ConfigServer Community Forum

Strange. I don't recall ever having to restart CSF after doing a simple 'csf -d'. If CSF had to be restarted each time 'csf -d' was ran, that would impose a huge performance penalty on a server if brute force protection of services was in place.

M

That is botnet-related SMTP Auth brute forcing. It's been going on for months now, off and on. I say botnet-related because the traffic will come on all at once, and from many different IP addresses all over the place, and will persist for a day or so. Then all of that will stop for days or even a w...

Jonathan,

I can verify that it's working now. Updated to 4.54 and it's working fine!

Thank you,

Mike

Jonathan,

Sorry for the delay. No, PS_INTERVAL was set to 0. I have DROP_IP_LOGGING disabled as well. I did go ahead and set PS_INTERVAL to 60 and I have kept DROP_IP_LOGGING disabled.

Mike

Jonathan, I'm running CSF v4.53 . It appears that I'm having this same problem again. It may have been going on for many versions. I have the IPTABLES LOG set to /var/log/kernel.log Syslog is properly logging to /var/log/kernel.log There are recent Firewall entries in /var/log/kernel.log When I atte...

Jonathan,

Thank you. It's working great in 4.05.

Mike

Sorry - i posted incorrect info... edited.

Jonathan, I'm not sure if this is a 'bug' or not If it is not, please forgive the post here. I am running CSF 4.03 I have configured /etc/syslog.conf so that firewall logging is put in /var/log/kernel.log instead of in /var/log/messages. [messages is too cluttered with other things] In WHM, in the C...