I noticed that I was getting emails from LFD (part of the ConfigServer Firewall package) about failing to find some added check line it was sending to syslog. <\/p>\n
The syslog message looks like this: The fix is simple. Just like how you may need to adjust the path in \/etc\/csf\/csf.conf to the real location of the UPDATE:<\/strong> UPDATE 2:<\/strong> I noticed that I was getting emails from LFD (part of the ConfigServer Firewall package) about failing to find some added check line it was sending to syslog. The syslog message looks like this: lfd[%d]: *SYSLOG CHECK* Failed to detect check line [%s] sent to SYSLOG Of course I’ve replaced the pid with %d and […]<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[6],"tags":[16,17,24,26],"_links":{"self":[{"href":"https:\/\/www.devolve.local\/wp-json\/wp\/v2\/posts\/613"}],"collection":[{"href":"https:\/\/www.devolve.local\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devolve.local\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devolve.local\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devolve.local\/wp-json\/wp\/v2\/comments?post=613"}],"version-history":[{"count":5,"href":"https:\/\/www.devolve.local\/wp-json\/wp\/v2\/posts\/613\/revisions"}],"predecessor-version":[{"id":618,"href":"https:\/\/www.devolve.local\/wp-json\/wp\/v2\/posts\/613\/revisions\/618"}],"wp:attachment":[{"href":"https:\/\/www.devolve.local\/wp-json\/wp\/v2\/media?parent=613"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devolve.local\/wp-json\/wp\/v2\/categories?post=613"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devolve.local\/wp-json\/wp\/v2\/tags?post=613"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\nlfd[%d]: *SYSLOG CHECK* Failed to detect check line [%s] sent to SYSLOG
\n<\/code>
\nOf course I’ve replaced the pid with %d and the check string that it’s looking for with %s, since that will vary.<\/p>\nipset<\/code> binary, you also may need to set where your SYSLOG messages are going. On an Ubuntu system, that means \/var\/log\/syslog rather than \/var\/log\/messages. Then just run csf -r<\/code> to restart LFD with the new settings.<\/p>\n
\n\/var\/log\/messages appears in more than just csf.conf. Since \/var\/log\/messages doesn’t exist on my system, I’m just going to symlink it to syslog and see what happens<\/del>.<\/p>\n
\nOK, I thought better of it and just modified csf.syslogs and csf.logfiles. I deleted that messages symlink in \/var\/log next. LFD was still being a little bitch after I restarted using csf -r<\/code>, so I ran service lfd stop<\/code> and then started it again.<\/p>\n","protected":false},"excerpt":{"rendered":"