Need help to switch to ClamAV server

Hi,

We've been able to get ClamAV Server and SpamAssassin Server running and now i would know how to switch all the virtual server we already have to use it.

Our goal is to lower IO ressources usage.

I will appreciate if you can point me to the right direction to do it as a batch.

Thank you

Status: 
Active

Comments

Howdy -- thanks for contacting us!

If you go into List Virtual Servers on the bottom left of Virtualmin, you can use that to update the available features in multiple domains all at once.

If i understand correctly, i need to disable virus and spam filtering for a first update and enable it back for a second update?

Do you know how much time it could take for 300 domains? (i know it depend on available ressources but do we talk about seconds, minutes or hours?

Thanks again

Hmm, in theory it'd just be a matter of selecting the domains in question (possibly all of them in this case), then going into Enable Feature Change, and there selecting "Enable" for the Spam and Virus filtering features.

Let us know if you're seeing a problem with that though!

I unfortunately don't know how long to expect it to take, but I wouldn't think it'd take longer than a minute or two.

Perfect, i'll wait and test it this evening.

Thanks again

Unhapilly, i've been able to do what you suggested me and it worked but clamscan and clamd continu to use all my cpu ressources.

Please can you help me with this? Maybe take a look at it?

I will really appreciate because this is a serious problem now and i have tons of customers that are complaning.

Thanks in advance

Can you describe the problem(s) that you're seeing?

Also, what is the output of these commands:

uptime
mailq | tail -1
free -m
ps auxwf

Lastly, what is Email Messages -> Spam and Virus Scanning -> Virus Scanning Program set to?

Also, note that I think I initially misunderstood the problem you were looking to solve, and I don't think my earlier comments helped with what you were asking for. Sorry for that.

But, the above (Comment #6) will help us better understand the issue you're describing.

[root@gestionminute1 ~]# uptime
19:07:10 up 8 days, 20:59,  2 users,  load average: 1.97, 2.18, 2.31

[root@gestionminute1 ~]# mailq | tail -1
-- 182 Kbytes in 3 Requests.

[root@gestionminute1 ~]# free -m
              total        used        free      shared  buff/cache   available
Mem:         257753       33468       45128        6864      179157      215668
Swap:         12279          98       12181

