In the default recommended configurations, CSF is supposed to only report incidents; however, we have found that for some reason the implementation in the WHM plugin appears to be set to automatically kill such processes and sadly does not provide a configuration option in the interface to change this behavior. On your server, CSF was configured to kill programs that meets one of the following criteria:
- process exceeds 500MB of memory
- process runs for more than 1800 seconds
- process spawns more than 10 sub processes
To fix this, simply add the magicspam-daemon program to the configuration file. Inside the file /etc/csf/csf.pignore, add the following line:
Code: Select all
exe:/usr/share/magicspam/bin/magicspam-daemon
Code: Select all
csf -r
/etc/init.d/lfd restart
Consider reviewing the safety of having the setting PT_USERKILL enabled in /etc/csf/csf.conf as this is strongly flagged as 'NOT RECOMMENDED' by the creators of CSF (http://configserver.com/cp/csf.html).