Hi Folks, I have received a bunch of bounce emails into my postmaster inbox below. Those emails are alert from the lfd log which i am running on the CSF firewall. Here is the lfd log FYI.
User:qmailq Time:204603 EXE:/var/qmail/bin/qmail-clean CMD:qmail-clean Dec 2 17:01:14 mail lfd[18791]: *User Processing* PID:11749 Kill:0 User:vpopmail Time:204604 EXE:/usr/bin/tcpserver CMD:/usr/bin/tcpserver -v -R -H -l mail.domain.com -x /etc/tcprules.d/tcp. Dec 2 17:01:14 mail lfd[18791]: *User Processing* PID:11858 Kill:0 User:vpopmail Time:204603 EXE:/usr/bin/tcpserver CMD:/usr/bin/tcpserver -v -R -H -l mail.domain.com -x /etc/tcprules.d/tcp. Dec 2 17:01:14 mail lfd[18791]: *User Processing* PID:11902 Kill:0 User:mysql Time:204602 EXE:/usr/bin/bash CMD:/bin/sh /usr/bin/mysqld_safe --basedir=/usr Dec 2 17:01:15 mail lfd[18791]: *User Processing* PID:12443 Kill:0 User:dovecot Time:204597 EXE:/usr/libexec/dovecot/anvil CMD:dovecot/anvil Dec 2 17:01:15 mail lfd[18791]: *User Processing* PID:11842 Kill:0 User:qmails Time:204603 EXE:/var/qmail/bin/qmail-send CMD:qmail-send Dec 2 17:01:15 mail lfd[18791]: *User Processing* PID:12454 Kill:0 User:dovecot Time:204597 EXE:/usr/libexec/dovecot/stats CMD:dovecot/stats Dec 2 17:01:15 mail lfd[18791]: *User Processing* PID:11710 Kill:0 User:clamupdate Time:204604 EXE:/usr/bin/freshclam CMD:/usr/bin/freshclam -d --foreground=true Dec 2 17:01:15 mail lfd[18791]: *User Processing* PID:1845 Kill:0 User:dspam Time:204617 EXE:/usr/bin/dspam CMD:/usr/bin/dspam --daemon 2>/dev/null Dec 2 17:01:15 mail lfd[18791]: *User Processing* PID:11845 Kill:0 User:qmailr Time:204603 EXE:/var/qmail/bin/qmail-rspawn CMD:qmail-rspawn Dec 2 17:01:15 mail lfd[18791]: *User Processing* PID:11879 Kill:0 User:vpopmail Time:204603 EXE:/usr/bin/tcpserver CMD:/usr/bin/tcpserver -v -R -H -l mail.domain.com -x /etc/tcprules.d/tcp. Dec 2 17:01:15 mail lfd[18791]: *User Processing* PID:11758 Kill:0 User:qmaill Time:204604 EXE:/usr/bin/multilog CMD:/usr/bin/multilog t s1000000 n100 /var/log/qmail/smtps Dec 2 17:01:15 mail lfd[18791]: *User Processing* PID:11755 Kill:0 User:qmaill Time:204604 EXE:/usr/bin/multilog CMD:/usr/bin/multilog t s1000000 n100 /var/log/qmail/submission Dec 2 17:01:16 mail lfd[18791]: *User Processing* PID:11847 Kill:0 User:qmails Time:204603 EXE:/var/qmail/bin/qmail-todo CMD:qmail-todo Dec 2 17:01:16 mail lfd[18791]: *User Processing* PID:12696 Kill:0 User:dovecot Time:204582 EXE:/usr/libexec/dovecot/auth CMD:dovecot/auth Dec 2 17:01:16 mail lfd[18791]: *User Processing* PID:11759 Kill:0 User:qmaill Time:204604 EXE:/usr/bin/multilog CMD:/usr/bin/multilog t s1000000 n100 /var/log/qmail/send Dec 2 17:01:16 mail lfd[18791]: *User Processing* PID:11746 Kill:0 User:qmaill Time:204604 EXE:/usr/bin/multilog CMD:/usr/bin/multilog t s1000000 n100 /var/log/qmail/smtp Dec 2 17:01:16 mail lfd[18791]: *User Processing* PID:11848 Kill:0 User:qmailq Time:204603 EXE:/var/qmail/bin/qmail-clean CMD:qmail-clean I have allowed the above process in /etc/csf/csf.pignore below. exe:/var/qmail/bin/qmail-clean exe:/usr/bin/tcpserver exe:/usr/bin/multilog exe:/var/qmail/bin/qmail-rspawn exe:/usr/libexec/dovecot/auth exe:/usr/sbin/clamd exe:/usr/bin/bash exe:/usr/bin/dspam exe:/var/qmail/bin/qmail-send exe:/usr/libexec/dovecot/anvil exe:/usr/libexec/dovecot/stats exe:/var/qmail/bin/qmail-todo exe:/opt/spamdyke/bin/spamdyke exe:/var/qmail/bin/qmail-smtpd exe:/usr/sbin/httpd Bounce email sample below for all above process with every 5 mins Subject: lfd on mail.domain.com: Excessive resource usage: qmaill (11758 (Parent PID:11736)) Time: Wed Dec 2 17:01:15 2020 +0800 Account: qmaill Resource: Process Time Exceeded: 204604 > 1800 (seconds) Executable: /usr/bin/multilog Command Line: /usr/bin/multilog t s1000000 n100 /var/log/qmail/smtps PID: 11758 (Parent PID:11736) Killed: No Any issue on the csf configuration. Could anyone help me. -- *Regards,Manikandan.C*