[root@gestionminute1 ~]# ps auxwf
USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root         2  0.0  0.0      0     0 ?        S    Jun29   0:02 [kthreadd]
root         3  0.0  0.0      0     0 ?        S    Jun29   0:44  \_ [ksoftirqd/0]
root         5  0.0  0.0      0     0 ?        S<   Jun29   0:00  \_ [kworker/0:0H]
root         6  0.0  0.0      0     0 ?        S    Jun29   0:02  \_ [kworker/u48:0]
root         8  0.0  0.0      0     0 ?        S    Jun29   4:47  \_ [migration/0]
root         9  0.0  0.0      0     0 ?        S    Jun29   0:00  \_ [rcu_bh]
root        10  0.3  0.0      0     0 ?        S    Jun29  50:32  \_ [rcu_sched]
root        11  0.0  0.0      0     0 ?        S<   Jun29   0:00  \_ [lru-add-drain]
root        12  0.0  0.0      0     0 ?        S    Jun29   0:17  \_ [watchdog/0]
root        13  0.0  0.0      0     0 ?        S    Jun29   0:13  \_ [watchdog/1]
root        14  0.0  0.0      0     0 ?        S    Jun29   4:38  \_ [migration/1]
root        15  0.0  0.0      0     0 ?        S    Jun29   2:37  \_ [ksoftirqd/1]
root        17  0.0  0.0      0     0 ?        S<   Jun29   0:00  \_ [kworker/1:0H]
root        18  0.0  0.0      0     0 ?        S    Jun29   0:18  \_ [watchdog/2]
root        19  0.0  0.0      0     0 ?        S    Jun29   3:41  \_ [migration/2]
root        20  0.0  0.0      0     0 ?        S    Jun29   0:39  \_ [ksoftirqd/2]
root        22  0.0  0.0      0     0 ?        S<   Jun29   0:00  \_ [kworker/2:0H]
root        23  0.0  0.0      0     0 ?        S    Jun29   0:12  \_ [watchdog/3]
root        24  0.0  0.0      0     0 ?        S    Jun29   3:42  \_ [migration/3]
root        25  0.0  0.0      0     0 ?        S    Jun29   0:15  \_ [ksoftirqd/3]
root        27  0.0  0.0      0     0 ?        S<   Jun29   0:00  \_ [kworker/3:0H]
root        28  0.0  0.0      0     0 ?        S    Jun29   0:15  \_ [watchdog/4]
root        29  0.0  0.0      0     0 ?        S    Jun29   3:50  \_ [migration/4]
root        30  0.0  0.0      0     0 ?        S    Jun29   0:25  \_ [ksoftirqd/4]
root        32  0.0  0.0      0     0 ?        S<   Jun29   0:00  \_ [kworker/4:0H]
root        33  0.0  0.0      0     0 ?        S    Jun29   0:14  \_ [watchdog/5]
root        34  0.0  0.0      0     0 ?        S    Jun29   3:46  \_ [migration/5]
root        35  0.0  0.0      0     0 ?        S    Jun29   0:11  \_ [ksoftirqd/5]
root        37  0.0  0.0      0     0 ?        S<   Jun29   0:00  \_ [kworker/5:0H]
root        38  0.0  0.0      0     0 ?        S    Jun29   0:13  \_ [watchdog/6]
root        39  0.0  0.0      0     0 ?        S    Jun29   2:21  \_ [migration/6]
root        40  0.0  0.0      0     0 ?        S    Jun29   0:17  \_ [ksoftirqd/6]
root        42  0.0  0.0      0     0 ?        S<   Jun29   0:00  \_ [kworker/6:0H]
root        44  0.0  0.0      0     0 ?        S    Jun29   0:10  \_ [watchdog/7]
root        45  0.0  0.0      0     0 ?        S    Jun29   1:44  \_ [migration/7]
root        46  0.0  0.0      0     0 ?        S    Jun29   0:15  \_ [ksoftirqd/7]
root        48  0.0  0.0      0     0 ?        S<   Jun29   0:00  \_ [kworker/7:0H]
root        49  0.0  0.0      0     0 ?        S    Jun29   0:11  \_ [watchdog/8]
root        50  0.0  0.0      0     0 ?        S    Jun29   1:43  \_ [migration/8]
root        51  0.0  0.0      0     0 ?        S    Jun29   0:15  \_ [ksoftirqd/8]
root        53  0.0  0.0      0     0 ?        S<   Jun29   0:00  \_ [kworker/8:0H]
root        54  0.0  0.0      0     0 ?        S    Jun29   0:10  \_ [watchdog/9]
root        55  0.0  0.0      0     0 ?        S    Jun29   1:37  \_ [migration/9]
root        56  0.0  0.0      0     0 ?        S    Jun29   0:16  \_ [ksoftirqd/9]
root        58  0.0  0.0      0     0 ?        S<   Jun29   0:00  \_ [kworker/9:0H]
root        59  0.0  0.0      0     0 ?        S    Jun29   0:09  \_ [watchdog/10]
root        60  0.0  0.0      0     0 ?        S    Jun29   1:37  \_ [migration/10]
root        61  0.0  0.0      0     0 ?        S    Jun29   0:16  \_ [ksoftirqd/10]
root        63  0.0  0.0      0     0 ?        S<   Jun29   0:00  \_ [kworker/10:0H]
root        64  0.0  0.0      0     0 ?        S    Jun29   0:08  \_ [watchdog/11]
root        65  0.0  0.0      0     0 ?        S    Jun29   1:38  \_ [migration/11]
root        66  0.0  0.0      0     0 ?        S    Jun29   0:16  \_ [ksoftirqd/11]
root        68  0.0  0.0      0     0 ?        S<   Jun29   0:00  \_ [kworker/11:0H]
root        69  0.0  0.0      0     0 ?        S    Jun29   0:14  \_ [watchdog/12]
root        70  0.0  0.0      0     0 ?        S    Jun29   3:22  \_ [migration/12]
root        71  0.0  0.0      0     0 ?        S    Jun29   0:08  \_ [ksoftirqd/12]
root        73  0.0  0.0      0     0 ?        S<   Jun29   0:00  \_ [kworker/12:0H]
root        74  0.0  0.0      0     0 ?        S    Jun29   0:12  \_ [watchdog/13]
root        75  0.0  0.0      0     0 ?        S    Jun29   2:42  \_ [migration/13]
root        76  0.0  0.0      0     0 ?        S    Jun29   0:21  \_ [ksoftirqd/13]
root        78  0.0  0.0      0     0 ?        S<   Jun29   0:00  \_ [kworker/13:0H]
root        79  0.0  0.0      0     0 ?        S    Jun29   0:07  \_ [watchdog/14]
root        80  0.0  0.0      0     0 ?        S    Jun29   2:43  \_ [migration/14]
root        81  0.0  0.0      0     0 ?        S    Jun29   1:11  \_ [ksoftirqd/14]
root        83  0.0  0.0      0     0 ?        S<   Jun29   0:00  \_ [kworker/14:0H]
root        84  0.0  0.0      0     0 ?        S    Jun29   0:12  \_ [watchdog/15]
root        85  0.0  0.0      0     0 ?        S    Jun29   2:40  \_ [migration/15]
root        86  0.0  0.0      0     0 ?        S    Jun29   0:14  \_ [ksoftirqd/15]
root        88  0.0  0.0      0     0 ?        S<   Jun29   0:00  \_ [kworker/15:0H]
root        89  0.0  0.0      0     0 ?        S    Jun29   0:19  \_ [watchdog/16]
root        90  0.0  0.0      0     0 ?        S    Jun29   2:43  \_ [migration/16]
root        91  0.0  0.0      0     0 ?        S    Jun29   0:09  \_ [ksoftirqd/16]
root        93  0.0  0.0      0     0 ?        S<   Jun29   0:00  \_ [kworker/16:0H]
root        94  0.0  0.0      0     0 ?        S    Jun29   0:14  \_ [watchdog/17]
root        95  0.0  0.0      0     0 ?        S    Jun29   2:37  \_ [migration/17]
root        96  0.0  0.0      0     0 ?        S    Jun29   0:14  \_ [ksoftirqd/17]
root        98  0.0  0.0      0     0 ?        S<   Jun29   0:00  \_ [kworker/17:0H]
root        99  0.0  0.0      0     0 ?        S    Jun29   0:13  \_ [watchdog/18]
root       100  0.0  0.0      0     0 ?        S    Jun29   1:36  \_ [migration/18]
root       101  0.0  0.0      0     0 ?        S    Jun29   0:07  \_ [ksoftirqd/18]
root       103  0.0  0.0      0     0 ?        S<   Jun29   0:00  \_ [kworker/18:0H]
root       104  0.0  0.0      0     0 ?        S    Jun29   0:10  \_ [watchdog/19]
root       105  0.0  0.0      0     0 ?        S    Jun29   1:33  \_ [migration/19]
root       106  0.0  0.0      0     0 ?        S    Jun29   0:23  \_ [ksoftirqd/19]
root       108  0.0  0.0      0     0 ?        S<   Jun29   0:00  \_ [kworker/19:0H]
root       109  0.0  0.0      0     0 ?        S    Jun29   0:09  \_ [watchdog/20]
root       110  0.0  0.0      0     0 ?        S    Jun29   1:18  \_ [migration/20]
root       111  0.0  0.0      0     0 ?        S    Jun29   0:16  \_ [ksoftirqd/20]
root       113  0.0  0.0      0     0 ?        S<   Jun29   0:00  \_ [kworker/20:0H]
root       114  0.0  0.0      0     0 ?        S    Jun29   0:10  \_ [watchdog/21]
root       115  0.0  0.0      0     0 ?        S    Jun29   1:12  \_ [migration/21]
root       116  0.0  0.0      0     0 ?        S    Jun29   0:11  \_ [ksoftirqd/21]
root       118  0.0  0.0      0     0 ?        S<   Jun29   0:00  \_ [kworker/21:0H]
root       119  0.0  0.0      0     0 ?        S    Jun29   0:10  \_ [watchdog/22]
root       120  0.0  0.0      0     0 ?        S    Jun29   1:13  \_ [migration/22]
root       121  0.0  0.0      0     0 ?        S    Jun29   0:09  \_ [ksoftirqd/22]
root       123  0.0  0.0      0     0 ?        S<   Jun29   0:00  \_ [kworker/22:0H]
root       124  0.0  0.0      0     0 ?        S    Jun29   0:11  \_ [watchdog/23]
root       125  0.0  0.0      0     0 ?        S    Jun29   1:13  \_ [migration/23]
root       126  0.0  0.0      0     0 ?        S    Jun29   0:08  \_ [ksoftirqd/23]
root       128  0.0  0.0      0     0 ?        S<   Jun29   0:00  \_ [kworker/23:0H]
root       131  0.0  0.0      0     0 ?        S    Jun29   0:00  \_ [kdevtmpfs]
root       132  0.0  0.0      0     0 ?        S<   Jun29   0:00  \_ [netns]
root       133  0.0  0.0      0     0 ?        S    Jun29   0:01  \_ [khungtaskd]
root       134  0.0  0.0      0     0 ?        S<   Jun29   0:00  \_ [writeback]
root       135  0.0  0.0      0     0 ?        S<   Jun29   0:00  \_ [kintegrityd]
root       136  0.0  0.0      0     0 ?        S<   Jun29   0:00  \_ [bioset]
root       137  0.0  0.0      0     0 ?        S<   Jun29   0:00  \_ [bioset]
root       138  0.0  0.0      0     0 ?        S<   Jun29   0:00  \_ [bioset]
root       139  0.0  0.0      0     0 ?        S<   Jun29   0:00  \_ [kblockd]
root       140  0.0  0.0      0     0 ?        S<   Jun29   0:00  \_ [md]
root       141  0.0  0.0      0     0 ?        S<   Jun29   0:00  \_ [edac-poller]
root       142  0.0  0.0      0     0 ?        S<   Jun29   0:00  \_ [watchdogd]
root       149  0.1  0.0      0     0 ?        S    Jun29  15:27  \_ [kswapd0]
root       150  0.0  0.0      0     0 ?        S    Jun29   9:07  \_ [kswapd1]
root       151  0.0  0.0      0     0 ?        SN   Jun29   0:00  \_ [ksmd]
root       152  0.0  0.0      0     0 ?        SN   Jun29   0:12  \_ [khugepaged]
root       153  0.0  0.0      0     0 ?        S<   Jun29   0:00  \_ [crypto]
root       161  0.0  0.0      0     0 ?        S<   Jun29   0:00  \_ [kthrotld]
root       165  0.0  0.0      0     0 ?        S<   Jun29   0:00  \_ [kmpath_rdacd]
root       166  0.0  0.0      0     0 ?        S<   Jun29   0:00  \_ [kaluad]
root       167  0.0  0.0      0     0 ?        S<   Jun29   0:00  \_ [kpsmoused]
root       169  0.0  0.0      0     0 ?        S<   Jun29   0:00  \_ [ipv6_addrconf]
root       182  0.0  0.0      0     0 ?        S<   Jun29   0:00  \_ [deferwq]
root       183  0.0  0.0      0     0 ?        S    Jun29   0:13  \_ [kworker/u48:1]
root       218  0.0  0.0      0     0 ?        S    Jun29   1:32  \_ [kauditd]
root      1704  0.0  0.0      0     0 ?        S<   Jun29   0:00  \_ [ata_sff]
root      2091  0.0  0.0      0     0 ?        S    Jun29   0:00  \_ [scsi_eh_0]
root      2092  0.0  0.0      0     0 ?        S<   Jun29   0:00  \_ [scsi_tmf_0]
root      2096  0.0  0.0      0     0 ?        S    Jun29   0:00  \_ [scsi_eh_1]
root      2099  0.0  0.0      0     0 ?        S<   Jun29   0:00  \_ [scsi_tmf_1]
root      2100  0.0  0.0      0     0 ?        S    Jun29   0:00  \_ [scsi_eh_2]
root      2101  0.0  0.0      0     0 ?        S<   Jun29   0:00  \_ [scsi_tmf_2]
root      2113  0.0  0.0      0     0 ?        S    Jun29   0:00  \_ [scsi_eh_3]
root      2115  0.0  0.0      0     0 ?        S<   Jun29   0:00  \_ [scsi_tmf_3]
