i use csf on my server and get email lfd on server2.xxxxxx.com: Suspicious File Alert

Question

i use csf on my server and get emails every hour or less saying lfd on server2.xxxxxx.com: Suspicious File Alert

Time:   Tue Aug 14 17:43:00 2018 -0500
File:   /tmp/snappy-1.1.0.1-54deb2c7-ea57-4e5b-907e-5e04b216997f-libsnappyjava.so

Reason: Linux Binary
Owner:  confluence:confluence (1003:1005)
Action: No action taken

also another one

Time:   Tue Aug 14 17:42:59 2018 -0500
File:   /tmp/liblz4-java1107978496114223354.so
Reason: Linux Binary
Owner:  confluence:confluence (1003:1005)
Action: No action taken

why are they suspicious is this an issue can I delete those files in /tmp or even all the files in /tmp folder ?

this is a fresh install of confluence latest build from 2 days ago 8-11-2018

do these files need to exec:

or can i add a command in csf .Ignore process to stop the emails ?

if these files need to be in /tmp folder how can I avoid this headache of all the emails please

thanks for your help

TV Clipz · Answer

I disabled collaborative editing and I'm not getting any messages any longer.. thanks .Not a 100% solution in the overall but did 100% solve my email issues. :)  Thanks again .

Nic Brough -Adaptavist- · Answer

Heh, I just read a lot of scientific stuff, acronyms everywhere in that.

Two things about those files

* Yes, if Confluence put them there, then they're there for a good reason.
* But, I'd expect Confluence to use its own working space, not /tmp.  I've only ever seen Confluence put graph files in /tmp, after I told it to use it for generating stuff.  But that was Confluence 5.  I suspect it's more likely to be Synchrony doing it (the bundled, but independent service that handles collaborative editing in Confluence 6+), which I'm less sure what its normal behaviour would be.

I'd try disabling the collaborative editing for a while to confirm if it's Synchrony or not (you can do it in the ui)

TV Clipz · Answer

ConfigServer Security & Firewall (csf) the correct acronym .