Unknown user created cldiaguser

Please note that Way to the Web Ltd. (the company behind ConfigServer) has announced it will close permanently on August 31, 2025. However, their free scripts will remain available under the GPLv3 license. For more details, see:

ConfigServer Services Announcement

Symptoms

A user named cldiaguser was created and deleted on your server. You may receive a notification if running the third-party software CSF, or see the following in your system's secure logs:

[06:00:00 server root ~]cPs# grep -i cldiag /var/log/secure
Jan 13 05:35:05 server useradd[197191]: new group: name=cldiaguser, GID=1121
Jan 13 05:35:05 server useradd[197191]: new user: name=cldiaguser, UID=1000, GID=1121, home=/home/cldiaguser, shell=/bin/bash
Jan 13 05:35:10 server userdel[197203]: delete user 'cldiaguser'

Description

CloudLinux created this user for the cldiag tool. This behavior change was intentional in the package update for package lve-utils in version 4.2.25-1.

Workaround

If you receive notifications from third-party software regarding the change, consider excluding this user or disregarding/filtering emails relating to this change.

Please note that this cron runs once per day and will be expected to create/remove a user each time it runs.