root      2117  0.0  0.0      0     0 ?        S    Jun29   0:00  \_ [scsi_eh_4]
root      2119  0.0  0.0      0     0 ?        S<   Jun29   0:00  \_ [scsi_tmf_4]
root      2120  0.0  0.0      0     0 ?        S    Jun29   0:00  \_ [scsi_eh_5]
root      2135  0.0  0.0      0     0 ?        S<   Jun29   0:00  \_ [scsi_tmf_5]
root      2210  0.0  0.0      0     0 ?        S    Jun29   0:00  \_ [scsi_eh_6]
root      2212  0.0  0.0      0     0 ?        S<   Jun29   0:00  \_ [scsi_tmf_6]
root      2238  0.0  0.0      0     0 ?        S<   Jun29   0:00  \_ [scsi_wq_6]
root      2873  0.0  0.0      0     0 ?        S<   Jun29   0:00  \_ [ttm_swap]
root      6902  0.0  0.0      0     0 ?        S<   Jun29   0:00  \_ [bioset]
root      6904  0.0  0.0      0     0 ?        S<   Jun29   0:00  \_ [bioset]
root      6905  0.0  0.0      0     0 ?        S    Jun29   0:36  \_ [md1_raid1]
root      6908  0.0  0.0      0     0 ?        S<   Jun29   0:58  \_ [kworker/8:1H]
root      6909  0.0  0.0      0     0 ?        S<   Jun29   0:00  \_ [bioset]
root      6910  0.0  0.0      0     0 ?        S<   Jun29   0:00  \_ [bioset]
root      6912  0.0  0.0      0     0 ?        S    Jun29   0:01  \_ [md0_raid1]
root      6914  0.0  0.0      0     0 ?        S<   Jun29   0:00  \_ [bioset]
root      6915  0.0  0.0      0     0 ?        S<   Jun29   0:00  \_ [bioset]
root      6916  0.5  0.0      0     0 ?        S    Jun29  64:44  \_ [md2_raid1]
root      6917  0.0  0.0      0     0 ?        S<   Jun29   0:58  \_ [kworker/9:1H]
root      6918  0.0  0.0      0     0 ?        S<   Jun29   0:59  \_ [kworker/6:1H]
root      6919  0.0  0.0      0     0 ?        S<   Jun29   0:15  \_ [kworker/0:1H]
root      6922  0.0  0.0      0     0 ?        S<   Jun29   0:59  \_ [kworker/10:1H]
root      6936  0.0  0.0      0     0 ?        S<   Jun29   0:08  \_ [kworker/20:1H]
root      6939  0.0  0.0      0     0 ?        S<   Jun29   0:28  \_ [kworker/3:1H]
root      6975  0.4  0.0      0     0 ?        S    Jun29  62:16  \_ [jbd2/md2-8]
root      6976  0.0  0.0      0     0 ?        S<   Jun29   0:00  \_ [ext4-rsv-conver]
root      7068  0.0  0.0      0     0 ?        S<   Jun29   0:03  \_ [kworker/12:1H]
root      7069  0.2  0.0      0     0 ?        S<   Jun29  30:51  \_ [kworker/1:1H]
root      7070  0.0  0.0      0     0 ?        S<   Jun29   0:08  \_ [kworker/22:1H]
root      7085  0.0  0.0      0     0 ?        S<   Jun29   0:39  \_ [kworker/2:1H]
root      7092  0.0  0.0      0     0 ?        S<   Jun29   0:08  \_ [kworker/21:1H]
root      8788  0.0  0.0      0     0 ?        SN   Jun29   0:00  \_ [kipmi0]
root     10189  0.0  0.0      0     0 ?        S<   Jun29   0:00  \_ [kvm-irqfd-clean]
root     13722  0.0  0.0      0     0 ?        S    Jun29   0:00  \_ [jbd2/md0-8]
root     13723  0.0  0.0      0     0 ?        S<   Jun29   0:00  \_ [ext4-rsv-conver]
root     13871  0.0  0.0      0     0 ?        S<   Jun29   0:21  \_ [kworker/4:1H]
root     13879  0.0  0.0      0     0 ?        S<   Jun29   0:08  \_ [kworker/23:1H]
root     13884  0.0  0.0      0     0 ?        S<   Jun29   0:18  \_ [kworker/5:1H]
root     13885  0.0  0.0      0     0 ?        S<   Jun29   0:09  \_ [kworker/19:1H]
root     13977  0.0  0.0      0     0 ?        S<   Jun29   0:58  \_ [kworker/11:1H]
root     14000  0.0  0.0      0     0 ?        S<   Jun29   0:01  \_ [kworker/17:1H]
root     16149  0.0  0.0      0     0 ?        S<   Jun29   0:05  \_ [kworker/13:1H]
root     16483  0.0  0.0      0     0 ?        S<   Jun29   0:57  \_ [kworker/7:1H]
root     16514  0.0  0.0      0     0 ?        S<   Jun29   0:08  \_ [kworker/18:1H]
root     30679  0.0  0.0      0     0 ?        S<   Jun29   0:03  \_ [kworker/15:1H]
root       586  0.0  0.0      0     0 ?        S<   Jun29   0:01  \_ [kworker/16:1H]
root      1621  0.0  0.0      0     0 ?        S<   Jun29   0:03  \_ [kworker/14:1H]
root     25888  0.3  0.0      0     0 ?        S<   Jun30  46:40  \_ [hcp_watchdog]
root     29152  0.0  0.0      0     0 ?        S    11:08   0:00  \_ [kworker/3:0]
root      1096  0.0  0.0      0     0 ?        S    14:25   0:00  \_ [kworker/17:1]
root       570  0.0  0.0      0     0 ?        S    15:10   0:00  \_ [kworker/4:0]
root     24129  0.0  0.0      0     0 ?        S    15:20   0:00  \_ [kworker/1:0]
root      9561  0.0  0.0      0     0 ?        S    15:29   0:00  \_ [kworker/22:0]
root     23684  0.0  0.0      0     0 ?        S    15:35   0:00  \_ [kworker/15:2]
root     30902  0.0  0.0      0     0 ?        S    15:38   0:00  \_ [kworker/23:0]
root     25287  0.0  0.0      0     0 ?        S    16:35   0:00  \_ [kworker/5:1]
root     20023  0.0  0.0      0     0 ?        S    16:58   0:00  \_ [kworker/8:2]
root     17414  0.0  0.0      0     0 ?        S    17:08   0:00  \_ [kworker/2:1]
root     26871  0.0  0.0      0     0 ?        S    17:14   0:00  \_ [kworker/u49:0]
root      7768  0.0  0.0      0     0 ?        S    17:23   0:00  \_ [kworker/19:0]
root     16522  0.0  0.0      0     0 ?        S    17:29   0:00  \_ [kworker/u50:0]
root     17758  0.0  0.0      0     0 ?        S    17:30   0:00  \_ [kworker/0:2]
root     31703  0.0  0.0      0     0 ?        S    17:38   0:00  \_ [kworker/10:2]
root      6810  0.0  0.0      0     0 ?        S    17:43   0:00  \_ [kworker/11:0]
root      7084  0.0  0.0      0     0 ?        S    17:43   0:00  \_ [kworker/20:0]
root     31181  0.0  0.0      0     0 ?        S    17:58   0:00  \_ [kworker/6:2]
root     27448  0.0  0.0      0     0 ?        S    18:11   0:00  \_ [kworker/21:2]
root     32359  0.0  0.0      0     0 ?        S    18:15   0:00  \_ [kworker/16:0]
root      6441  0.0  0.0      0     0 ?        S    18:19   0:00  \_ [kworker/13:2]
root      6753  0.0  0.0      0     0 ?        S    18:20   0:00  \_ [kworker/12:2]
root      8208  0.0  0.0      0     0 ?        S    18:21   0:00  \_ [kworker/u50:2]
root     32638  0.0  0.0      0     0 ?        S    18:38   0:00  \_ [kworker/7:1]
root      1888  0.0  0.0      0     0 ?        S    18:40   0:00  \_ [kworker/9:0]
root      1910  0.0  0.0      0     0 ?        S    18:40   0:00  \_ [kworker/14:2]
root      7024  0.0  0.0      0     0 ?        S    18:43   0:00  \_ [kworker/12:1]
root      7240  0.0  0.0      0     0 ?        S    18:43   0:00  \_ [kworker/18:0]
root     12016  0.0  0.0      0     0 ?        S    18:47   0:00  \_ [kworker/u49:1]
root     16597  0.0  0.0      0     0 ?        S    18:50   0:00  \_ [kworker/1:1]
root     21089  0.0  0.0      0     0 ?        S    18:53   0:00  \_ [kworker/7:0]
root     21167  0.0  0.0      0     0 ?        S    18:53   0:00  \_ [kworker/23:2]
root     21192  0.0  0.0      0     0 ?        S    18:53   0:00  \_ [kworker/20:1]
root     21265  0.0  0.0      0     0 ?        S    18:53   0:00  \_ [kworker/15:0]
root     21331  0.0  0.0      0     0 ?        S    18:53   0:00  \_ [kworker/4:1]
root     22862  0.0  0.0      0     0 ?        S    18:55   0:00  \_ [kworker/17:0]
root     23239  0.0  0.0      0     0 ?        S    18:55   0:00  \_ [kworker/14:1]
root     23338  0.0  0.0      0     0 ?        S    18:55   0:00  \_ [kworker/10:1]
root     27338  0.0  0.0      0     0 ?        S    18:58   0:00  \_ [kworker/13:0]
root     27383  0.0  0.0      0     0 ?        S    18:58   0:00  \_ [kworker/22:1]
root     27443  0.0  0.0      0     0 ?        S    18:58   0:00  \_ [kworker/8:1]
root     27523  0.0  0.0      0     0 ?        S    18:58   0:00  \_ [kworker/21:1]
root     27561  0.0  0.0      0     0 ?        S    18:58   0:00  \_ [kworker/19:2]
root     27607  0.0  0.0      0     0 ?        S    18:58   0:00  \_ [kworker/11:2]
root     27654  0.0  0.0      0     0 ?        S    18:58   0:00  \_ [kworker/5:2]
root     27701  0.0  0.0      0     0 ?        S    18:58   0:00  \_ [kworker/16:2]
root     27878  0.0  0.0      0     0 ?        S    18:58   0:00  \_ [kworker/3:1]
root     28638  0.0  0.0      0     0 ?        S    18:59   0:00  \_ [kworker/0:0]
root     29550  0.0  0.0      0     0 ?        S    19:00   0:00  \_ [kworker/2:0]
root     29600  0.0  0.0      0     0 ?        S    19:00   0:00  \_ [kworker/6:1]
root     29933  0.0  0.0      0     0 ?        S    19:00   0:00  \_ [kworker/18:2]
root     31040  0.0  0.0      0     0 ?        S    19:00   0:00  \_ [kworker/9:1]
root      8333  0.0  0.0      0     0 ?        S    19:03   0:00  \_ [kworker/23:1]
root      8351  0.0  0.0      0     0 ?        S    19:03   0:00  \_ [kworker/20:2]
root      8358  0.0  0.0      0     0 ?        S    19:03   0:00  \_ [kworker/4:2]
root      8392  0.0  0.0      0     0 ?        S    19:03   0:00  \_ [kworker/u49:2]
root      8396  0.0  0.0      0     0 ?        S    19:03   0:00  \_ [kworker/1:2]
root      8429  0.0  0.0      0     0 ?        S    19:03   0:00  \_ [kworker/10:0]
root      8444  0.0  0.0      0     0 ?        S    19:03   0:00  \_ [kworker/7:2]
root      8513  0.0  0.0      0     0 ?        S    19:03   0:00  \_ [kworker/15:1]
root      8540  0.0  0.0      0     0 ?        S    19:03   0:00  \_ [kworker/14:0]
root      8567  0.0  0.0      0     0 ?        S    19:03   0:00  \_ [kworker/13:1]
root      8716  0.0  0.0      0     0 ?        S    19:03   0:00  \_ [kworker/8:0]
root      8756  0.0  0.0      0     0 ?        S    19:03   0:00  \_ [kworker/19:1]
root      8828  0.0  0.0      0     0 ?        S    19:03   0:00  \_ [kworker/5:0]
root      8855  0.0  0.0      0     0 ?        S    19:03   0:00  \_ [kworker/11:1]
root      9040  0.0  0.0      0     0 ?        S    19:03   0:00  \_ [kworker/u50:1]
root     10045  0.0  0.0      0     0 ?        S    19:05   0:00  \_ [kworker/17:2]
root     10226  0.0  0.0      0     0 ?        S    19:05   0:00  \_ [kworker/16:1]
root     10256  0.0  0.0      0     0 ?        S    19:05   0:00  \_ [kworker/21:0]
root     10537  0.0  0.0      0     0 ?        S    19:05   0:00  \_ [kworker/9:2]
root         1  0.4  0.0 191428  4168 ?        Ss   Jun29  57:04 /usr/lib/systemd/systemd --system --deserialize 22
root      7050  0.4  0.0 223996 136612 ?       Ss   Jun29  61:10 /usr/lib/systemd/systemd-journald
root     13739  0.0  0.0  55520  1072 ?        S<sl Jun29   4:43 /sbin/auditd
dbus     13766  0.4  0.0  63460  6216 ?        Ss   Jun29  55:03 /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfi
root     13769  0.0  0.0   7336   704 ?        Ss   Jun29   0:00 /sbin/mdadm --monitor --scan -f --pid-file=/var/run/mdadm/mdadm.pid
root     13782  0.1  0.0 465232  6852 ?        Ssl  Jun29  13:05 /usr/sbin/NetworkManager --no-daemon
root     13785  0.0  0.0  24508  2104 ?        Ss   Jun29   0:00 /usr/sbin/smartd -n -q never
avahi    13789  0.0  0.0  60184  1652 ?        Ss   Jun29   2:51 avahi-daemon: running [gestionminute1.local]
avahi    13810  0.0  0.0  60060    40 ?        S    Jun29   0:00  \_ avahi-daemon: chroot helper
root     13793  0.0  0.0  21676  1176 ?        Ss   Jun29   2:27 /usr/sbin/irqbalance --foreground
root     13794  0.1  0.0  29796  5140 ?        Ss   Jun29  24:21 /usr/lib/systemd/systemd-logind
polkitd  13796  0.1  0.0 612488  6820 ?        Ssl  Jun29  19:20 /usr/lib/polkit-1/polkitd --no-debug
root     13801  0.0  0.0  79296  2604 ?        Ss   Jun29   4:22 /usr/sbin/saslauthd -m /run/saslauthd -a pam -r -r
