You are receiving such messages on your cPanel/CentOS server with CSF installed?

Time: Wed Aug 23 13:31:28 2017 -0500
Error: Failed to detect code [bBBeGfELFkMEGUV4fi] in SYSLOG_LOG [/var/log/messages]

SYSLOG may not be running correctly on server.example.com

These messages are sent by lfd(Login Failure Daemon- part of the Config Server Firewall CSF). It’s not an lfd issue. The issue is with the rsyslog. It is not logging correctly.

There are some options to fix this issue.

First make sure rsyslog is running. Use service rsyslog status command:

root@web [~]# service rsyslog status
Redirecting to /bin/systemctl status  rsyslog.service
* rsyslog.service - System Logging Service
   Loaded: loaded (/usr/lib/systemd/system/rsyslog.service; enabled; vendor preset: enabled)
   Active: active (running) since Sat 2017-08-19 07:39:49 EDT; 4 days ago
 Main PID: 207 (rsyslogd)
   CGroup: /system.slice/rsyslog.service
           `-207 /usr/sbin/rsyslogd -n

Aug 19 07:39:49 web systemd[1]: Starting System Logging Service...
Aug 19 07:39:49 web systemd[1]: Started System Logging Service.
root@web [~]#

If it’s not running, try to start it with service rsyslog start:

root@web [~]# service rsyslog status
Redirecting to /bin/systemctl status  rsyslog.service
* rsyslog.service - System Logging Service
   Loaded: loaded (/usr/lib/systemd/system/rsyslog.service; enabled; vendor preset: enabled)
   Active: inactive (dead) since Wed 2017-08-23 16:06:25 EDT; 7s ago
  Process: 4056 ExecStart=/usr/sbin/rsyslogd -n $SYSLOGD_OPTIONS (code=exited, status=0/SUCCESS)
 Main PID: 4056 (code=exited, status=0/SUCCESS)

Aug 23 16:06:13 web systemd[1]: Starting System Logging Service...
Aug 23 16:06:13 web systemd[1]: Started System Logging Service.
Aug 23 16:06:25 web systemd[1]: Stopping System Logging Service...
Aug 23 16:06:25 web systemd[1]: Stopped System Logging Service.
root@web [~]# service rsyslog start
Redirecting to /bin/systemctl start  rsyslog.service
root@web [~]# service rsyslog status
Redirecting to /bin/systemctl status  rsyslog.service
* rsyslog.service - System Logging Service
   Loaded: loaded (/usr/lib/systemd/system/rsyslog.service; enabled; vendor preset: enabled)
   Active: active (running) since Wed 2017-08-23 16:06:51 EDT; 4s ago
 Main PID: 4146 (rsyslogd)
   CGroup: /system.slice/rsyslog.service
           `-4146 /usr/sbin/rsyslogd -n

Aug 23 16:06:51 web systemd[1]: Starting System Logging Service...
Aug 23 16:06:51 web systemd[1]: Started System Logging Service.
root@web [~]#

Now, let’s check if rsyslog is logging correctly, log a test message:

root@web [~]# logger -p auth.notice "log test"
root@web [~]# grep "log test" /var/log/messages
root@web [~]#

If you don’t see your message rsyslog is not working correctly. To fix this you will need to edit the file /etc/rsyslog.conf. These lines must to commented out:

#$ModLoad imjournal # provides access to the systemd journal
#$IMJournalStateFile imjournal.state

and this option changed to off

$OmitLocalLogging off

Then restart the rsyslog with service rsyslog restart:

root@web [~]# service rsyslog restart
Redirecting to /bin/systemctl restart  rsyslog.service
root@web [~]#

Test again if the logging is working correctly:

root@web [~]# logger -p auth.notice "log test"
root@web [~]# grep "log test" /var/log/messages
Aug 23 16:09:06 web root: log test
root@web [~]#

Now, everything is running fine and you should not receive any more messages from lfd regarding rsyslog.

cPanel v66 is not using anymore a MySQL database for the cphulkd utility. cPHulk now uses SQLite. So, after upgrading to cPanel v66 you will receive a message saying:

The following MySQL database has been deprecated and is no longer used by cPanel & WHM.

Database Name	Database Username
cphulkd	cphulkd

You can delete this database and related database users at your leisure. To remove the MySQL database, see our documentation.

To delete the cphulkd database:

1. Login to WHM as root.
2. Navigate to SQL Services >> phpMyAdmin
3. On the left list click on the cphulkd entry (cphulkd database)
4. Now from top menu choose Operations tab
5. On the Remove database section, click on the Drop the database (DROP) link
6. Click OK button at the confirmation prompt: You are about to DESTROY a complete database! Do you really want to execute “DROP DATABASE `cphulkd`”?
7. The cphulkd database has been removed.

It’s always a good idea to keep your WHM/cPanel installation up-to-date. You can upgrade cPanel via the WHM interface or via the command line.

Upgrade cPanel via the WHM interface:

1. Connect to WHM as root user
2. Navigate to cPanel >> Upgrade to Latest Version
   
   
3. Click the Click to Upgrade button. Select the Force option if you want to reinstall WHM/cPanel.
   

   Forced Reinstall
   This feature allows you to force a reinstall of the cPanel & WHM software, regardless of whether WHM detects that your system is up-to-date. This can be useful if any files are corrupt and you wish to reinstall them.

4. The process will begin. At the end you will see a message Upgrade complete
   

The movie tutorial for this KB post:

You can also run a cPanel upgrade at the command line.Use:

root@web [~]# /scripts/upcp

and with the –force parameter:

root@web [~]# /scripts/upcp --force

The full output of the command is here cpanel upgrade command line output