Increase the LFD 5-Minute Load Average Alert Threshold in CSF

Introduction

ConfigServer Security & Firewall (CSF) includes Login Failure Daemon (LFD), which monitors a server for various security and resource-related events. One of the conditions monitored by LFD is the server’s 5-minute load average.

By default, LFD can generate a high-load alert when the server load average exceeds the configured threshold. On servers with multiple CPU cores, a load value that appears high at first glance may not necessarily indicate an actual performance problem.

For example, a server with 10 CPU cores can generally handle a higher load average than a single-core server. If the default threshold is too low for a multi-core environment, administrators may receive frequent and unnecessary high-load email notifications.

This blog explains how to check the available CPU cores and increase the PT_LOAD_AVG threshold in CSF to suit the server’s CPU capacity.

Prerequisites

Before modifying the CSF configuration, ensure that you have:

• Root or sudo access to the server.
• CSF installed and configured on the server.
• LFD enabled and running.
• SSH access to the server.
• Basic knowledge of Linux command-line operations.
• A backup or copy of the existing CSF configuration.

You can verify that CSF is installed by running:

csf -v

You should also ensure that the LFD service is running before making configuration changes.

Implementation

Step 1: Check the Number of CPU Cores

First, determine how many CPU cores are available on the server.

Run:

nproc

For example:

[root@hostname ~]# nproc
10

The output indicates that the server has 10 CPU cores.

You can also use the following command for more detailed CPU information:

lscpu

Step 2: Check the Current Load Average

Before changing the threshold, check the current server load.

uptime

Example output:

09:30:15 up 25 days, 4:32,  2 users,  load average: 1.25, 1.10, 0.95

The three values represent the:

• 1-minute load average
• 5-minute load average
• 15-minute load average

Since LFD monitors the 5-minute load average for this alert, the second value is particularly relevant.

Step 3: Edit the CSF Configuration

Open the CSF configuration file:

vi /etc/csf/csf.conf

Locate the following configuration:

PT_LOAD_AVG = "5"

The default threshold may be set to 5.

If the server has 10 CPU cores, you can increase the threshold accordingly:

PT_LOAD_AVG = "10"

Save the configuration file after making the change.

Note: The threshold should be selected based on the server’s CPU capacity and workload. Simply matching the value to the number of CPU cores is a common approach, but it should not be treated as a universal performance rule.

Step 4: Restart CSF

After modifying the configuration, reload CSF so that the changes take effect:

csf -r

You can verify the configuration afterwards:

grep PT_LOAD_AVG /etc/csf/csf.conf

Expected output:

PT_LOAD_AVG = "10"

LFD will now use the updated threshold when monitoring the server’s 5-minute load average.

Architecture Diagram

The configuration flow can be represented as follows:

Conclusion

The PT_LOAD_AVG setting in CSF determines the load-average threshold used by LFD for high-load notifications. On servers with multiple CPU cores, the default threshold may be unnecessarily low and can result in frequent alerts.

By checking the server’s CPU capacity with:

nproc

and appropriately adjusting:

PT_LOAD_AVG = "10"

in:

/etc/csf/csf.conf

Administrators can make LFD’s load alerts more suitable for their server environment.

After modifying the configuration, reload CSF using:

csf -r

It is important to choose the threshold based not only on CPU count but also on the server’s normal workload and performance requirements.

FAQs

1. What is PT_LOAD_AVG in CSF?

PT_LOAD_AVG is a CSF configuration parameter that defines the load-average threshold used by LFD to detect high server load.

2. How can I check the number of CPU cores?

Run:

nproc

For more detailed CPU information, use:

lscpu

3. Where is the CSF configuration file located?

The main CSF configuration file is

/etc/csf/csf.conf

4. How do I change the LFD load-average threshold?

Edit the CSF configuration:

vi /etc/csf/csf.conf

Then update:

PT_LOAD_AVG = "5"

to your required value, for example:

PT_LOAD_AVG = "10"

5. How can I check the current load average?

Use:

uptime

or:

top

These commands display the server’s load averages.

Related Article

For more information about troubleshooting CSF/LFD configuration issues, refer to:

Error: LFD will not run with TESTING enabled in /etc/csf/csf.conf at line 83.

Read the related article

Talk to our experts

Looking for the right technology solution for your business? Our team of experts can help you with development, cloud, DevOps, design, and a wide range of other technology needs. Get in touch with our team here.