ConfigServer Community Forum

I'm getting a few log entries like this:

Sep 15 12:40:38 www cxswatch : WARNING: '/home/user/public_html/error_log' scanned 6 times in the last 30 seconds, you might want to ignore this resource

Any ideas what might cause this, or whether ignoring:
hfile:/public_html/error_log

is advisable for all? (Does cxs scan the log file?)

Thanks.

Anyone know why im getting Error: Bayes corpus not found errors?

My cxswatch.log contains lines with:

Oct 12 00:28:44 localhost cxswatch : TERM
Oct 12 00:28:44 localhost cxswatch : daemon stopped
Oct 12 00:28:44 localhost cxswatch : Startup...
Oct 12 00:28:44 localhost cxswatch : (/usr/sbin/cxs --allusers --baction high --bayes --breport medium --clamdsock /var/run/clamd.scan/clamd.sock...

I've started getting a report from chkservd multiple times per minute that our cxswatch service is down.

How can I troubleshoot this to see why it's crashing and fix it?

I can post the emailed report, if that helps.

I copied the example ignore file and renamed it cxs.ignore
and have added a rule in the file :

hdir:/public_html/wp-content/wflogs

but still in email i am getting this warning :

Aug 26 10:03:51 home cxswatch : WARNING: '/home/******/public_html/wp-content/wflogs/config.php' scanned 6 times in the last 30 seconds, you might want to ignore this resource
Aug 26 10:03:51 home cxswatch : Ignoring...

Hi,

CXSwatch seems to have stopped sending emails across a number of servers in the last few days, I want to do some testing - is there a test exploit script that will trigger it?

Thanks,

Jacob

Hello,

I would like to disable notification emails from CXS, how can one do that?
cxs Scan on panel.uhlhosting.ch (Hits:0) (Viruses:0) (Fingerprints:0)

Hello ,

We are trying to update CXS to the latest version .But when we try to update the cxs using the command #cxs -u it gives the following error :

=====================
Failed: Unable to download: 404 - Not Found
====================

We have tried using --force but still the issue persists .

Hello,

today when i try to run the scanner in my WHM i got this error

Unable to connect to clamd, virus scanning disabled

any help avaiable?

thks

I'm curious as to why CXS flags as outdated the current version of Joomla, and states that Joomla 3.6 is the current version. Joomla 3.6 is still in Release Candidate stage.

All the twentyfourteen in my server are detected as exploit.

Is true?

Content of the file

cxs : - Suspected exploit file

/**
* Twenty Fourteen Featured Content admin behavior: add a tag suggestion
* when changing the tag.
*/
/* global ajaxurl:true */

jQuery( document ).ready( function( $ ) {
$( '#customize-control-featured-content-tag-name input' ).suggest( ajaxurl +...

Hello,

clamd daemon is running as the clam user (member of group clam)

/home/*/public_html folders permissions are set as 0750/drwxr-x---

As such, cxs/clamd is unable to scan any public_html folders/files for viruses.

- Should I set o+x to the public_html folders? (insecure)
- Should I add my clam user to the nobody group? (the public_html folders group is set to nobody)

Has anybody...

Hello,

Is it possible to create an scan for a reseller and it's users?
You can manual select the users but i would be nice if you can select and Reseller and when they at an user it will be automatic added the to scan (like it is i you choice for all the users).

Thank you!

I have a public_html directory that has Joomla in it and than two sub directories with Wordpress in each. When I run cxs I get the following notice.

Known exploit = [PHP Wordpress Exploit ]

This file is an error log from Joomla.

Should I just ignore this one file? Is there something better to do?

Thanks,
Steve

Hello, is possible to install CXS on a non-cPanel server? Just to scan files on a CentOS (or any Linux) server via shell. No need interface.

Hi folks,
Quarantine works well enough against the clamav stuff, though question.

If I know a hacker is uploading a particular script, like one with this text I've added to extras now:
regall:POST\

Is there a way to tell quarantine to auto quarantine files with my specific signatures as well?

Something like an Other Files -> etc/cxs/cxs.autoquarantine
option would sure be nice. Your...

Hi
Can i add new Fingerprint not included in cxs scanner so any one will upload that shell will be quarantined as others
thanks in advance.

Hi.

On Centos 7, I cant start cxs service.

-rwxr-xr-x. 1 root root 111 feb 25 14:08 /etc/cxs/cxswatch.sh*
Also try
-rwxr-----. 1 root root 111 feb 25 14:08 /etc/cxs/cxswatch.sh*

-- Subject: Unit cxswatch.service has begun start-up
-- Defined-By: systemd
-- Support:
--
-- Unit cxswatch.service has begun starting up.
mar 09 07:14:46 srv108.tamainut.net systemd : Failed at step EXEC spawning...

hello

my cpanel server ip changed
After changing the IP of the server and change the IP license
Shell can not remove cxs
Shell has already been removed in less than 1 second shell, but now run loose, but not deleted

please help me for solve this problem ...

thanks ,

I have reported excess process running on my VPS resulting in clamd and Mysql termination frequently.

My web host has advised following:
===========================================
It is advised that it would be preferable to uninstall ClamAV since CXS is already installed on the server. The working of both the applications is the same hence it is suggested to uninstall the ClamAV. We would...