ConfigServer Community Forum

If this is a script or application that you did not put on your server, and it is actually located in the root directory as per your post, then it is not a cxs issue because it's an indication your server may be root compromised. Cxs is not designed to scan for rootkits or root compromises, there ar...

The reason it's not working is that this isn't a cxswatch alert. It's from cxs cgi scanning (modsecurity scanning). Cxs is not reporting the file admin-ajax.php as an exploit, it is reporting that the file admin-ajax.php is being used to upload possible exploits. I don't think you really want to ign...

Could you please post the cxs alert email you receive - subject and message - with domains and IP addresses removed?

Do you have Store Messages enabled in MailScanner? If this is enabled, a copy of all messages will be saved in the Quarantine nonspam folder, and this would not mean there is a problem with MailScanner. I suggest that you look at your exim log to find out whether some filter has deleted those emails...

This is somewhat helpful thank you. I'm seeing this message in the "Spam Report (components)" section under Mail Control. It's helpful to know this is coming from Spamassasin. But the Score is 0.00 anyways so therefore it's not a problem? It's still going to do the test unless you add tho...

Are you getting that error in the "Spam Report" section for an email in MailControl? If so, it is not MailScanner but SpamAssassin that is triggering the error. You'd have to modify the actual SpamAssassin test to fix the error or stop it from checking. The rule should be in the file /var/...

IF there is anything set in LF_ALERT_TO, it will override what is in the templates.

Do you have anything set in LF_ALERT_TO in the firewall configuration? Did you restart csf and lfd?

That report means it is an EXIM filter that has blocked it, not MailScanner. Check the user's cpanel email filters and get rid of any unnecessary filters, as we have seen these cause problems on servers running MailScanner.

From the screenshot it looks like the email was not blocked. Have you checked your exim log?