root     13802  0.0  0.0  93900  2716 ?        S    Jun29   4:15  \_ /usr/sbin/saslauthd -m /run/saslauthd -a pam -r -r
root     13803  0.0  0.0  79296  2580 ?        S    Jun29   4:15  \_ /usr/sbin/saslauthd -m /run/saslauthd -a pam -r -r
root     13804  0.0  0.0  79296  2580 ?        S    Jun29   4:14  \_ /usr/sbin/saslauthd -m /run/saslauthd -a pam -r -r
root     13805  0.0  0.0  79296  2580 ?        S    Jun29   4:14  \_ /usr/sbin/saslauthd -m /run/saslauthd -a pam -r -r
root     13815  0.0  0.0  25904  1112 ?        Ss   Jun29   1:34 /usr/sbin/atd -f
root     13897  0.0  0.0 110104   828 tty1     Ss+  Jun29   0:00 /sbin/agetty --noclear tty1 linux
root     14199  0.0  0.0 574180 16448 ?        Ssl  Jun29   1:46 /usr/bin/python2 -Es /usr/sbin/tuned -l -P
memcach+ 14203  0.0  0.0 365448 25856 ?        Ssl  Jun29   9:21 /usr/bin/memcached -u memcached -p 11211 -m 40096 -c 2000
root     14207  0.1  0.0 813092 80424 ?        Ss   Jun29  16:24 /usr/sbin/httpd -DFOREGROUND
apache   16981  0.0  0.0 463812 64556 ?        S    15:59   0:04  \_ /usr/sbin/httpd -DFOREGROUND
ucbgl    16991  0.0  0.0 322152 70808 ?        S    15:59   0:06  |   \_ /bin/php70-cgi
ugtl     17149  0.0  0.0 459852 75312 ?        S    15:59   0:02  |   \_ /bin/php-cgi
uphp     17173  1.4  0.0 459436 73184 ?        S    15:59   2:41  |   \_ /bin/php-cgi
cp       17231  1.4  0.0 287196 37208 ?        S    15:59   2:38  |   \_ /bin/php70-cgi
granite+ 17243  0.1  0.0 249444 17852 ?        S    15:59   0:16  |   \_ /bin/php55-cgi
ecolo-c+ 17366  0.9  0.0 356096 30796 ?        S    15:59   1:48  |   \_ /bin/php70-cgi
sumoweb+ 17677  0.3  0.0 276316 28284 ?        S    15:59   0:44  |   \_ /bin/php70-cgi
upfl     17822  0.1  0.0 460972 89468 ?        S    15:59   0:21  |   \_ /bin/php-cgi
upfl     17847  0.1  0.0 460392 75964 ?        S    15:59   0:19  |   \_ /bin/php-cgi
upfl     17848  0.2  0.0 461180 90284 ?        S    15:59   0:25  |   \_ /bin/php-cgi
umbm     17899  0.1  0.0 463612 77376 ?        S    15:59   0:13  |   \_ /bin/php-cgi
lussier+ 18100  0.0  0.0 290280 40136 ?        S    15:59   0:00  |   \_ /bin/php70-cgi
ventes   18559  0.0  0.0 440428 18320 ?        Ss   16:00   0:00  |   \_ /bin/php-cgi
ventes   18561  0.0  0.0 541468 64460 ?        S    16:00   0:01  |   |   \_ /bin/php-cgi
uairmax  18843  0.2  0.0 477960 107204 ?       S    16:00   0:29  |   \_ /bin/php-cgi
uairmax  19299  0.2  0.0 545048 95084 ?        S    16:00   0:31  |   \_ /bin/php-cgi
uairmax  19408  0.3  0.0 544836 95408 ?        S    16:00   0:39  |   \_ /bin/php-cgi
granite+ 24693  5.1  0.0 249532 18468 ?        S    16:00   9:35  |   \_ /bin/php55-cgi
u22degr+ 24721  0.3  0.0 314016 64920 ?        S    16:00   0:37  |   \_ /bin/php70-cgi
ucbgl    25098  0.0  0.0 325952 80324 ?        S    16:00   0:02  |   \_ /bin/php70-cgi
circuit+ 25588  0.3  0.0 366000 39228 ?        S    16:01   0:43  |   \_ /bin/php70-cgi
umbm     25644  0.1  0.0 460308 75816 ?        S    16:01   0:12  |   \_ /bin/php-cgi
umbm     25652  0.1  0.0 459424 74256 ?        S    16:01   0:11  |   \_ /bin/php-cgi
logicie+ 25857  0.2  0.0 380248 54848 ?        S    16:01   0:31  |   \_ /bin/php70-cgi
ugp2     25964  0.2  0.0 463824 93648 ?        S    16:01   0:30  |   \_ /bin/php-cgi
gestion+ 26444  0.2  0.0 280336 33036 ?        S    16:01   0:24  |   \_ /bin/php70-cgi
uvma     26992  0.1  0.0 460984 90576 ?        S    16:02   0:20  |   \_ /bin/php-cgi
uvma     27018  0.2  0.0 465184 94280 ?        S    16:02   0:23  |   \_ /bin/php-cgi
uvma     27019  0.1  0.0 460864 90748 ?        S    16:02   0:21  |   \_ /bin/php-cgi
gestion+ 27151  0.0  0.0 536628 79824 ?        S    16:02   0:03  |   \_ /bin/php-cgi
gestion+ 27197  0.0  0.0 536504 77796 ?        S    16:02   0:02  |   \_ /bin/php-cgi
concept+ 27693  0.3  0.0 381776 59240 ?        S    16:02   0:35  |   \_ /bin/php70-cgi
ucmm     30586  0.0  0.0 311588 60000 ?        S    16:03   0:06  |   \_ /bin/php70-cgi
positio+ 30717  0.0  0.0 275860 28552 ?        S    16:03   0:04  |   \_ /bin/php70-cgi
minutem+ 31131  0.0  0.0 291728 40696 ?        S    16:04   0:09  |   \_ /bin/php70-cgi
uforgex  31192  0.5  0.0 544764 95656 ?        S    16:04   1:03  |   \_ /bin/php-cgi
ugp2     31378  0.2  0.0 547124 96004 ?        S    16:04   0:25  |   \_ /bin/php-cgi
uabs     31573  0.4  0.0 311896 61512 ?        S    16:04   0:48  |   \_ /bin/php70-cgi
uabs     32056  0.5  0.0 314036 63104 ?        S    16:04   1:00  |   \_ /bin/php70-cgi
uabs       655  0.5  0.0 313880 62448 ?        S    16:05   1:00  |   \_ /bin/php70-cgi
ufop      3118  0.0  0.0 319448 70484 ?        S    16:06   0:07  |   \_ /bin/php70-cgi
uarbo     3500  0.5  0.0 467552 97000 ?        S    16:06   0:58  |   \_ /bin/php-cgi
uarbo     3501  0.5  0.0 471336 101700 ?       S    16:06   1:02  |   \_ /bin/php-cgi
ufop      3559  0.0  0.0 315680 65948 ?        S    16:06   0:08  |   \_ /bin/php70-cgi
ufop      3560  0.0  0.0 317268 66944 ?        S    16:06   0:03  |   \_ /bin/php70-cgi
u22degr+  3978  0.4  0.0 314724 66488 ?        S    16:06   0:47  |   \_ /bin/php70-cgi
u22degr+  3980  0.4  0.0 314172 62804 ?        S    16:06   0:43  |   \_ /bin/php70-cgi
circuit+  4164  0.1  0.0 287228 39464 ?        S    16:07   0:16  |   \_ /bin/php70-cgi
concept+  5172  0.4  0.0 389564 58568 ?        S    16:07   0:45  |   \_ /bin/php70-cgi
uforgex   5717  0.4  0.0 544064 92532 ?        S    16:07   0:49  |   \_ /bin/php-cgi
daignea+  7842  0.0  0.0 355672 30008 ?        S    16:08   0:09  |   \_ /bin/php70-cgi
daignea+  7914  0.1  0.0 364944 34112 ?        S    16:08   0:14  |   \_ /bin/php70-cgi
ecolo-c+ 10361  1.0  0.0 382856 57452 ?        S    16:09   1:53  |   \_ /bin/php70-cgi
ecolo-c+ 10362  0.8  0.0 368720 42668 ?        S    16:09   1:31  |   \_ /bin/php70-cgi
ujefo    11115  0.0  0.0 309056 46540 ?        S    16:10   0:01  |   \_ /bin/php70-cgi
airfroi+ 11231  0.0  0.0 313296 64136 ?        S    16:10   0:10  |   \_ /bin/php70-cgi
airfroi+ 11794  0.0  0.0 315852 65080 ?        S    16:10   0:08  |   \_ /bin/php70-cgi
airfroi+ 11795  0.1  0.0 313344 64152 ?        S    16:10   0:11  |   \_ /bin/php70-cgi
cp       11814  1.4  0.0 287196 35872 ?        S    16:10   2:38  |   \_ /bin/php70-cgi
uje      14065  0.0  0.0 479224 104388 ?       S    16:12   0:08  |   \_ /bin/php-cgi
uje      14075  0.0  0.0 472520 98292 ?        S    16:12   0:06  |   \_ /bin/php-cgi
utecair  14794  0.1  0.0 460696 75744 ?        S    16:13   0:17  |   \_ /bin/php-cgi
uphp     16956  1.3  0.0 459572 74184 ?        S    16:13   2:23  |   \_ /bin/php-cgi
ustepha+ 21856  0.0  0.0 318332 67612 ?        S    16:16   0:09  |   \_ /bin/php70-cgi
ustepha+ 22941  0.0  0.0 320272 69048 ?        S    16:17   0:09  |   \_ /bin/php70-cgi
circuit+ 26058  0.4  0.0 377208 44476 ?        S    16:18   0:41  |   \_ /bin/php70-cgi
uje      30192  0.0  0.0 475076 100152 ?       S    16:20   0:05  |   \_ /bin/php-cgi
urb      30519  0.1  0.0 318180 69588 ?        S    16:20   0:17  |   \_ /bin/php70-cgi
urb      30611  0.1  0.0 313424 64096 ?        S    16:20   0:15  |   \_ /bin/php70-cgi
uarbo     1219  0.5  0.0 465452 94740 ?        S    16:22   0:54  |   \_ /bin/php-cgi
ujfd      1821  0.2  0.0 467044 97376 ?        S    16:23   0:25  |   \_ /bin/php-cgi
gestion+  3223  0.0  0.0 372936 22124 ?        S    16:23   0:02  |   \_ /bin/php70-cgi
uiejp     4128  0.5  0.0 316056 69508 ?        S    16:23   0:49  |   \_ /bin/php70-cgi
uiejp     4207  0.5  0.0 318372 71664 ?        S    16:23   0:50  |   \_ /bin/php70-cgi
uiejp     4367  0.4  0.0 316288 69592 ?        S    16:23   0:46  |   \_ /bin/php70-cgi
urossig+  7948  0.1  0.0 447748 70244 ?        S    16:26   0:12  |   \_ /bin/php-cgi
urossig+  8246  0.1  0.0 460940 89024 ?        S    16:26   0:11  |   \_ /bin/php-cgi
ulapoin+ 12576  1.1  0.0 315232 68824 ?        S    16:28   1:46  |   \_ /bin/php70-cgi
ujee     15590  0.8  0.0 293944 42132 ?        S    16:30   1:24  |   \_ /bin/php70-cgi
ujee     15646  1.1  0.0 318052 66268 ?        S    16:30   1:46  |   \_ /bin/php70-cgi
ujee     15647  0.9  0.0 318320 67480 ?        S    16:30   1:34  |   \_ /bin/php70-cgi
udivisi+ 19216  0.3  0.0 320620 70168 ?        S    16:33   0:32  |   \_ /bin/php70-cgi
ucna     23171  0.0  0.0 287944 37920 ?        S    16:33   0:00  |   \_ /bin/php70-cgi
ucna     23172  0.0  0.0 292256 42112 ?        S    16:33   0:00  |   \_ /bin/php70-cgi
ujfd     23330  0.2  0.0 462688 78120 ?        S    16:33   0:18  |   \_ /bin/php-cgi
uecovat+ 24075  0.1  0.0 312632 65564 ?        S    16:34   0:15  |   \_ /bin/php70-cgi
gestion+ 31514  0.0  0.0 276048 28536 ?        S    16:38   0:00  |   \_ /bin/php70-cgi
logicie+  1314  0.1  0.0 376824 52624 ?        S    16:40   0:09  |   \_ /bin/php70-cgi
ulgef     2722  0.1  0.0 318244 67288 ?        S    16:41   0:11  |   \_ /bin/php70-cgi
ulgef     2738  0.0  0.0 320160 69232 ?        S    16:41   0:06  |   \_ /bin/php70-cgi
uvj       2787  0.0  0.0 319752 56020 ?        S    16:41   0:08  |   \_ /bin/php70-cgi
uvj       3074  0.0  0.0 319532 56848 ?        S    16:41   0:04  |   \_ /bin/php70-cgi
upurpat+  8745  0.5  0.0 401620 69816 ?        S    16:43   0:43  |   \_ /bin/php70-cgi
upurpat+  8953  0.4  0.0 317204 69936 ?        S    16:43   0:35  |   \_ /bin/php70-cgi
upurpat+  9301  0.5  0.0 317300 69456 ?        S    16:43   0:48  |   \_ /bin/php70-cgi
betonle+ 10016  0.1  0.0 301232 39028 ?        S    16:43   0:13  |   \_ /bin/php70-cgi
betonle+ 10289  0.1  0.0 320260 58532 ?        S    16:44   0:11  |   \_ /bin/php70-cgi
ulgef    12249  0.0  0.0 318116 67104 ?        S    16:44   0:06  |   \_ /bin/php70-cgi
betonle+ 13351  0.0  0.0 290864 27832 ?        S    16:44   0:08  |   \_ /bin/php70-cgi
ulapoin+ 13858  0.8  0.0 313928 65352 ?        S    16:44   1:15  |   \_ /bin/php70-cgi
uvj      21898  0.0  0.0 309140 46868 ?        S    16:47   0:01  |   \_ /bin/php70-cgi
uthermo+ 26593  1.0  0.0 321956 69728 ?        S    16:49   1:26  |   \_ /bin/php70-cgi
ujfd     27822  0.0  0.0 459588 72928 ?        S    16:50   0:05  |   \_ /bin/php-cgi
ugf      29103  0.0  0.0 311544 60848 ?        S    16:50   0:02  |   \_ /bin/php70-cgi
uforgex  31590  0.1  0.0 458640 75752 ?        S    16:52   0:14  |   \_ /bin/php-cgi
ulajoie   2095  0.0  0.0 312700 63312 ?        S    16:53   0:02  |   \_ /bin/php70-cgi
ulajoie   2102  0.0  0.0 314748 63996 ?        S    16:53   0:03  |   \_ /bin/php70-cgi
ulajoie   2254  0.0  0.0 316796 66848 ?        S    16:53   0:03  |   \_ /bin/php70-cgi
urossig+  3212  0.0  0.0 460932 90276 ?        S    16:53   0:07  |   \_ /bin/php-cgi
sebasti+  8060  0.1  0.0 318132 68300 ?        S    16:56   0:12  |   \_ /bin/php70-cgi
ugd      17171  0.1  0.0 547516 97636 ?        S    16:57   0:11  |   \_ /bin/php-cgi
concept+ 19903  0.0  0.0 373636 41116 ?        S    16:58   0:01  |   \_ /bin/php70-cgi
ufaxero+  6726  0.1  0.0 315204 65140 ?        S    17:02   0:08  |   \_ /bin/php70-cgi
ubotanix  7063  0.2  0.0 313620 65420 ?        S    17:02   0:19  |   \_ /bin/php70-cgi
lecuyer2 10565  0.0  0.0 309004 59792 ?        S    17:04   0:04  |   \_ /bin/php70-cgi
lecuyer2 11233  0.0  0.0 296072 45948 ?        S    17:04   0:00  |   \_ /bin/php70-cgi
