If root login alerts stop temporarily and then return later, this is usually due to cPFence automatically whitelisting root login IPs for 24 hours only.
After this period expires, the IP is removed from the automatic whitelist. If the same IP logs in again as root, a new alert may be generated.
To prevent repeated alerts for a trusted IP, please remove the IP from the whitelist manually and clear any pending tasks using the commands below:
cpfence --del-whitelist-ip Your-IP
atq | awk '{print $1}' | xargs atrm
cpfence --add-whitelist-ip Your-IP
This ensures that the IP address is correctly added to the allowlist permanently. Once completed, monitor the system to verify that the alerts have stopped.
