ConfigServer Community Forum

deleteme

I'm using the cPanel/WHM installation of ClamAV, and CXS can't seem to find the socket, even when I put the path to clamd in the cxs.defaults file.

I remember a while ago you had to uninstall the cPanel install and install ClamAV independently. Is that still the case?

I am seeing the error below when I go to ConfigServer eXploit Scanner in WHM:

Error trying to talk to ClamAV socket : Connection refused
You must install ClamAV (Clamavconnector on cPanel) or ensure clamd is running to use this product correctly

If the clamd socket is not automatically detected, and to clear this message, you must set clamdsock=/path/to/socket in /etc/cxs/cxs.defaults to the...

I just discovered that this account user sitolog refused to be scanned by CXS, it end task immediately, and this account is similar to many others....

/usr/sbin/cxs --quiet --report /var/log/cxstool.log --quarantine /home/quarantine --filemax 0 --exploitscan --mail admin@mydomain.fr --options mMOfSGchexdnwZDRu --sversionscan --bayes --virusscan --options MmhSGchednZRD --qoptions MfuhTEvU...

I need to exclude any files on the server with .xap extension.

I tried to use the following but does not seems to have any effect.

pfile:.*\.xap$

Hi, I am running a cron every night and am getting this email

cxs Scan on bla.com (Hits:1823) (Viruses:48) (Fingerprints:0)

----------- SCAN REPORT -----------

TimeStamp: Wed, 30 Nov 2016 00:00:09 -0500

(/usr/sbin/cxs --allusers --nobayes --clamdsock /var/clamd --defapache nobody --doptions Mv --exploitscan --nofallback --filemax 10000 --html --mail lagace.sebastien@gmail.com --options...

I have been using Linux for about 10 years now. I am having allot of problems more than the ordinary with this new apache update.
I have installed CXS about three months ago i have brought two licenses for my cpanel servers.

I have only performed one command so far that was all i seen when i first installed. This was the cxs --qcreate --quarantine /home/quarantine command. I am not sure what...

Hello
when i scan user in command i get this error:

Insecure dependency in chdir while running with -T switch at /usr/share/perl5/File/Find.pm line 876.

help?

Hi,

I'm hoping someone can help me determine what is being reported here... I have a default configuration of CXS, that was installed by configserver as part of the cPanel Server Service.

Scanning web upload script file...
Time : Mon Apr 20 06:13:19 2015 -0400
Web referer URL :
Local IP : 111.222.333.444
Web upload script user : nobody (99)
Web upload script owner: legitusername (600)
Web...

I'm getting a few log entries like this:

Sep 15 12:40:38 www cxswatch : WARNING: '/home/user/public_html/error_log' scanned 6 times in the last 30 seconds, you might want to ignore this resource

Any ideas what might cause this, or whether ignoring:
hfile:/public_html/error_log

is advisable for all? (Does cxs scan the log file?)

Thanks.

Hi,

I can't find Ignore button in CXS Explore Quarantine Files. How to make ignore button available again?

Thank you,

Kurniawan

Hi

This got blocked by CSF due to CXS block upload on ftp:

Oct 15 16:15:18 lin05 cxs : IP:1.2.3.4 User:hcjvregm FTP upload: - Regular expression match =

Trying to figure out why it did when the cxsftp.sh has the following:

/usr/sbin/cxs -Z --ftp --block --smtp --mail root --logfile /var/log/cxs.log --qoptions Mexv -I /etc/cxs/cxs.ignore --xtra /etc/cxs/cxs.xtra $1

It shows regular...

Anyone know why im getting Error: Bayes corpus not found errors?

My cxswatch.log contains lines with:

Oct 12 00:28:44 localhost cxswatch : TERM
Oct 12 00:28:44 localhost cxswatch : daemon stopped
Oct 12 00:28:44 localhost cxswatch : Startup...
Oct 12 00:28:44 localhost cxswatch : (/usr/sbin/cxs --allusers --baction high --bayes --breport medium --clamdsock /var/run/clamd.scan/clamd.sock...

I've started getting a report from chkservd multiple times per minute that our cxswatch service is down.

How can I troubleshoot this to see why it's crashing and fix it?

I can post the emailed report, if that helps.

Upgrading cxs from v6.17 to 6.18...
Retrieving new cxs installer...
Oops: Unable to open /usr/src/cxsinstaller.tgz.tmp: No such file or directory

I copied the example ignore file and renamed it cxs.ignore
and have added a rule in the file :

hdir:/public_html/wp-content/wflogs

but still in email i am getting this warning :

Aug 26 10:03:51 home cxswatch : WARNING: '/home/******/public_html/wp-content/wflogs/config.php' scanned 6 times in the last 30 seconds, you might want to ignore this resource
Aug 26 10:03:51 home cxswatch : Ignoring...

Hey Guys,

Quite a while ago now configserver ran their whole server service over my live server.
This included cxs.

Now... I'm getting notifications from the server all the time giving me an update.
I'd like these emails to be sent to a specific email address and I can't figure it out.

They're being sent to the original root email address that was set when the server (WHM) was setup.

The root...

Hi,

CXSwatch seems to have stopped sending emails across a number of servers in the last few days, I want to do some testing - is there a test exploit script that will trigger it?

Thanks,

Jacob

Hello,

I would like to disable notification emails from CXS, how can one do that?
cxs Scan on panel.uhlhosting.ch (Hits:0) (Viruses:0) (Fingerprints:0)