Good afternoon everyone.

I'm looking for some in site on an error that I keep getting with my CentOS 5.3 / cPanel box with the Alpha security / monitoring. This issue has been going on for the past month (3 or 4 times a day).

I keep getting emails from the server with the title "lfd on server1.example.tdl failed" (ill remove my domain)

QUOTE
lfd failed @ Thu Oct 8 11:11:25 2009. A restart was attempted automagically.
Service Check Method: check command


So I've been watching the log and just cannot seem to figure out whats causing it to act up.

QUOTE
root@server1 [~]# vi /var/log/lfd.log
Oct 8 10:23:01 server1 lfd[4641]: *Performance* log parsing taking 53 seconds
Oct 8 10:37:01 server1 lfd[20131]: Incoming IP ***.***.***.*** temporary block removed
Oct 8 10:37:23 server1 lfd[20161]: *Port Scan* detected from ***.***.***.***. 11 hits in the last 131 seconds - *Blocked in csf* for 3600 secs
Oct 8 11:11:26 server1 lfd[27312]: daemon started on server1.example.tdl - csf v4.78 (cPanel)
Oct 8 11:11:26 server1 lfd[27312]: CSF Tracking...
Oct 8 11:11:26 server1 lfd[27312]: LOAD Tracking...
Oct 8 11:11:26 server1 lfd[27312]: System Integrity Tracking...
Oct 8 11:11:26 server1 lfd[27312]: Exploit Tracking...
Oct 8 11:11:26 server1 lfd[27312]: Directory Watching...
Oct 8 11:11:26 server1 lfd[27312]: Email Script Tracking...
Oct 8 11:11:26 server1 lfd[27312]: Email Relay Tracking...
Oct 8 11:11:26 server1 lfd[27312]: Port Scan Tracking...
Oct 8 11:11:26 server1 lfd[27312]: Account Tracking...
Oct 8 11:11:26 server1 lfd[27312]: User Process Tracking...
Oct 8 11:11:26 server1 lfd[27312]: WHM Tracking...
Oct 8 11:11:26 server1 lfd[27312]: Watching /var/log/maillog...
Oct 8 11:11:26 server1 lfd[27312]: Watching /var/log/exim_mainlog...
Oct 8 11:11:26 server1 lfd[27312]: Watching /var/log/messages...
Oct 8 11:11:26 server1 lfd[27312]: Watching /var/log/secure...
Oct 8 11:11:26 server1 lfd[27312]: Watching /usr/local/cpanel/logs/login_log...
Oct 8 11:11:26 server1 lfd[27312]: Watching /usr/local/apache/logs/error_log...
Oct 8 11:11:26 server1 lfd[27312]: Watching /usr/local/cpanel/logs/access_log..



Any idea's? It actually doesn't give me any warning or fail notice...

Thank you!