lecuyer2 11241  0.0  0.0 304536 53844 ?        S    17:04   0:01  |   \_ /bin/php70-cgi
uct      14063  0.0  0.0 311232 61276 ?        S    17:06   0:02  |   \_ /bin/php70-cgi
ufaxero+ 14082  0.1  0.0 312936 62928 ?        S    17:06   0:08  |   \_ /bin/php70-cgi
granite+ 14276  4.6  0.0 340076 31356 ?        S    17:07   5:34  |   \_ /bin/php55-cgi
ubotanix 14447  0.1  0.0 315484 66660 ?        S    17:07   0:08  |   \_ /bin/php70-cgi
ubotanix 15155  0.0  0.0 312752 61932 ?        S    17:07   0:02  |   \_ /bin/php70-cgi
uplanis+ 18592  0.3  0.0 318392 68036 ?        S    17:09   0:21  |   \_ /bin/php70-cgi
uplanis+ 18595  0.3  0.0 318120 68144 ?        S    17:09   0:25  |   \_ /bin/php70-cgi
utherma  18764  0.7  0.0 313884 63988 ?        S    17:09   0:55  |   \_ /bin/php70-cgi
utherma  18818  0.6  0.0 317080 68696 ?        S    17:09   0:47  |   \_ /bin/php70-cgi
utherma  18819  0.6  0.0 310816 60796 ?        S    17:09   0:49  |   \_ /bin/php70-cgi
uecovat+ 25810  0.0  0.0 308544 57768 ?        S    17:13   0:03  |   \_ /bin/php70-cgi
uecovat+ 26028  0.0  0.0 289928 39344 ?        S    17:13   0:00  |   \_ /bin/php70-cgi
ulapoin+ 29593  0.3  0.0 311064 62308 ?        S    17:16   0:24  |   \_ /bin/php70-cgi
uthermo+  4830  0.5  0.0 311992 61720 ?        S    17:21   0:31  |   \_ /bin/php70-cgi
umelano   7195  0.0  0.0 294768 44236 ?        S    17:23   0:00  |   \_ /bin/php70-cgi
ecolo-c+  8893  0.0  0.0 277500 28404 ?        S    17:24   0:00  |   \_ /bin/php70-cgi
ubca      9070  0.4  0.0 323504 76360 ?        S    17:24   0:26  |   \_ /bin/php70-cgi
uthermo+ 24979  0.0  0.0 306528 56660 ?        S    17:34   0:02  |   \_ /bin/php70-cgi
ubca      8614  0.1  0.0 313468 64764 ?        S    17:44   0:05  |   \_ /bin/php70-cgi
urb       8650  0.0  0.0 290060 39648 ?        S    17:44   0:00  |   \_ /bin/php70-cgi
festiva+  8657  0.3  0.0 281240 34104 ?        S    17:44   0:16  |   \_ /bin/php70-cgi
unorcan  13926  1.8  0.0 320488 68960 ?        S    17:46   1:28  |   \_ /bin/php70-cgi
ugmei    19361  0.2  0.0 456468 72224 ?        S    17:50   0:09  |   \_ /bin/php-cgi
ugmei    19387  0.2  0.0 464432 92864 ?        S    17:50   0:13  |   \_ /bin/php-cgi
urr      21001  0.0  0.0 298232 48716 ?        S    17:52   0:01  |   \_ /bin/php70-cgi
festiva+ 24622  0.2  0.0 281624 33712 ?        S    17:54   0:09  |   \_ /bin/php70-cgi
ucjr     28231  0.0  0.0 294944 44280 ?        S    17:57   0:00  |   \_ /bin/php70-cgi
urolec   32688  1.3  0.0 319744 70980 ?        S    17:59   0:56  |   \_ /bin/php70-cgi
urolec   32691  1.6  0.0 319764 71268 ?        S    17:59   1:08  |   \_ /bin/php70-cgi
urolec   32692  1.6  0.0 317052 70488 ?        S    17:59   1:06  |   \_ /bin/php70-cgi
festiva+   707  0.3  0.0 267708 21600 ?        S    17:59   0:13  |   \_ /bin/php70-cgi
uinfini+  1323  0.4  0.0 556176 92992 ?        S    18:00   0:18  |   \_ /bin/php-cgi
uinfini+  1324  0.3  0.0 543512 84136 ?        S    18:00   0:14  |   \_ /bin/php-cgi
urfd      8245  0.9  0.0 318228 67676 ?        S    18:00   0:37  |   \_ /bin/php70-cgi
festiva+  8256  0.0  0.0 271800 22772 ?        S    18:00   0:00  |   \_ /bin/php70-cgi
logicie+ 12339  0.0  0.0 283564 34040 ?        S    18:03   0:00  |   \_ /bin/php70-cgi
uplanis+ 19301  0.4  0.0 317896 66212 ?        S    18:06   0:14  |   \_ /bin/php70-cgi
ugd      19600  0.2  0.0 536252 72824 ?        S    18:06   0:10  |   \_ /bin/php-cgi
ugp2     20376  0.4  0.0 465732 97028 ?        S    18:07   0:15  |   \_ /bin/php-cgi
ueae     20494  0.0  0.0 457928 69940 ?        S    18:07   0:01  |   \_ /bin/php-cgi
ubotate+ 22891  0.6  0.0 471124 87116 ?        S    18:08   0:22  |   \_ /bin/php-cgi
ulm      31127  0.4  0.0 468568 83680 ?        S    18:13   0:15  |   \_ /bin/php-cgi
ulm      31163  0.4  0.0 475156 104600 ?       S    18:13   0:15  |   \_ /bin/php-cgi
ulm      31167  0.4  0.0 463168 91452 ?        S    18:13   0:13  |   \_ /bin/php-cgi
ugd       2940  0.5  0.0 539636 90000 ?        S    18:17   0:15  |   \_ /bin/php-cgi
unorcan   5628  1.3  0.0 315616 66640 ?        S    18:18   0:38  |   \_ /bin/php70-cgi
uravene+  8484  0.3  0.0 314752 65720 ?        S    18:21   0:09  |   \_ /bin/php70-cgi
uravene+  8506  0.3  0.0 313224 64156 ?        S    18:21   0:10  |   \_ /bin/php70-cgi
daignea+ 13048  0.0  0.0 275068 22108 ?        S    18:24   0:00  |   \_ /bin/php70-cgi
uae      18854  0.0  0.0 454940 65580 ?        S    18:29   0:01  |   \_ /bin/php-cgi
upcl     20096  0.4  0.0 312944 63084 ?        S    18:30   0:10  |   \_ /bin/php70-cgi
ubotate+ 21738  0.2  0.0 460104 74360 ?        S    18:31   0:06  |   \_ /bin/php-cgi
ubotate+ 22099  0.2  0.0 460512 74480 ?        S    18:32   0:04  |   \_ /bin/php-cgi
upm      22287  0.1  0.0 311028 60308 ?        S    18:32   0:03  |   \_ /bin/php70-cgi
upcl     22620  0.0  0.0 306584 57576 ?        S    18:32   0:01  |   \_ /bin/php70-cgi
sebasti+ 22668  0.3  0.0 315800 65404 ?        S    18:32   0:07  |   \_ /bin/php70-cgi
sebasti+ 22669  0.3  0.0 320012 69484 ?        S    18:32   0:07  |   \_ /bin/php70-cgi
unorcan  27598  0.5  0.0 319388 69100 ?        S    18:35   0:11  |   \_ /bin/php70-cgi
utecair  28089  0.9  0.0 464592 80324 ?        S    18:35   0:17  |   \_ /bin/php-cgi
utecair  28111  1.0  0.0 460728 76224 ?        S    18:35   0:19  |   \_ /bin/php-cgi
ujlp     29531  0.1  0.0 317068 67052 ?        S    18:37   0:02  |   \_ /bin/php70-cgi
ugaia    32078  0.3  0.0 315280 65808 ?        S    18:38   0:05  |   \_ /bin/php70-cgi
ugaia    32079  0.4  0.0 313224 63856 ?        S    18:38   0:07  |   \_ /bin/php70-cgi
ugaia    32102  0.1  0.0 311240 61628 ?        S    18:38   0:02  |   \_ /bin/php70-cgi
usolea    5273  0.5  0.0 320072 68752 ?        S    18:42   0:08  |   \_ /bin/php70-cgi
usolea    5274  0.5  0.0 331040 84552 ?        S    18:42   0:07  |   \_ /bin/php70-cgi
usolea    5276  0.3  0.0 316848 65848 ?        S    18:42   0:05  |   \_ /bin/php70-cgi
positio+  7306  0.0  0.0 269524 22116 ?        S    18:43   0:00  |   \_ /bin/php70-cgi
test     11533  0.2  0.0 466376 79712 ?        S    18:47   0:03  |   \_ /bin/php-cgi
test     11671  0.1  0.0 453432 64264 ?        S    18:47   0:01  |   \_ /bin/php-cgi
ujlp     14710  0.3  0.0 317068 67796 ?        S    18:48   0:03  |   \_ /bin/php70-cgi
ujlp     14739  0.0  0.0 292492 42256 ?        S    18:48   0:00  |   \_ /bin/php70-cgi
ugmei    15666  0.1  0.0 458056 68540 ?        S    18:49   0:01  |   \_ /bin/php-cgi
urfd     16841  2.3  0.0 318144 67176 ?        S    18:50   0:24  |   \_ /bin/php70-cgi
urfd     16861  2.0  0.0 322352 71988 ?        S    18:50   0:21  |   \_ /bin/php70-cgi
upll     20898  0.1  0.0 454876 65108 ?        S    18:53   0:01  |   \_ /bin/php-cgi
ulm       4936  3.7  0.0 462556 76968 ?        S    19:01   0:12  |   \_ /bin/php-cgi
ulm       5335  2.5  0.0 462292 77108 ?        S    19:02   0:08  |   \_ /bin/php-cgi
ulm       6786  1.6  0.0 462172 72904 ?        S    19:03   0:04  |   \_ /bin/php-cgi
ugazone+  6889  0.5  0.0 453360 64220 ?        S    19:03   0:01  |   \_ /bin/php-cgi
upb      10767  0.5  0.0 287808 37480 ?        S    19:05   0:00  |   \_ /bin/php70-cgi
apache    4774  0.0  0.0 814840 71120 ?        S    19:01   0:00  \_ /usr/sbin/httpd -DFOREGROUND
apache    5962  0.0  0.0 814504 70856 ?        S    19:02   0:00  \_ /usr/sbin/httpd -DFOREGROUND
apache    6825  0.0  0.0 814812 70600 ?        S    19:03   0:00  \_ /usr/sbin/httpd -DFOREGROUND
apache    9521  0.0  0.0 814044 70368 ?        S    19:04   0:00  \_ /usr/sbin/httpd -DFOREGROUND
apache   10785  0.0  0.0 814208 70360 ?        S    19:05   0:00  \_ /usr/sbin/httpd -DFOREGROUND
apache   11074  0.0  0.0 814240 70448 ?        S    19:05   0:00  \_ /usr/sbin/httpd -DFOREGROUND
apache   11449  0.0  0.0 814052 70248 ?        S    19:06   0:00  \_ /usr/sbin/httpd -DFOREGROUND
apache   11683  0.0  0.0 813884 70028 ?        S    19:06   0:00  \_ /usr/sbin/httpd -DFOREGROUND
apache   11740  0.0  0.0 813924 70084 ?        S    19:06   0:00  \_ /usr/sbin/httpd -DFOREGROUND
apache   12363  0.1  0.0 813912 70096 ?        S    19:06   0:00  \_ /usr/sbin/httpd -DFOREGROUND
apache   12383  0.0  0.0 813884 70160 ?        S    19:06   0:00  \_ /usr/sbin/httpd -DFOREGROUND
apache   12384  0.0  0.0 813508 69568 ?        S    19:06   0:00  \_ /usr/sbin/httpd -DFOREGROUND
apache   12407  0.0  0.0 813820 70040 ?        S    19:06   0:00  \_ /usr/sbin/httpd -DFOREGROUND
apache   12671  0.0  0.0 813228 68732 ?        S    19:07   0:00  \_ /usr/sbin/httpd -DFOREGROUND
root     14208  0.0  0.0 112864  3464 ?        Ss   Jun29   0:20 /usr/sbin/sshd -D
root      8464  0.0  0.0 154796  5952 ?        Ss   00:44   0:00  \_ sshd: root@notty
root      8476  0.0  0.0  72332  2996 ?        Ss   00:44   0:15  |   \_ /usr/libexec/openssh/sftp-server
root     22986  0.0  0.0 154664  5636 ?        Ss   00:56   0:00  \_ sshd: root@pts/0
root     23033  0.0  0.0 115572  2148 pts/0    Ss   00:57   0:00  |   \_ -bash
root     12792  0.0  0.0 155840  2428 pts/0    R+   19:07   0:00  |       \_ ps auxwf
root     31534  0.0  0.0 154664  5652 ?        Ss   12:41   0:00  \_ sshd: root@pts/1
root     31562  0.0  0.0 115540  2104 pts/1    Ss+  12:41   0:00  |   \_ -bash
root     12705  0.2  0.0 156688  5168 ?        Ss   19:07   0:00  \_ sshd: root [priv]
sshd     12706  0.0  0.0 112864  2232 ?        S    19:07   0:00  |   \_ sshd: root [net]
root     12711  0.2  0.0 156688  5168 ?        Ss   19:07   0:00  \_ sshd: root [priv]
sshd     12712  0.0  0.0 112864  2228 ?        S    19:07   0:00      \_ sshd: root [net]
root     14211  0.6  0.0 133552  3820 ?        Ssl  Jun29  82:46 /usr/bin/monit -I
root     12776  3.0  0.0      0     0 ?        Zs   19:07   0:00  \_ [top] <defunct>
root     14233  0.2  0.0 796596 203868 ?       Ssl  Jun29  32:57 /usr/sbin/rsyslogd -n
nobody   15079  0.0  0.0 198704  2020 ?        Ss   Jun29   0:13 proftpd: (accepting connections)
root     15104  0.0  0.0  20432  1240 ?        Ss   Jun29   1:53 /usr/sbin/dovecot
dovecot  16225  0.0  0.0   9868  1256 ?        S    Jun29   0:28  \_ dovecot/anvil
root     16226  0.0  0.0   9872  1408 ?        S    Jun29   0:31  \_ dovecot/log
root     16239  0.0  0.0  52084 37376 ?        S    Jun29   2:54  \_ dovecot/config
dovenull   910  0.0  0.0  44356  4332 ?        S    Jul04   0:02  \_ dovecot/imap-login
dave.ge+   921  0.0  0.0  17900  2624 ?        S    Jul04   0:03  \_ dovecot/imap
dovenull  1004  0.0  0.0  44364  4328 ?        S    Jul04   0:02  \_ dovecot/imap-login
support+  1029  0.0  0.0  17980  2944 ?        S    Jul04   0:03  \_ dovecot/imap
dovenull 12839  0.0  0.0  44356  4328 ?        S    Jul04   0:02  \_ dovecot/imap-login
dave.ge+ 12851  0.0  0.0  17912  2792 ?        S    Jul04   0:03  \_ dovecot/imap
dovenull  2515  0.0  0.0  44356  4328 ?        S    Jul04   0:01  \_ dovecot/imap-login
dovenull  2625  0.0  0.0  44364  4336 ?        S    Jul04   0:02  \_ dovecot/imap-login
dave.ge+  2639  0.0  0.0  17900  2732 ?        S    Jul04   0:02  \_ dovecot/imap
support+  2711  0.0  0.0  18368  3220 ?        S    Jul04   0:03  \_ dovecot/imap
dovenull 27469  0.0  0.0  44364  4332 ?        S    Jul05   0:01  \_ dovecot/imap-login
support+ 27496  0.0  0.0  17896  2896 ?        S    Jul05   0:02  \_ dovecot/imap
