Home / server / Questions / 233320
In Process
Squeeb
Asked: 2011-02-10 07:08:34 +0800 CST

CSF / LFD picking up suspicious users in OpenVZ containers

  • 772

I have OpenVZ running on a box with CSF / LFD installed.

I like the way LFD can alert me of suspicious processes running on the HardwareNode itself.

However, LFD is emailing me about every suspicious process that the VE's are running.

Is there a way to make LFD ignore the /vz/root directory entirely?

Regards, Chris

openvz csf

1 Answers

  1. You need to tweak /etc/csf/csf.pignore (on the host) to your requirements. In most cases we tend to ignore certain process on VMs like this:

    exe:/var/lib/vz/root/*/usr/sbin/mysqld
exe:/var/lib/vz/root/*/usr/sbin/portmap
exe:/var/lib/vz/root/*/sbin/portmap
    • 0