ConfigServer Firewall works well by default. But if you customize it some, it can be even more poweful of a tool. When your load is high, you usually receive an alert from CSF. However, those reports contain a limited amount of information. If your receive these high server alerts often and want more information about what is actually going on when high load averages occur, then do the following. You can have lfd send you custom reports by using the PT_LOAD_ACTION option within the CSF configuration.First, login to shell.
Then create a file call /etc/csf/load.sh
touch /etc/csf/load.sh
nano /etc/csf.load.sh
Add the following contents to the file:
#!/bin/sh
>/etc/csf/csf.report
iostat -d 1 5 >> /etc/csf/csf.report
iostat -x -d 1 5 >> /etc/csf/csf.report
mpstat -P ALL >> /etc/csf/csf.report
top -b -n 1 >> /etc/csf/csf.report
netstat -autpn
mail -s “Load Report” root < /etc/csf/csf.report
Save the file.
Then, change the chmod settings of the file:
chmod +x /etc/csf/load.sh
Finally, edit /etc/csf/csf.conf and goto the section labeled “PT_LOAD_ACTION”. Add “/etc/csf/load.sh” so that it now looks like this:
PT_LOAD_ACTION = “/etc/csf/load.sh”
Restart csf:
csf -r
That’s it! Now when you receive a high CPU load alert, you will also receive an email with a lot more information in it. If you want CSF to automatically restart apache too, you can add the following line to the end of the load.sh file:
service httpd restart
And then save the file and restart configserver