dovenull  8262  0.0  0.0  44364  4328 ?        S    Jul05   0:01  \_ dovecot/imap-login
support+  8278  0.0  0.0  18136  3224 ?        S    Jul05   0:02  \_ dovecot/imap
dovenull 31931  0.0  0.0  44356  4332 ?        S    Jul05   0:01  \_ dovecot/imap-login
dave.ge+ 32003  0.0  0.0  18088  3040 ?        S    Jul05   0:02  \_ dovecot/imap
dovenull 15344  0.0  0.0  44364  4336 ?        S    02:24   0:00  \_ dovecot/imap-login
support+ 15350  0.0  0.0  21116  4036 ?        S    02:24   0:00  \_ dovecot/imap
dovenull 15449  0.0  0.0  44356  4336 ?        S    02:24   0:00  \_ dovecot/imap-login
dave.ge+ 15455  0.0  0.0  57360 18600 ?        S    02:24   0:03  \_ dovecot/imap
dovenull 16301  0.0  0.0  44232  4076 ?        S    02:25   0:00  \_ dovecot/imap-login
info.su+ 16302  0.0  0.0  18892  3736 ?        S    02:25   0:00  \_ dovecot/imap
dovenull 20964  0.0  0.0  44232  4072 ?        S    02:31   0:00  \_ dovecot/imap-login
info.su+ 20969  0.0  0.0  33808  8424 ?        S    02:31   0:01  \_ dovecot/imap
dovenull 20976  0.0  0.0  44364  4332 ?        S    02:31   0:00  \_ dovecot/imap-login
info.ge+ 20978  0.0  0.0  30388 10508 ?        S    02:31   0:04  \_ dovecot/imap
dovenull 20990  0.0  0.0  44232  4068 ?        S    02:31   0:00  \_ dovecot/imap-login
moi.pat+ 20993  0.0  0.0  25992  9052 ?        S    02:31   0:03  \_ dovecot/imap
dovenull 21002  0.0  0.0  44364  4332 ?        S    02:31   0:00  \_ dovecot/imap-login
support+ 21003  0.0  0.0  21112  4072 ?        S    02:31   0:00  \_ dovecot/imap
dovenull 10188  1.4  0.0  44232  4288 ?        S    19:05   0:02  \_ dovecot/imap-login
lussier+ 10207  4.4  0.0 133884 67580 ?        S    19:05   0:06  \_ dovecot/imap
dovenull 11144  0.0  0.0  44356  4336 ?        S    19:05   0:00  \_ dovecot/imap-login
constan+ 11147  0.0  0.0  18148  3020 ?        S    19:05   0:00  \_ dovecot/imap
mailman  15258  0.0  0.0 232220  7936 ?        Ss   Jun29   0:00 /usr/bin/python /usr/lib/mailman/bin/mailmanctl -s start
mailman  15544  0.0  0.0 232040  5592 ?        S    Jun29   1:52  \_ /usr/bin/python /usr/lib/mailman/bin/qrunner --runner=ArchRunne
mailman  15546  0.0  0.0 232072 11708 ?        S    Jun29   2:00  \_ /usr/bin/python /usr/lib/mailman/bin/qrunner --runner=BounceRun
mailman  15549  0.0  0.0 232096 11860 ?        S    Jun29   1:53  \_ /usr/bin/python /usr/lib/mailman/bin/qrunner --runner=CommandRu
mailman  15550  0.0  0.0 232136 11112 ?        S    Jun29   1:53  \_ /usr/bin/python /usr/lib/mailman/bin/qrunner --runner=IncomingR
mailman  15551  0.0  0.0 232192 13876 ?        S    Jun29   1:49  \_ /usr/bin/python /usr/lib/mailman/bin/qrunner --runner=NewsRunne
mailman  15553  0.0  0.0 232076 14168 ?        S    Jun29   1:59  \_ /usr/bin/python /usr/lib/mailman/bin/qrunner --runner=OutgoingR
mailman  15556  0.0  0.0 232104 11152 ?        S    Jun29   1:52  \_ /usr/bin/python /usr/lib/mailman/bin/qrunner --runner=VirginRun
mailman  15557  0.0  0.0 232100 14052 ?        S    Jun29   0:00  \_ /usr/bin/python /usr/lib/mailman/bin/qrunner --runner=RetryRunn
root     16538  0.0  0.0  89652  1364 ?        Ss   Jun29   2:16 /usr/libexec/postfix/master -w
postfix  30694  0.0  0.0  89976  4376 ?        S    Jul02   0:08  \_ qmgr -l -t unix -u
postfix  30829  0.0  0.0  89768  4088 ?        S    Jul02   0:03  \_ tlsmgr -l -t unix -u
postfix  30830  0.0  0.0  89856  4140 ?        S    Jul02   1:07  \_ anvil -l -t unix -u
postfix  12793  0.0  0.0  89756  4016 ?        S    18:24   0:00  \_ pickup -l -t unix -u
postfix  18718  0.0  0.0 122120  6588 ?        S    18:51   0:00  \_ smtpd -n smtp -t inet -u -o stress= -s 2 -o smtpd_sasl_auth_ena
postfix  18761  0.0  0.0 122120  6584 ?        S    18:51   0:00  \_ smtpd -n smtp -t inet -u -o stress= -s 2 -o smtpd_sasl_auth_ena
postfix  24908  0.0  0.0 122168  6604 ?        S    18:56   0:00  \_ smtpd -n smtp -t inet -u -o stress= -s 2 -o smtpd_sasl_auth_ena
postfix   4677  0.0  0.0 122120  6592 ?        S    19:01   0:00  \_ smtpd -n smtp -t inet -u -o stress= -s 2 -o smtpd_sasl_auth_ena
postfix  10653  0.0  0.0  90152  5032 ?        S    19:05   0:00  \_ cleanup -z -t unix -u
postfix  10656  0.0  0.0  89892  4448 ?        S    19:05   0:00  \_ trivial-rewrite -n rewrite -t unix -u
postfix  10658  0.0  0.0  89860  4612 ?        S    19:05   0:00  \_ local -t unix
postfix  10713  0.0  0.0  90240  5716 ?        S    19:05   0:00  \_ smtp -t unix -u
postfix  11499  0.0  0.0 122224  6720 ?        S    19:06   0:00  \_ smtpd -n submission -t inet -u -o stress= -s 2 -o smtpd_sasl_au
postfix  11500  0.0  0.0  89732  4004 ?        S    19:06   0:00  \_ proxymap -t unix -u
postfix  12387  0.0  0.0 122120  6580 ?        S    19:06   0:00  \_ smtpd -n submission -t inet -u -o stress= -s 2 -o smtpd_sasl_au
postfix  12610  0.0  0.0  89892  4008 ?        S    19:07   0:00  \_ showq -t unix -u
root     28813  0.0  0.0 195548 17424 ?        Ss   Jun29   0:11 /usr/bin/perl /usr/libexec/usermin/miniserv.pl /etc/usermin/miniser
root     28912  0.0  0.0 198744 18680 ?        Ss   Jun29   7:51 /usr/bin/perl /usr/libexec/webmin/miniserv.pl /etc/webmin/miniserv.
root     14013  0.0  0.0 198744 17456 ?        S    Jul07   0:00  \_ /usr/bin/perl /usr/libexec/webmin/miniserv.pl /etc/webmin/minis
root     16615  0.0  0.0 198744 18052 ?        S    03:58   0:00  \_ /usr/bin/perl /usr/libexec/webmin/miniserv.pl /etc/webmin/minis
root      2162  0.0  0.0   4380   504 ?        Ss   Jun29   0:08 runsvdir -P /opt/gitlab/service log: ..............................
root      2165  0.0  0.0   4228   352 ?        Ss   Jun29   0:00  \_ runsv gitlab-workhorse
root      2181  0.0  0.0   4372   528 ?        S    Jun29   0:01  |   \_ svlogd /var/log/gitlab/gitlab-workhorse
git      23737  0.0  0.0 2422788 36884 ?       Ssl  01:06   0:40  |   \_ /opt/gitlab/embedded/bin/gitlab-workhorse -listenNetwork tc
root      2166  0.0  0.0   4228   356 ?        Ss   Jun29   0:00  \_ runsv postgresql
root      2179  0.0  0.0   4372   560 ?        S    Jun29   0:00  |   \_ svlogd -tt /var/log/gitlab/postgresql
gitlab-+  2188  0.0  0.1 15080816 321392 ?     Ss   Jun29   0:27  |   \_ /opt/gitlab/embedded/bin/postgres -D /var/opt/gitlab/postgr
gitlab-+  2389  0.0  0.0 15080012 122208 ?     Ss   Jun29   0:02  |       \_ postgres: checkpointer process
gitlab-+  2390  0.0  0.0 15079860 115396 ?     Ss   Jun29   0:09  |       \_ postgres: writer process
gitlab-+  2391  0.0  0.0 15079904 19276 ?      Ss   Jun29   0:09  |       \_ postgres: wal writer process
gitlab-+  2392  0.0  0.0 15080472 3656 ?       Ss   Jun29   1:00  |       \_ postgres: autovacuum launcher process
gitlab-+  2393  0.0  0.0  34016  3304 ?        Ss   Jun29   6:21  |       \_ postgres: stats collector process
gitlab-+  2394  0.0  0.0 15080316 3372 ?       Ss   Jun29   0:00  |       \_ postgres: bgworker: logical replication launcher
gitlab-+ 23892  0.1  0.0 15185744 11724 ?      Ss   01:06   1:13  |       \_ postgres: gitlab-psql postgres [local] idlegitlab-+ 24209  0.0  0.0 15189892 15724 ?      Ss   01:06   0:59  |       \_ postgres: gitlab gitlabhq_production [local] idle
gitlab-+ 24210  0.0  0.0 15185196 9700 ?       Ss   01:06   0:28  |       \_ postgres: gitlab gitlabhq_production [local] idle
gitlab-+ 24211  0.4  0.0 15185980 13936 ?      Ss   01:06   4:31  |       \_ postgres: gitlab gitlabhq_production [local] idle
gitlab-+ 25005  0.0  0.0 15190620 24796 ?      Ss   01:07   0:00  |       \_ postgres: gitlab gitlabhq_production [local] idle
gitlab-+ 27939  0.0  0.0 15191912 25460 ?      Ss   01:09   0:00  |       \_ postgres: gitlab gitlabhq_production [local] idle
gitlab-+ 29287  0.0  0.0 15190544 28456 ?      Ss   01:10   0:00  |       \_ postgres: gitlab gitlabhq_production [local] idle
gitlab-+  1446  0.0  0.0 15190820 25540 ?      Ss   01:12   0:00  |       \_ postgres: gitlab gitlabhq_production [local] idle
gitlab-+  6139  0.0  0.0 15190680 25524 ?      Ss   01:14   0:00  |       \_ postgres: gitlab gitlabhq_production [local] idle
gitlab-+  8932  0.0  0.0 15185416 15936 ?      Ss   01:15   0:00  |       \_ postgres: gitlab gitlabhq_production [local] idle
gitlab-+  8933  0.0  0.0 15190020 23520 ?      Ss   01:15   0:00  |       \_ postgres: gitlab gitlabhq_production [local] idle
gitlab-+  9848  0.0  0.0 15190932 27224 ?      Ss   01:15   0:00  |       \_ postgres: gitlab gitlabhq_production [local] idle
gitlab-+ 15398  0.0  0.0 15193176 27056 ?      Ss   01:17   0:00  |       \_ postgres: gitlab gitlabhq_production [local] idle
gitlab-+  1175  0.0  0.0 15190888 24520 ?      Ss   01:23   0:00  |       \_ postgres: gitlab gitlabhq_production [local] idle
gitlab-+  2816  0.0  0.0 15187832 23156 ?      Ss   01:25   0:00  |       \_ postgres: gitlab gitlabhq_production [local] idle
gitlab-+  3626  0.0  0.0 15187832 24024 ?      Ss   01:26   0:00  |       \_ postgres: gitlab gitlabhq_production [local] idle
gitlab-+ 10721  0.0  0.0 15187904 22916 ?      Ss   01:30   0:00  |       \_ postgres: gitlab gitlabhq_production [local] idle
gitlab-+ 13491  0.0  0.0 15189932 24060 ?      Ss   01:31   0:00  |       \_ postgres: gitlab gitlabhq_production [local] idle
gitlab-+ 16279  0.0  0.0 15191752 24844 ?      Ss   01:32   0:00  |       \_ postgres: gitlab gitlabhq_production [local] idle
gitlab-+ 22703  0.0  0.0 15190888 23880 ?      Ss   01:34   0:00  |       \_ postgres: gitlab gitlabhq_production [local] idle
gitlab-+ 26097  0.0  0.0 15191632 25156 ?      Ss   01:37   0:00  |       \_ postgres: gitlab gitlabhq_production [local] idle
gitlab-+ 28326  0.0  0.0 15191136 27520 ?      Ss   01:38   0:00  |       \_ postgres: gitlab gitlabhq_production [local] idle
gitlab-+ 31868  0.0  0.0 15191176 26704 ?      Ss   01:42   0:00  |       \_ postgres: gitlab gitlabhq_production [local] idle
gitlab-+  4766  0.0  0.0 15190900 24496 ?      Ss   01:46   0:00  |       \_ postgres: gitlab gitlabhq_production [local] idle
gitlab-+  8339  0.0  0.0 15190932 25576 ?      Ss   01:49   0:00  |       \_ postgres: gitlab gitlabhq_production [local] idle
gitlab-+ 18078  0.0  0.0 15187564 20388 ?      Ss   01:58   0:00  |       \_ postgres: gitlab gitlabhq_production [local] idle
gitlab-+ 25299  0.0  0.0 15189916 21116 ?      Ss   02:00   0:00  |       \_ postgres: gitlab gitlabhq_production [local] idle
gitlab-+ 25300  0.0  0.0 15190004 23660 ?      Ss   02:00   0:00  |       \_ postgres: gitlab gitlabhq_production [local] idle
gitlab-+ 25305  0.0  0.0 15187412 20388 ?      Ss   02:00   0:00  |       \_ postgres: gitlab gitlabhq_production [local] idle
gitlab-+ 25310  0.0  0.0 15187204 18928 ?      Ss   02:00   0:00  |       \_ postgres: gitlab gitlabhq_production [local] idle
gitlab-+ 25750  0.0  0.0 15187828 24464 ?      Ss   02:01   0:00  |       \_ postgres: gitlab gitlabhq_production [local] idle
gitlab-+ 19797  0.0  0.0 15188488 25236 ?      Ss   02:29   0:00  |       \_ postgres: gitlab gitlabhq_production [local] idle
gitlab-+ 25603  0.0  0.0 15191320 25060 ?      Ss   02:36   0:00  |       \_ postgres: gitlab gitlabhq_production [local] idle
gitlab-+ 28902  0.0  0.0 15187792 21560 ?      Ss   02:39   0:00  |       \_ postgres: gitlab gitlabhq_production [local] idle
gitlab-+  7720  0.0  0.0 15193344 29316 ?      Ss   03:49   0:00  |       \_ postgres: gitlab gitlabhq_production [local] idle
