LFD on Excessive resource usage [FIX]

You may experiencing this issue if you are working with CPanel WHM and using LFD(Login Failure Daemon) to monitor server logs which is related to login failure attempt and then provide action in the CSF (Config Server Firewall).

LFD service sends excessive resource usage alerts to email with the following common format :

Time:         Thu Dec 28 13:58:57 2019 +0700
Account:      sp8dovr
Resource:     RSS Memory Size
Exceeded:     258 > 256 (MB)
Executable:   /usr/local/cpanel/3rdparty/perl/524/bin/perl
Command Line: spamd child
PID:          4241 (Parent PID:26888)
Killed:       No 

We can quickly solve this issue with using the following action :

1. Login to your WHM.

2. Goto Server Configuration > Terminal.

3. Create backup csf.pignore : cp /etc/csf/csf.pignore /etc/csf/csf.pignore.original

4. Edit file csf.pignore : vi /etc/csf/csf.pignore

5. Take note Executable from email notification to /etc/csf/csf.pignore.

   for example in this case Executable is : 

   /usr/local/cpanel/3rdparty/perl/524/bin/perl

6. Referring to Executable in Step 5 add this line to /etc/csf/csf.pignore.

   exe:/usr/local/cpanel/3rdparty/perl/.*/bin/perl 

   .* are regex to replacing 524 so that we don't need to make any configuration

   whenever perl version is changed.

7. Lastly Restart LFD (ConfigServer Security & Firewall > lfd Restart)

Note :

Others also report the following executables varian :

cmd:spamd child 

exe:/usr/local/cpanel/3rdparty/perl/.*/bin/spamd

exe:/opt/cpanel/ea-php*/root/usr/sbin/php-fpm

exe:/usr/bin/gpg-agent 

That's it ...