# Lfd on Server: Suspicious File Alert

**URL:** <https://discuss.elastic.co/t/lfd-on-server-suspicious-file-alert/279541>\
**Category:** Elasticsearch\
**Created:** [July 24, 2021, 6:41pm UTC](https://discuss.elastic.co/t/lfd-on-server-suspicious-file-alert/279541 "2021-07-24T18:41:46Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![NileYouth](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nileyouth/32/92086_2.png) [@NileYouth](https://discuss.elastic.co/u/NileYouth)\
**Post date:** [July 24, 2021, 6:41pm UTC](https://discuss.elastic.co/t/lfd-on-server-suspicious-file-alert/279541/1 "2021-07-24T18:41:46Z")

</div>

I have got many suspiction on CSF notfication can any one help in this or how can I exclode this files

```auto
Time: Sat Jul 24 20:25:39 2021 +0200
File: /tmp/systemd-private-07b3a323be3d4e5e9196051704fa4e9b-elasticsearch.service-HBYEvX/tmp/elasticsearch-6945169774004527476/jna7818653641099336736.tmp
Reason: Linux Binary
Owner: elasticsearch:elasticsearch (989:978)
Action: No action taken

```

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [July 26, 2021, 7:46am UTC](https://discuss.elastic.co/t/lfd-on-server-suspicious-file-alert/279541/2 "2021-07-26T07:46:18Z")

</div>

Can you add some more context of what a Lfd and a CSF is? This does not sound at all like anything Elasticsearch specific.

Where do you want to exclude this file from and why do you think that this is a problem? The JNA library within Elasticsearch needs to create a tmp file each time it is starting.

Thanks!

---

<div class="post-metadata">

**Author:** ![NileYouth](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nileyouth/32/92086_2.png) [@NileYouth](https://discuss.elastic.co/u/NileYouth)\
**Post date:** [July 26, 2021, 9:17am UTC](https://discuss.elastic.co/t/lfd-on-server-suspicious-file-alert/279541/3 "2021-07-26T09:17:30Z")

</div>

I need to Exclode this files from CSF I try may way but still got this susbiction massages so I need to exclode it from CSF I but this in

/etc/csf/csf.pignore

```auto
user:elasticsearch
exe:/usr/share/elasticsearch/modules/x-pack-ml/platform/linux-x86_64/bin/controller
cmd:/usr/share/elasticsearch/modules/x-pack-ml/platform/linux-x86_64/bin/controller

```

and /etc/csf/csf.fignore

```auto
user:elasticsearch
/tmp/systemd-private-[a-zA-Z0-9]+/tmp/elasticsearch-[\d\.]+/.tmp
/tmp/systemd-private-*-elasticsearch.service-*/tmp/elasticsearch-*.tmp

```

but dosn't exclode it from CSF Susbiction so can you help in this ?

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [July 26, 2021, 9:35am UTC](https://discuss.elastic.co/t/lfd-on-server-suspicious-file-alert/279541/4 "2021-07-26T09:35:44Z")

</div>

So this looks more like a CSF issue than an Elasticsearch problem then? You might be lucky and someone knows/recognizes CSF (which you still have not explained here, so I have no idea to be honest), but you are probably better off to ask in the product specific forum of CSF than here.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 23, 2021, 9:35am UTC](https://discuss.elastic.co/t/lfd-on-server-suspicious-file-alert/279541/5 "2021-08-23T09:35:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.