root      2167  0.0  0.0   4228   460 ?        Ss   Jun29   0:00  \_ runsv logrotate
root      2187  0.0  0.0   4372   560 ?        S    Jun29   0:00  |   \_ svlogd -tt /var/log/gitlab/logrotate
root     12114  0.0  0.0  11680  1432 ?        Ss   19:06   0:00  |   \_ /bin/sh /opt/gitlab/embedded/bin/gitlab-logrotate-wrapper
root     12118  0.0  0.0   4360   356 ?        S    19:06   0:00  |       \_ sleep 600
root      2168  0.0  0.0   4228   352 ?        Ss   Jun29   0:00  \_ runsv alertmanager
root      2183  0.0  0.0   4372   536 ?        S    Jun29   0:00  |   \_ svlogd -tt /var/log/gitlab/alertmanager
gitlab-+ 23768  0.1  0.0 2247000 32816 ?       Ssl  01:06   1:20  |   \_ /opt/gitlab/embedded/bin/alertmanager --web.listen-address=
root      2169  0.0  0.0   4228   352 ?        Ss   Jun29   0:00  \_ runsv unicorn
root      2185  0.0  0.0   4372   564 ?        S    Jun29   0:00  |   \_ svlogd -tt /var/log/gitlab/unicorn
git      23963  0.0  0.0  11688  1624 ?        Ss   01:06   0:32  |   \_ /bin/bash /opt/gitlab/embedded/bin/gitlab-unicorn-wrapper
git      12782  0.0  0.0   4360   352 ?        S    19:07   0:00  |       \_ sleep 1
root      2170  0.0  0.0   4228   356 ?        Ss   Jun29   0:00  \_ runsv redis-exporter
root      2182  0.0  0.0   4372   560 ?        S    Jun29   0:00  |   \_ svlogd -tt /var/log/gitlab/redis-exporter
gitlab-+ 23936  0.0  0.0 2337940 19320 ?       Ssl  01:06   0:40  |   \_ /opt/gitlab/embedded/bin/redis_exporter --web.listen-addres
root      2171  0.0  0.0   4228   356 ?        Ss   Jun29   0:00  \_ runsv node-exporter
root      2180  0.0  0.0   4372   556 ?        S    Jun29   0:00  |   \_ svlogd -tt /var/log/gitlab/node-exporter
gitlab-+ 23877  0.8  0.0 119976 22216 ?        Ssl  01:06   9:01  |   \_ /opt/gitlab/embedded/bin/node_exporter --web.listen-address
root      2172  0.0  0.0   4228   356 ?        Ss   Jun29   0:00  \_ runsv gitaly
root      2186  0.0  0.0   4372   524 ?        S    Jun29   0:00  |   \_ svlogd /var/log/gitlab/gitaly
git       2201  0.0  0.0 397608  9524 ?        Ssl  Jun29   2:09  |   \_ /opt/gitlab/embedded/bin/gitaly-wrapper /opt/gitlab/embedde
git       2280  0.3  0.0 2941336 49748 ?       Sl   Jun29  47:25  |       \_ /opt/gitlab/embedded/bin/gitaly /var/opt/gitlab/gitaly/
git       2399  0.2  0.0 3147576 77396 ?       Sl   Jun29  32:58  |           \_ ruby /opt/gitlab/embedded/service/gitaly-ruby/bin/g
git       2401  0.2  0.0 2938256 75580 ?       Sl   Jun29  32:17  |           \_ ruby /opt/gitlab/embedded/service/gitaly-ruby/bin/g
root      2173  0.0  0.0   4228   356 ?        Ss   Jun29   0:00  \_ runsv grafana
root      2199  0.0  0.0   4372   564 ?        S    Jun29   0:00  |   \_ svlogd -tt /var/log/gitlab/grafana
gitlab-+ 23823  0.0  0.0 3667128 44488 ?       Ssl  01:06   0:11  |   \_ /opt/gitlab/embedded/bin/grafana-server -config /var/opt/gi
root      2174  0.0  0.0   4228   352 ?        Ss   Jun29   0:00  \_ runsv postgres-exporter
root      2184  0.0  0.0   4372   508 ?        S    Jun29   0:00  |   \_ svlogd -tt /var/log/gitlab/postgres-exporter
gitlab-+ 23886  0.1  0.0 2253924 24272 ?       Ssl  01:06   1:22  |   \_ /opt/gitlab/embedded/bin/postgres_exporter --web.listen-add
root      2175  0.0  0.0   4228   460 ?        Ss   Jun29   0:08  \_ runsv prometheus
root      2189  0.0  0.0   4372   572 ?        S    Jun29   0:09  |   \_ svlogd -tt /var/log/gitlab/prometheus
gitlab-+ 23898  0.7  0.0 5408560 141796 ?      Ssl  01:06   7:35  |   \_ /opt/gitlab/embedded/bin/prometheus --web.listen-address=lo
root      2176  0.0  0.0   4228   352 ?        Ss   Jun29   0:00  \_ runsv redis
root      2190  0.0  0.0   4372   600 ?        S    Jun29   0:01  |   \_ svlogd -tt /var/log/gitlab/redis
gitlab-+  2206  0.6  0.0  45624  9940 ?        Ssl  Jun29  87:56  |   \_ /opt/gitlab/embedded/bin/redis-server 127.0.0.1:0
root      2177  0.0  0.0   4228   356 ?        Ss   Jun29   0:00  \_ runsv sidekiq
root      2191  0.0  0.0   4372   532 ?        S    Jun29   0:02  |   \_ svlogd /var/log/gitlab/sidekiq
git      23954  1.5  0.1 1231308 417032 ?      Ssl  01:06  16:48  |   \_ sidekiq 5.2.7 gitlab-rails [0 of 25 busy]
root      2178  0.0  0.0   4228   348 ?        Ss   Jun29   0:00  \_ runsv gitlab-monitor
root      2192  0.0  0.0   4372   564 ?        S    Jun29   0:00      \_ svlogd -tt /var/log/gitlab/gitlab-monitor
git      23812  0.8  0.0 478068 48932 ?        Ssl  01:06   9:25      \_ puma 3.12.0 (tcp://localhost:9168) [gitlab-monitor]
cp        2655  0.0  0.0 179448  6440 ?        Sl   Jun29   0:51 ./socketd --port=8008 --ssl --sslcert=/home/cp/ssl.cert --sslkey=/h
cp       12980  0.1  0.0 311552 19924 ?        S    02:23   1:04  \_ /usr/bin/php ./server.php
root     25892  4.8  0.2 2825352 670804 ?      SNsl Jun30 606:16 /usr/sbin/r1soft/bin/cdp -s -c /usr/sbin/r1soft/conf/agent_config
root      2826  0.0  0.0 286936 71736 ?        S    Jul02   1:11 /usr/bin/perl -T -w /usr/bin/spamd
root     20938  0.0  0.0 286936 68016 ?        S    Jul04   0:00  \_ spamd child
root     20939  0.0  0.0 286936 68044 ?        S    Jul04   0:00  \_ spamd child
clamupd+ 11027  0.0  0.0  66592  2780 ?        Ss   Jul02   0:24 /usr/bin/freshclam -d -c 4
root     20881  0.0  0.2 957228 737424 ?       Ssl  Jul02   7:38 /usr/sbin/clamd -c /etc/clamd.d/clamd.conf --foreground=yes
root     31999  1.5  0.2 2643952 671892 ?      Ss   Jul07  37:56 cdp_io/1/0
root     32001  0.8  0.2 2643952 671892 ?      Ss   Jul07  20:25 cdp_io/1/1
root     32002  1.2  0.2 2643952 671892 ?      Ss   Jul07  30:22 cdp_io/1/2
root     32005  1.0  0.2 2643952 671892 ?      Ss   Jul07  25:21 cdp_io/1/3
root     32006  1.0  0.2 2643952 671880 ?      Ss   Jul07  26:03 cdp_io/1/4
root     32007  1.0  0.2 2643952 671812 ?      Ss   Jul07  26:17 cdp_io/1/5
root     32008  1.0  0.2 2643952 671888 ?      Ss   Jul07  24:51 cdp_io/1/6
root     32009  0.9  0.2 2643952 671892 ?      Ss   Jul07  24:10 cdp_io/1/7
root     32010  1.0  0.2 2643952 671892 ?      Ss   Jul07  26:58 cdp_io/1/8
root     32011  0.8  0.2 2643952 671892 ?      Ss   Jul07  22:09 cdp_io/1/9
root     32013  0.9  0.2 2643952 671892 ?      Ss   Jul07  23:09 cdp_io/1/10
root     32014  0.7  0.2 2643952 671892 ?      Ss   Jul07  18:49 cdp_io/1/11
root     32015  0.9  0.2 2643952 671892 ?      Ss   Jul07  23:09 cdp_io/1/12
root     32016  0.9  0.2 2643952 671892 ?      Ss   Jul07  23:12 cdp_io/1/13
root     32017  1.0  0.2 2643952 671892 ?      Ss   Jul07  25:36 cdp_io/1/14
root     32018  1.0  0.2 2643952 671892 ?      Ss   Jul07  25:42 cdp_io/1/15
mysql    14518  0.0  0.0 113316  1652 ?        Ss   Jul07   0:00 /bin/sh /usr/bin/mysqld_safe --basedir=/usr
mysql    14956 15.0  5.5 38964088 14524400 ?   Sl   Jul07 197:21  \_ /usr/libexec/mysqld --basedir=/usr --datadir=/var/lib/mysql --p
root     25797  0.0  0.0 126708  2080 ?        Ss   00:58   0:05 /usr/sbin/crond -n
root      1018  0.0  0.0 180724  2976 ?        S    18:00   0:00  \_ /usr/sbin/CROND -n
root      1067  0.0  0.0 113172  1452 ?        Ss   18:00   0:00  |   \_ /bin/bash /usr/share/clamav/freshclam-sleep
root      1069  0.0  0.0 107948   352 ?        S    18:00   0:00  |       \_ sleep 8608
root      9872  0.0  0.0 180724  2980 ?        S    19:05   0:00  \_ /usr/sbin/CROND -n
lussier+  9954  6.4  0.0 650152 182000 ?       Ss   19:05   0:09      \_ php /home/lussieralarme/public_html/wp-content/plugins/gest
root     25846  0.0  0.0  44536  1836 ?        Ss   00:58   0:01 /usr/lib/systemd/systemd-udevd
git      23986  0.0  0.1 685188 353660 ?       S    01:06   0:28 unicorn master -D -E production -c /var/opt/gitlab/gitlab-rails/etc
git      24348  0.0  0.1 808180 399908 ?       S    01:07   0:07  \_ unicorn worker[0] -D -E production -c /var/opt/gitlab/gitlab-ra
git      24349  0.0  0.1 808180 399420 ?       S    01:07   0:06  \_ unicorn worker[1] -D -E production -c /var/opt/gitlab/gitlab-ra
git      24350  0.0  0.1 868504 408020 ?       Sl   01:07   0:09  \_ unicorn worker[2] -D -E production -c /var/opt/gitlab/gitlab-ra
git      24351  0.0  0.1 868504 397512 ?       Sl   01:07   0:10  \_ unicorn worker[3] -D -E production -c /var/opt/gitlab/gitlab-ra
git      24352  0.0  0.1 868504 397568 ?       Sl   01:07   0:11  \_ unicorn worker[4] -D -E production -c /var/opt/gitlab/gitlab-ra
git      24353  0.0  0.1 864436 396980 ?       Sl   01:07   0:08  \_ unicorn worker[5] -D -E production -c /var/opt/gitlab/gitlab-ra
git      24354  0.0  0.1 862360 402808 ?       Sl   01:07   0:08  \_ unicorn worker[6] -D -E production -c /var/opt/gitlab/gitlab-ra
git      24355  0.0  0.1 806020 407672 ?       S    01:07   0:08  \_ unicorn worker[7] -D -E production -c /var/opt/gitlab/gitlab-ra
git      24356  0.0  0.1 868504 400980 ?       Sl   01:07   0:10  \_ unicorn worker[8] -D -E production -c /var/opt/gitlab/gitlab-ra
git      24357  0.0  0.1 806020 405284 ?       S    01:07   0:09  \_ unicorn worker[9] -D -E production -c /var/opt/gitlab/gitlab-ra
git      24358  0.0  0.1 862360 397980 ?       Sl   01:07   0:10  \_ unicorn worker[10] -D -E production -c /var/opt/gitlab/gitlab-r
git      24359  0.0  0.1 868504 404964 ?       Sl   01:07   0:09  \_ unicorn worker[11] -D -E production -c /var/opt/gitlab/gitlab-r
git      24360  0.0  0.1 864520 391536 ?       Sl   01:07   0:09  \_ unicorn worker[12] -D -E production -c /var/opt/gitlab/gitlab-r
git      24361  0.0  0.1 862360 396596 ?       Sl   01:07   0:09  \_ unicorn worker[13] -D -E production -c /var/opt/gitlab/gitlab-r
git      24362  0.0  0.1 870664 419372 ?       Sl   01:07   0:09  \_ unicorn worker[14] -D -E production -c /var/opt/gitlab/gitlab-r
git      24365  0.0  0.1 862360 399088 ?       Sl   01:07   0:13  \_ unicorn worker[15] -D -E production -c /var/opt/gitlab/gitlab-r
git      24366  0.0  0.1 806020 405624 ?       S    01:07   0:07  \_ unicorn worker[16] -D -E production -c /var/opt/gitlab/gitlab-r
git      24367  0.0  0.1 870664 428276 ?       Sl   01:07   0:14  \_ unicorn worker[17] -D -E production -c /var/opt/gitlab/gitlab-r
git      24368  0.0  0.1 862360 401100 ?       Sl   01:07   0:12  \_ unicorn worker[18] -D -E production -c /var/opt/gitlab/gitlab-r
git      24369  0.0  0.1 799876 398524 ?       S    01:07   0:07  \_ unicorn worker[19] -D -E production -c /var/opt/gitlab/gitlab-r
git      24370  0.0  0.1 862360 390572 ?       Sl   01:07   0:07  \_ unicorn worker[20] -D -E production -c /var/opt/gitlab/gitlab-r
git      24371  0.0  0.1 870664 409804 ?       Sl   01:07   0:10  \_ unicorn worker[21] -D -E production -c /var/opt/gitlab/gitlab-r
git      24373  0.0  0.1 808180 404920 ?       S    01:07   0:08  \_ unicorn worker[22] -D -E production -c /var/opt/gitlab/gitlab-r
git      24374  0.0  0.1 801952 395448 ?       S    01:07   0:06  \_ unicorn worker[23] -D -E production -c /var/opt/gitlab/gitlab-r
git      24375  0.0  0.1 802036 392024 ?       S    01:07   0:06  \_ unicorn worker[24] -D -E production -c /var/opt/gitlab/gitlab-r
opendkim 24993  0.0  0.0 996516  4564 ?        Ssl  01:35   0:28 /usr/sbin/opendkim -b s
root     31915  0.0  0.0 1087752 47960 pts/1   Sl   12:41   0:09 node ./server.js
root     12479  100  0.2 772392 596912 ?       Rs   19:06   0:30 /usr/sbin/clamd -c /etc/clamd.d/clamd.conf --foreground=yes

