Skip to main content

LFD file and folder watching is confusing

BlueSteam
Hi All, I have set the CSF filrewall to monitor two folders for any changes. Names my WHMCS directory. Inside this folder there are hundreds if not thousands of files. No when a single file is changed for any reason, an email is sent to me telling me that there were files changed. but it doesn't indicate WHICH file. It's a bit useless to me at this stage but I would really like to know WHICH files have actually changed. Is this possible to simply filter out the changed files?? Thanks in advance BlueSteam

Comments

15 comments

Date Votes
  • cPanelMichael
    Hello :) You will likely receive more feedback to this question on the CSF forums, as this is a feature of CSF instead of cPanel/WHM. Thank you.
    0
  • BlueSteam
    I have received absolutely NO feedback on the CSF forums. I even proceeded to open a support ticket to which they batted me away saying I must pay to have my concern answered. :eek:
    0
  • Infopro
    Please post one of these emails intact, only obfuscate your personal details first please, thanks.
    0
  • BlueSteam
    The email just contains a full list of the folder it is monitoring. This email is meant to indicate to me that something has changed. but to know WHICH file has changed is a nightmare if the folder has thousands of files in it. see attached
    0
  • Infopro
    I have set the CSF filrewall to monitor two folders for any changes.

    Could you please explain exactly how you set this up? What I mean is, what you added to the csf.dirwatch file, exactly.
    0
  • BlueSteam
    Could you please explain exactly how you set this up? What I mean is, what you added to the csf.dirwatch file, exactly.

    I simply added this location to the csf.dirwatch /home/cpanelaccount/public_html/admin
    0
  • simon templar
    The best way to see if something changed would be to export the result of /home/cpanelaccount/public_html/admin via ls -lsAr into a file, and once you receive an email, do the same (into another file) then compare the md5sum . If they are different, then something changed. This is what csf.dirwatch does basically .
    0
  • BlueSteam
    Thank you for looking. I do realize that this is how it works but I'm saying that it is silly to watch a directory to alert you that something changed and then not actually SHOW you what changed. This tool can be improved on so many levels. Really sad that no one has corrected it.
    0
  • Infopro
    No when a single file is changed for any reason, an email is sent to me

    Can you give me an example of a file change you might make in your WHMCS admin directory? What are your other settings under the Directory Watching & Integrity section?
    0
  • BlueSteam
    There are no other setting to set. If csf.dirwatch has content in it then it will monitor those files and locations. then simply send you an email with a full output of all the files and directories. It has not intuitive way of telling you what changed and no additional settings to set. it's a very STUPID system.
    0
  • Infopro
    Sure there is: CSF > Directory Watching & Integrity Can you provide me an example that triggers the email you got?
    0
  • BlueSteam
    anything that changes. like if a file is uploaded or renamed or replaced etc.
    0
  • Infopro
    I do not have LF_DIRWATCH_DISABLE set to 1. As it states, that would grab and tarball the files. I am unable to trip this and get an email like you are. I'm using the same directory as you (different name though see: Further Security Steps > WHMCS Docs) and the same (I assume) WHMCS files. Editing a file, replacing a file, deleting a file, uploading a new completely unrelated file to that directory, does not trip this for me. I do note that you first posted this thread on Oct 14, and by the dates in the output you posted, it seems you just updated WHMCS on Oct 14 as well. I updated my own on Oct 13. I got no email about that, like your email, either. I wonder what the difference is between yours and mine then?
    0
  • BlueSteam
    That setting doesn't tarball the files. It doesn't state that it does. it states This option allows you to have lfd watch a particular file or directory for changes and should they change and email alert using watchalert.txt is sent
    So, the LF_DIRWATCH simply watches the directories that you want watched for any changes. If there are changes, it kicks off a mail. Mine works. I don't know why you'rs isn't working.
    0
  • Infopro
    Mine works. I don't know why you'rs isn't working.

    Me either. LF_DIRWATCH_FILE is the one emailing you, not LF_DIRWATCH. Descriptions are above, not below each setting.
    0

Please sign in to leave a comment.

Didn't find what you were looking for?

New post