Knowledgebase

SpamAssassin Temporary File Alerts in cPanel (lfd on name.server: Suspicious File Alert)

Print
SpamAssassin
tmp
cPanel
2

Fix SpamAssassin Alerts in cPanel

The cPanel update in August 2024 caused CSF/LFD to issue hourly alerts regarding SpamAssassin temporary files.

Alert Format

The alerts appear as follows:

Time: Tue Sep 24 13:06:26 2024 +0300
File: /tmp/.spamassassin*******/.spamassassin
Reason: Suspicious directory
Owner: nobody:nobody (99:99)
Action: No action taken

Recommended Solution

To stop these alerts, add the SpamAssassin temporary files located in the /tmp folder to the whitelist to prevent them from being scanned by CSF/LFD:

Implementation Steps

  1. Open WHM
  2. Go to ConfigServer Security & Firewall
  3. Navigate to csf.fignore
  4. Add the following line at the end of the file:
    /tmp\/.spamassassin*
  5. Restart the LFD service
Result: This will add the SpamAssassin temporary files in /tmp to the whitelist and prevent future alerts.
Was this answer helpful?