How to Disable Suspicious File Alert Emails in ConfigServer (CSF) via WHM on cPanel Servers

Overview

Dedicated Website Hosting or cPanel Server customers who maintain an administrator role may encounter frequent emails from the server with the following subject:

lfd on <server>: Suspicious File Alert

These alerts are generated by ConfigServer Security & Firewall (CSF)'s Login Failure Daemon (lfd), which watches for suspicious script files created in temporary directories like /tmp or /dev/shm.

Reference: cPanel Support Article on Suspicious File Alerts

Step-by-Step Guide to Disable These Alerts

1. Log in to WHM as root

Use root credentials to access WebHost Manager (WHM).

2. Navigate to ConfigServer Security & Firewall

• In WHM, go to:

  WHM > Plugins > ConfigServer Security & Firewall
  

• Or search for "ConfigServer" or "CSF" in the sidebar.

3. Access the Firewall Configuration

• Click on "Firewall Configuration" under the CSF interface.

4. Locate the LF_DIRWATCH Setting

• Search for the following setting:

  LF_DIRWATCH
  

• By default, this may be set to a number representing the scan interval in seconds (e.g., 3600).

5. Disable Directory Watching

• To disable these alerts entirely, set:

  LF_DIRWATCH = 0
  

This disables lfd from scanning /tmp, /dev/shm, and similar directories for suspicious file types.

6. Save Changes

• Scroll to the bottom and click "Change" to save the configuration.

7. Restart CSF and LFD

• After saving, click "Restart csf+lfd" to apply the new configuration.

Alternative: Fine-Tune Rather Than Disable

If you wish to reduce false positives without disabling directory watching completely, you may:

A. Modify File Extensions to Watch

• Adjust:

  LF_DIRWATCH_FILE_TYPES = "perl|py|cgi|pl|sh|rb"
  

• This removes .php from the scan, which is the common cause of false alerts from services like PHP-FPM.

B. Add Paths to Ignore

• Edit the CSF ignore file:

  /etc/csf/csf.fignore
  

• Add:

  /tmp/systemd-private-*
  

• Save the file and restart CSF/LFD.

Important Note

Disabling this feature stops lfd from alerting you about any script-like files dropped in temp space — which may include malware. Ensure you have other malware scanning tools (e.g., ImunifyAV, ClamAV) running if you disable this.

Summary

By following the steps above, you can eliminate noisy and often unnecessary alerts for PHP-FPM-related temp files while maintaining full control over your server security posture.