ConfigServer eXploit Scanner (CXS) eating too much CPU

yogeshzade

I am using CXS antimalware (https://configserver.com/cp/cxs.html) from last two months. It's performing well for my Shared Hosting server but overeating CPU. Is there anyone facing the same issue?

TheLinuxBug

Have you reviewed the logs? Generally this means you have some set of files that keep being uploaded / updated or a folder with large amounts of file changes which it keeps having to scan. If you check the logs for it, you should be able to see this and you can exclude specific folders/files in the cxs.conf file and restart cxswatch to calm some of the load you are seeing.

Cheers!

yogeshzade

@TheLinuxBug said:
Have you reviewed the logs? Generally this means you have some set of files that keep being uploaded / updated or a folder with large amounts of file changes which it keeps having to scan. If you check the logs for it, you should be able to see this and you can exclude specific folders/files in the cxs.conf file and restart cxswatch to calm some of the load you are seeing.

Cheers!

Is https://www.imunify360.com best ?

TheLinuxBug

@yogeshzade said:

@TheLinuxBug said:
Have you reviewed the logs? Generally this means you have some set of files that keep being uploaded / updated or a folder with large amounts of file changes which it keeps having to scan. If you check the logs for it, you should be able to see this and you can exclude specific folders/files in the cxs.conf file and restart cxswatch to calm some of the load you are seeing.

Cheers!

Is https://www.imunify360.com best ?

I have no idea what you are asking here, but I think the default log path for CXSwatch is /var/log/cxswatch.log you should review the log and find which items / folders are continually being re-scanned over and over again and exclude them in /etc/cxs/cxs.ignore adding entries like:

file:/home/user/public_html/file.exe
file:/home/user/public_html/mmm5k/file1.tar.gz
file:/home/user/public_html/public/file18.zip

etc.

It will even give you warnings about this in the log, like:

Nov  1 12:30:25  cxswatch[2681356]: WARNING: '/home/user/public_html/domain.com/wp-content/cache/preload_permalink.txt' scanned 6 times in the last 30 seconds, you might want to ignore this resource

Cheers!

yogeshzade

@TheLinuxBug said:

@yogeshzade said:

@TheLinuxBug said:
Have you reviewed the logs? Generally this means you have some set of files that keep being uploaded / updated or a folder with large amounts of file changes which it keeps having to scan. If you check the logs for it, you should be able to see this and you can exclude specific folders/files in the cxs.conf file and restart cxswatch to calm some of the load you are seeing.

Cheers!

Is https://www.imunify360.com best ?

I have no idea what you are asking here, but I think the default log path for CXSwatch is /var/log/cxswatch.log you should review the log and find which items / folders are continually being re-scanned over and over again and exclude them in /etc/cxs/cxs.ignore adding entries like:

> file:/home/user/public_html/file.exe
> file:/home/user/public_html/mmm5k/file1.tar.gz
> file:/home/user/public_html/public/file18.zip
> 
> etc.
> 

It will even give you warnings about this in the log, like:

> Nov  1 12:30:25  cxswatch[2681356]: WARNING: '/home/user/public_html/domain.com/wp-content/cache/preload_permalink.txt' scanned 6 times in the last 30 seconds, you might want to ignore this resource
> 

Cheers!

Thank you so much for your detailed instructions. But I was asking you that instead of CXS I am thinking to go with https://www.imunify360.com, I believe there is only one way to reduce the server load.

TheLinuxBug

yogeshzade said: Thank you so much for your detailed instructions. But I was asking you that instead of CXS I am thinking to go with https://www.imunify360.com, I believe there is only one way to reduce the server load.

Well, seeing as we employ CXS on all of the cPanel shared servers we run at the company I work for and we don't seem to run into server load issues, unless what I suggested above is happening, I can't suggest another product as we haven't had a need to look for another solution. Generally, if you review and configure CXS correctly you shouldn't have any wild load issues caused by it. I would bet, as mentioned before, that you have some paths that have files constantly updating that you need to exclude and it would likely stop the load issue you are seeing.

Cheers!