Save the changes.
Once you've done these steps, LFD won't send alerts about excessive resource usage anymore.
How do I stop getting too many alerts about LFD using up too many resources through SSH?
Method 1
To turn off the LFD alert, you can follow these steps:
Step 1: Open the file named "csf.pignore" using a text editor.
Step 2: Add the path of the command line but not the executable path.
Step 3: Typically, this file is located at "/etc/csf/csf.pignore".
Step 4: Be careful not to add only the executable path. For example, if the alert mentions "/usr/bin/php" as the executable path, don't add it. This way, it won't notify about any PHP processes on your server. Add only specific things. The process for adjusting process time is the same.
Method 2
This method will permanently disable the LFD alert, but it comes with a security risk:
Step 1: Open the file "csf.conf" using a text editor.
Step 2: Set "PT_USERMEM=0".
The process for adjusting process time is the same, but you need to change "PT_USERTIME" value instead of "PT_USERMEM" values.
Method 3
To increase the value of "PT_USERMEM" beyond 200:
The default value is 200, so you can set it to a higher value, like 500.
Step 1: Open the file "csf.conf" using a text editor.
Step 2: Set "PT_USERMEM=500".
The process for adjusting process time is the same, but you need to change "PT_USERTIME" value instead of "PT_USERMEM" values.
Step 3: Finally, restart the CSF using the below command.
# csf -r
Conclusion
In conclusion, various methods can be used to disable the LFD excessive resource usage alert in WHM/cPanel, each with its own considerations. Whether permanently turning off alerts, temporarily adjusting parameters, or ignoring specific processes/services, it's crucial to assess the trade-offs between security risks and monitoring needs before making any changes.
