Login Failure Daemon (lfd) is a process that runs all the time and periodically (every X seconds) scans the latest log file entries for login attempts against your server that continually fail within a short period of time. Such attempts are often called “Brute-force attacks” and the daemon process responds very quickly to such patterns and blocks offending IP’s quickly

====================================================
To check why lfd has failed look at the end of /var/log/lfd.log.
It may be because of csf installation.
There is a daemon called lfd bundled with csf.
So check whether the csf is installed in particular server.
check the csf.conf and disable the test mode.
restart.