LFD "Excessive resource usage" from imunify360-scanlogd

Issue

LFD keeps delivering alerts about imunify360-scanlogd "resource usage".

Environment

• Imunify360
• imunify360-scanlogd
• LFD

Solution

False-positives from LFD resource usage are common, as this tool doesn't analyze what the process is doing, instead, it notifies based on pre-established rules.

To stop these alerts, you may want to whitelist the process by adding it to:

/etc/csf/csf.pignore

Add to the bottom of the file:

exe:/usr/sbin/imunify360-scanlogd

 You can also disable our service, but this will prevent Imunify from detecting port scanning, which is not recommended:

systemctl disable --now imunify360-scanlogd

Cause

False-positive from LFD.

Useful links

https://www.knownhost.com/kb/common-csf-lfd-false-positives-and-how-to-stop-the-notifications/