Knowledgebase

The root cause of the issue is a current known bug with the imjournal module for rsyslog that prevents it from logging properly, which then confuses lfd with the data being entered by the module.  More info on the bug here: https://bugzilla.redhat.com/show_bug.cgi?id=1088021

First step: reboot your server. This may clear up the issue. Note that only one reboot is necessary; if one reboot does not fix the problem, multiple subsequent reboots will not fix it either.

There are two options for resolution:

1. Set rsyslog to log the systemd journal messages to files instead of via syslog (recommended):
   • Edit /etc/rsyslogd.conf with your favorite editor, adjust the following:
     • Comment $ModLoad imjournal 
       
     • Comment $IMJournalStateFile imjournal.state
     • Change $OmitLocalLogging from "on" to "off"
     • Save the file
   • Restart rsyslogd with the following: /usr/local/cpanel/scripts/restartsrv rsyslogd
   • Confirm a success messagefrom the restart command
2. Disable syslog checking in LFD (not recommended, but easier; perform at your own risk):
   • Edit /etc/csf/csf.conf with yor favorite editor, adjust the following:
     
     • Change SYSLOG_CHECK  from 1 to 0
     • Save the file
   • Restart LFD with the following: systemctl restart lfd
   • Confirm a success from the restart command.