Sometimes it so happens that you login to the server and you see Real Time monitoring is disabled.

This is because the inotifywait process was killed on your server. We use inotify to monitor file changes.

One of the reasons for this is the CSF Firewall, which kills processes that are not listed under its allow list.

You can add:

exe:/usr/local/maldetect/inotify/inotifywait

to /etc/csf/csf.pignore and restart the firewall to tell CSF that inotifywait is OK to run.

Once this is done, re-enable real time monitoring and you should be good.

In case it fails again, please open a ticket with us and our Developers will identify and resolve the issue for you.