🔍 Find Sites Running Hetrix Monitoring (CloudLinux + CageFS + Imunify360)

By /

This guide shows how to identify users/sites running HetrixTools monitoring on a cPanel server using CloudLinux, CageFS, and Imunify360.

✅ Step 1: Locate hetrixtools Directories

Use the following command to search for HetrixTools-related directories in user accounts:

find /home -type d -name "hetrixtools"

This will return results like:

/home/user1/public_html/hetrixtools
/home/user2/hetrixtools

Each path helps you identify which cPanel users are using HetrixTools.

✅ Step 2: Check All Users’ Crontabs for HetrixTools References

This step scans user cronjobs for scheduled HetrixTools checks.

for u in $(cut -d: -f1 /etc/passwd); do crontab -l -u "$u" 2>/dev/null; done > /root/hetrixtools_crons.txt

Then search the file:

grep -i hetrixtools /root/hetrixtools_crons.txt

Output will look like:

*/5 * * * * /home/user1/hetrixtools/server_uptime.php

This confirms HetrixTools usage via cron.

✅ Step 3: Check CageFS Jail for HetrixTools Presence

To see which users have HetrixTools files within their jailed environment:

for u in $(ls /var/cagefs/); do find /var/cagefs/$u -type d -name "hetrixtools" 2>/dev/null; done

This works especially if users manually installed HetrixTools while jailed.

✅ Step 4: Imunify360 Considerations

If HetrixTools is using custom scripts or PHP scripts, Imunify360 may flag or rate-limit them.

You can check if any files are being quarantined:

imunify360-agent malware list | grep hetrixtools

To whitelist a false positive:

imunify360-agent malware ignore add --path /home/username/hetrixtools

🔒 Security Tips

  • Remove if Unused: If the script is no longer in use, remove the cronjob and directory to reduce attack surface.
  • Audit Regularly: Include hetrixtools checks in your monthly server audits.
  • Monitor Resource Use: HetrixTools cronjobs can be aggressive—ensure they don’t violate LVE limits under CloudLinux.
Scroll to Top