Support

For your reference, the documentation for this feature is in https://www.akeeba.com/documentation/admin-tools-joomla/web-application-firewall.html#waf-configure-joomla-hardening under "Monitor Critical Files".

You can temporarily disable this feature instead of Admin Tools in its entirety. Don't throw the baby out with the bath water.

As per the documentation, the files being checked are index.php, administrator/index.php, configuration.php, and each of your site's templates' index.php, error.php and component.php files (not every template has all files).

Either whatever you are doing modifies one of these files even if only by updating its last modified date, or it messes up the #__admintools_storage table with the key criticalfiles which is where the information about these files is stored.

Frankly, I consider it unlikely that any of that happens because of the health check. I believe the health check simply exposed a problem in your configuration.

You basically have an application server cluster. How are the files synchronised between the cluster nodes? For example rsync by default does not update the last modified time; you have to explicitly use the -t option (yeah, I know…). If you have a cluster sharing a single database (naturally!), but each node has a different last modified time for its own copy of each file then this situation would cause the problem you described.

Let's say we have index.php in two nodes, Node A and Node B. The last modified time on Node A is 1730358773 and on Node B it is 1722399171; I'll shorten them as '773 and '171 for readability purposes. A request is made and it is handled by Node A. There is no saved information, so it reads the last modified time ('773) and saves it to the database. Another request is made, and it is handled by Node B. The database says the file's last modified time should be '773 but it is '171. An email is sent, and the database is updated with the '171 value. Another request comes in and it is handled by Node A again. The database says the last modified time should be '171 but it is '773. An email is sent, and the database is updated with the '773 value. And so on and so forth.

I have a suspicion that your load balancer wasn't working before, all requests were handled by the same server. When you added the health check it started making HTTP requests to your application server nodes. So, every time the health check runs it goes Node A, to Node B etc. That's why you get these periodic emails.

The correct solution is to sync your filesystems completely, including the last modified time, not because of Admin Tools, but because Joomla itself relies on the last modified time of certain files to operate correctly.

You're welcome! I am glad my approximately 20-year-old frustrations with rsync came to good use :)