Skip to main content

clamd high-cpu

katmai
hi, i've just setup a new server on AlmaLinux8, and i've noticed that clamav is sitting at around 650% of cpu. ran a strace on the process, but it doesn't look like it's doing much, there's not a lot of output going on, just a bunch of these: read(4, "\0", 1025) = 1 poll([{fd=4, events=POLLIN}], 1, 600000) = 1 ([{fd=4, revents=POLLIN}]) read(4, "\0", 1025) = 1 poll([{fd=4, events=POLLIN}, {fd=59, events=POLLIN}], 2, 30000) = 1 ([{fd=59, revents=POLLIN}]) recvmsg(59, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="SCAN /var/spool/exim/scan/1qvZKL"..., iov_len=4104}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 64 poll([{fd=4, events=POLLIN}], 1, 600000) = 1 ([{fd=4, revents=POLLIN}]) read(4, "\0", 1025) = 1 i've tried uninstalling, reinstalling, killing the process, but every time it just goes back again. i don't have any customizations made to it. fresh after uninstall / reinstall it went back to hogging the cpu. i'm not really sure how to proceed. anyone got a suggestion? thanks.

Comments

11 comments

Date Votes
  • cPRex Jurassic Moderator
    Hey there! Can you let us know a bit more about your server specs? It's normal for Clam to use resources, but not THAT many resources, but I'd like to hear more about the system before I provide some thoughts.
    0
  • katmai
    Hey there! Can you let us know a bit more about your server specs? It's normal for Clam to use resources, but not THAT many resources, but I'd like to hear more about the system before I provide some thoughts.

    it's an intel i7-7700 with 64 gb ram, 2 x 2 tb NVMe drives in raid1 software. it's the first time i see this.
    0
  • cPRex Jurassic Moderator
    Well that should be more than enough :D I would also expect you would need to be getting a large amount of email in order for this to happen, which you likely would have noticed. I really don't have any good ideas on this one as there haven't been similar reports. It would be worth submitting a ticket if you wanted us to check it out!
    0
  • katmai
    Well that should be more than enough :D I would also expect you would need to be getting a large amount of email in order for this to happen, which you likely would have noticed. I really don't have any good ideas on this one as there haven't been similar reports. It would be worth submitting a ticket if you wanted us to check it out!

    yeah i will submit a ticket. thanks.
    0
  • cPRex Jurassic Moderator
    Can you let me know that ticket number once you have it so I can follow along?
    0
  • katmai
    Can you let me know that ticket number once you have it so I can follow along?

    sure - #95143766
    0
  • cPRex Jurassic Moderator
    Thanks for that - I'm following along with that ticket now.
    0
  • cPRex Jurassic Moderator
    I see we disabled the "scan entire home directory option" and that freed up the resources. With over 1T of data on your /home disk, this was causing a large amount of CPU usage.
    0
  • Webdomain.com

    Hello,

    We are in the same boat on 1 server and tried everything the OP did as well as the suggested solution to disable the entire home directory scan.

    Is there any other thing to do to debug what is eating the whole cpu ressources by clams ?

    0
  • katmai

    i had the solution but i forgot to post.

    so apparently i had some extra enabled libraries which caused the high load.

    so go and uninstall completely clamav, then see if there's anything in the folder:

     /usr/local/cpanel/3rdparty/share/clamav

    i had foxhole_all.cdb and a few others. so delete the clamav folder, and then reinstall clamav and it all should come back to normal.

    cheers.

    0
  • Webdomain.com

    Thank you very much.

    I have ASSP Deluxe reinstalling those libraries each night but removing them fix the issue.

    0

Please sign in to leave a comment.

Didn't find what you were looking for?

New post