* * * UPDATED 11st July, 2016 * * *
To reduce a number of false alarms and email notifications from CSF/LFD on a Directadmin powered server we need to add some trusted services into an exception list which is stored in /etc/csf/csf.pignore.
Open /etc/csf/csf.pignore and update it with the following lines:
cmd:spamd child exe:/bin/dbus-daemon exe:/sbin/ntpd exe:/usr/bin/dbus-daemon exe:/usr/bin/dbus-daemon-1 exe:/usr/bin/fetchmail exe:/usr/bin/freshclam exe:/usr/bin/lsmd exe:/usr/libexec/dovecot/anvil exe:/usr/libexec/dovecot/imap exe:/usr/libexec/dovecot/imap-login exe:/usr/libexec/dovecot/managesieve exe:/usr/libexec/dovecot/managesieve-login exe:/usr/libexec/dovecot/pop3 exe:/usr/libexec/dovecot/pop3-login exe:/usr/libexec/gam_server exe:/usr/libexec/hald-addon-acpi exe:/usr/libexec/hald-addon-keyboard exe:/usr/lib/polkit-1/polkitd exe:/usr/local/bin/clamd exe:/usr/local/bin/freshclam exe:/usr/local/bin/pureftpd_uploadscan.sh exe:/usr/local/directadmin/dataskq exe:/usr/local/directadmin/directadmin exe:/usr/local/libexec/dovecot/imap exe:/usr/local/libexec/dovecot/imap-login exe:/usr/local/libexec/dovecot/pop3 exe:/usr/local/libexec/dovecot/pop3-login exe:/usr/local/mysql-5.1.54-linux-x86_64/bin/mysqld exe:/usr/local/php53/bin/php53 exe:/usr/local/php53/bin/php-cgi53 exe:/usr/local/php53/bin/php_uploadscan.sh exe:/usr/local/php53/sbin/php-fpm53 exe:/usr/local/php54/bin/php54 exe:/usr/local/php54/bin/php-cgi54 exe:/usr/local/php54/bin/php_uploadscan.sh exe:/usr/local/php54/sbin/php-fpm54 exe:/usr/local/php55/bin/php55 exe:/usr/local/php55/bin/php-cgi55 exe:/usr/local/php55/bin/php_uploadscan.sh exe:/usr/local/php55/sbin/php-fpm55 exe:/usr/local/php56/bin/php56 exe:/usr/local/php56/bin/php-cgi56 exe:/usr/local/php56/bin/php_uploadscan.sh exe:/usr/local/php56/sbin/php-fpm56 exe:/usr/local/php70/bin/php70 exe:/usr/local/php70/bin/php-cgi70 exe:/usr/local/php70/bin/php_uploadscan.sh exe:/usr/local/php70/sbin/php-fpm70 exe:/usr/local/sbin/nginx exe:/usr/sbin/chronyd exe:/usr/sbin/exim exe:/usr/sbin/hald exe:/usr/sbin/httpd exe:/usr/sbin/mysqld exe:/usr/sbin/mysqld_safe exe:/usr/sbin/named exe:/usr/sbin/nginx exe:/usr/sbin/nscd exe:/usr/sbin/ntpd exe:/usr/sbin/proftpd exe:/usr/sbin/pure-ftpd exe:/usr/sbin/sshd user:munin user:mysql
And now we restart LFD:
/etc/init.d/lfd restart
Have a good day!
p.s. Based on this thread: http://forum.directadmin.com/showthread.php?t=49424