Trigger an action via CSF when server load is high on Server

Config Server Firewall works well by default. But if you customize it some, it can be even more poweful of a tool. When your load is high, you usually receive an alert from CSF. However, those reports contain a limited amount of information. If your receive these high server alerts often and want more information about what is actually going on when high load averages occur, then do the following. You can have lfd send you custom reports by using the PT_LOAD_ACTION option within the CSF configuration.First, login to shell.

Then create a file call /etc/csf/load.sh

touch /etc/csf/load.sh
nano /etc/csf.load.sh

Add the following contents to the file:

#!/bin/sh

>/etc/csf/csf.report

iostat -d 1 5 >> /etc/csf/csf.report

iostat -x -d 1 5 >> /etc/csf/csf.report

mpstat -P ALL >> /etc/csf/csf.report

top -b -n 1 >> /etc/csf/csf.report

netstat -autpn

mail -s “Load Report” root < /etc/csf/csf.report

Save the file.

Then, change the chmod settings of the file:

chmod +x /etc/csf/load.sh

Finally, edit /etc/csf/csf.conf and goto the section labeled “PT_LOAD_ACTION”. Add “/etc/csf/load.sh” so that it now looks like this:

PT_LOAD_ACTION = "/etc/csf/load.sh"

Restart csf:

csf -r

That’s it! Now when you receive a high CPU load alert, you will also receive an email with a lot more information in it. If you want CSF to automatically restart apache too, you can add the following line to the end of the load.sh file:

service httpd restart

And then save the file and restart config server.

Share this:

Trigger an action via CSF when server load is high on Server