For Spam and Virus scanning, it use:

SpamAssassin client program: Standalone Virus scanning program: Standalone

Both buttons at the bottom are activated. I can push to disable if needed.

Okay, so in that Spam and Virus Scanning screen, you'd want to change the Virus Scanning Program to "Local server scanner".

And similar with the SpamAssassin option, you'd want to change it to "spamc".

Note that when looking at your process list, it doesn't appear that ClamAV and SpamAssassin are the culprits for heavy IO usage. You have plenty of RAM though, and it certainly doesn't hurt to move them over to the server-based scanning methods.

When you check in the last line, clamd was using 100% of the CPU.

However, i just tried to make modifications you told me and i get this:

ERROR: Please edit the example config file /etc/clamd.d/scan.conf ERROR: Can't parse clamd configuration file /etc/clamd.d/scan.conf

That clamd process you're seeing there is the clamd daemon that you're trying to switch to. So that won't be going away based on the changes we're attempting to make here, it'll actually be getting more use.

It is indeed using 100% CPU at the moment, but overall has used very little CPU time, especially compared to some of the other processes running.

For example, unicorn and cpd have used significantly more CPU time than the clamd process has.

We're very happy to help move things over to the server-based scanners, there's no reason not to if you have the RAM for it (which you do) -- I'm just wondering if maybe something else is using up the IO that you're trying to free up.

Anyhow, regarding the clam scanner -- can you paste in the contents of the "/etc/clamd.d/scan.conf" file? Thanks!

#

Example config file for the Clam AV daemon

Please read the clamd.conf(5) manual before editing this file.

# Comment or remove the line below.

Example

Uncomment this option to enable logging. LogFile must be writable for the user running daemon. A full path is required. Default: disabled LogFile /var/log/clamd.scan By default the log file is locked for writing - the lock protects against running clamd multiple times (if want to run another clamd, please copy the configuration file, change the LogFile variable, and run the daemon with --config-file option). This option disables log file locking. Default: no LogFileUnlock yes Maximum size of the log file. Value of 0 disables the limit. You may use 'M' or 'm' for megabytes (1M = 1m = 1048576 bytes) and 'K' or 'k' for kilobytes (1K = 1k = 1024 bytes). To specify the size in bytes just don't use modifiers. If LogFileMaxSize is enabled, log rotation (the LogRotate option) will always be enabled. Default: 1M LogFileMaxSize 2M Log time with each message. Default: no LogTime yes Also log clean files. Useful in debugging but drastically increases the log size. Default: no LogClean yes Use system logger (can work together with LogFile). Default: no

LogSyslog yes

Specify the type of syslog messages - please refer to 'man syslog' for facility names. Default: LOG_LOCAL6 LogFacility LOG_MAIL Enable verbose logging. Default: no LogVerbose yes Enable log rotation. Always enabled when LogFileMaxSize is enabled. Default: no LogRotate yes Enable Prelude output. Default: no PreludeEnable yes

#

Set the name of the analyzer used by prelude-admin. Default: ClamAV PreludeAnalyzerName ClamAV Log additional information about the infected file, such as its size and hash, together with the virus name. ExtendedDetectionInfo yes This option allows you to save a process identifier of the listening daemon (main thread). Default: disabled PidFile /var/run/clamd.scan/clamd.pid Optional path to the global temporary directory. Default: system specific (usually /tmp or /var/tmp). TemporaryDirectory /var/tmp Path to the database directory. Default: hardcoded (depends on installation options) DatabaseDirectory /var/lib/clamav Only load the official signatures published by the ClamAV project. Default: no OfficialDatabaseOnly no The daemon can work in local mode, network mode or both. Due to security reasons we recommend the local mode. Path to a local socket file the daemon will listen on. Default: disabled (must be specified by a user) LocalSocket /var/run/clamd.scan/clamd.sock Sets the group ownership on the unix socket. Default: disabled (the primary group of the user running clamd) LocalSocketGroup virusgroup Sets the permissions on the unix socket to the specified mode. Default: disabled (socket is world accessible) LocalSocketMode 660 Remove stale socket after unclean shutdown. Default: yes FixStaleSocket yes TCP port address. Default: no TCPSocket 3310 TCP address. By default we bind to INADDR_ANY, probably not wise. Enable the following to provide some degree of protection from the outside world. This option can be specified multiple times if you want to listen on multiple IPs. IPv6 is now supported. Default: no TCPAddr 127.0.0.1 Maximum length the queue of pending connections may grow to. Default: 200 MaxConnectionQueueLength 30 Clamd uses FTP-like protocol to receive data from remote clients. If you are using clamav-milter to balance load between remote clamd daemons on firewall servers you may need to tune the options below. Close the connection when the data size limit is exceeded. The value should match your MTA's limit for a maximum attachment size. Default: 25M StreamMaxLength 10M Limit port range. Default: 1024 StreamMinPort 30000 Default: 2048 StreamMaxPort 32000 Maximum number of threads running at the same time. Default: 10 MaxThreads 20 Waiting for data from a client socket will timeout after this time (seconds). Default: 120 ReadTimeout 300 This option specifies the time (in seconds) after which clamd should timeout if a client doesn't provide any initial command after connecting. Default: 30 CommandReadTimeout 30 This option specifies how long to wait (in milliseconds) if the send buffer is full. Keep this value low to prevent clamd hanging

#

Default: 500 SendBufTimeout 200 Maximum number of queued items (including those being processed by MaxThreads threads) It is recommended to have this value at least twice MaxThreads if possible. WARNING: you shouldn't increase this too much to avoid running out of file descriptors, the following condition should hold: MaxThreads*MaxRecursion + (MaxQueue - MaxThreads) + 6< RLIMIT_NOFILE (usual max is 1024)

#

Default: 100 MaxQueue 200 Waiting for a new job will timeout after this time (seconds). Default: 30 IdleTimeout 60 Don't scan files and directories matching regex This directive can be used multiple times Default: scan all ExcludePath ^/proc/ ExcludePath ^/sys/ Maximum depth directories are scanned at. Default: 15 MaxDirectoryRecursion 20 Follow directory symlinks. Default: no FollowDirectorySymlinks yes Follow regular file symlinks. Default: no FollowFileSymlinks yes Scan files and directories on other filesystems. Default: yes CrossFilesystems yes Perform a database check. Default: 600 (10 min) SelfCheck 600 Execute a command when virus is found. In the command string %v will be replaced with the virus name. Default: no VirusEvent /usr/local/bin/send_sms 123456789 "VIRUS ALERT: %v" Run as another user (clamd must be started by root for this option to work) Default: don't drop privileges

User clamscan

Stop daemon when libclamav reports out of memory condition. ExitOnOOM yes Don't fork into background. Default: no Foreground yes Enable debug messages in libclamav. Default: no Debug yes Do not remove temporary files (for debug purposes). Default: no LeaveTemporaryFiles yes Permit use of the ALLMATCHSCAN command. If set to no, clamd will reject any ALLMATCHSCAN command as invalid. Default: yes AllowAllMatchScan no Detect Possibly Unwanted Applications. Default: no DetectPUA yes Exclude a specific PUA category. This directive can be used multiple times. See https://github.com/vrtadmin/clamav-faq/blob/master/faq/faq-pua.md for the complete list of PUA categories. Default: Load all categories (if DetectPUA is activated) ExcludePUA NetTool ExcludePUA PWTool Only include a specific PUA category. This directive can be used multiple times. Default: Load all categories (if DetectPUA is activated) IncludePUA Spy IncludePUA Scanner IncludePUA RAT This option causes memory or nested map scans to dump the content to disk. If you turn on this option, more data is written to disk and is available when the LeaveTemporaryFiles option is enabled. ForceToDisk yes This option allows you to disable the caching feature of the engine. By default, the engine will store an MD5 in a cache of any files that are not flagged as virus or that hit limits checks. Disabling the cache will have a negative performance impact on large scans. Default: no DisableCache yes In some cases (eg. complex malware, exploits in graphic files, and others), ClamAV uses special algorithms to detect abnormal patterns and behaviors that may be malicious. This option enables alerting on such heuristically detected potential threats. Default: yes HeuristicAlerts yes Allow heuristic alerts to take precedence. When enabled, if a heuristic scan (such as phishingScan) detects a possible virus/phish it will stop scan immediately. Recommended, saves CPU scan-time. When disabled, virus/phish detected by heuristic scans will be reported only at the end of a scan. If an archive contains both a heuristically detected virus/phish, and a real malware, the real malware will be reported

#

Keep this disabled if you intend to handle ".Heuristics." viruses differently from "real" malware. If a non-heuristically-detected virus (signature-based) is found first, the scan is interrupted immediately, regardless of this config option.

#

Default: no HeuristicScanPrecedence yes #

Heuristic Alerts

# With this option clamav will try to detect broken executables (both PE and ELF) and alert on them with the Broken.Executable heuristic signature. Default: no AlertBrokenExecutables yes Alert on encrypted archives and documents with heuristic signature (encrypted .zip, .7zip, .rar, .pdf). Default: no AlertEncrypted yes Alert on encrypted archives with heuristic signature (encrypted .zip, .7zip, .rar). Default: no AlertEncryptedArchive yes Alert on encrypted archives with heuristic signature (encrypted .pdf). Default: no AlertEncryptedDoc yes With this option enabled OLE2 files containing VBA macros, which were not detected by signatures will be marked as "Heuristics.OLE2.ContainsMacros". Default: no AlertOLE2Macros yes Alert on SSL mismatches in URLs, even if the URL isn't in the database. This can lead to false positives. Default: no AlertPhishingSSLMismatch yes Alert on cloaked URLs, even if URL isn't in database. This can lead to false positives. Default: no AlertPhishingCloak yes Alert on raw DMG image files containing partition intersections Default: no AlertPartitionIntersection yes #

Executable files

# PE stands for Portable Executable - it's an executable file format used in all 32 and 64-bit versions of Windows operating systems. This option allows ClamAV to perform a deeper analysis of executable files and it's also required for decompression of popular executable packers such as UPX, FSG, and Petite. If you turn off this option, the original files will still be scanned, but without additional processing. Default: yes ScanPE yes Certain PE files contain an authenticode signature. By default, we check the signature chain in the PE file against a database of trusted and revoked certificates if the file being scanned is marked as a virus. If any certificate in the chain validates against any trusted root, but does not match any revoked certificate, the file is marked as whitelisted. If the file does match a revoked certificate, the file is marked as virus. The following setting completely turns off authenticode verification. Default: no DisableCertCheck yes Executable and Linking Format is a standard format for UN*X executables. This option allows you to control the scanning of ELF files. If you turn off this option, the original files will still be scanned, but without additional processing. Default: yes ScanELF yes #

Documents

# This option enables scanning of OLE2 files, such as Microsoft Office documents and .msi files. If you turn off this option, the original files will still be scanned, but without additional processing. Default: yes ScanOLE2 yes This option enables scanning within PDF files. If you turn off this option, the original files will still be scanned, but without decoding and additional processing. Default: yes ScanPDF yes This option enables scanning within SWF files. If you turn off this option, the original files will still be scanned, but without decoding and additional processing. Default: yes ScanSWF yes This option enables scanning xml-based document files supported by libclamav. If you turn off this option, the original files will still be scanned, but without additional processing. Default: yes ScanXMLDOCS yes This option enables scanning of HWP3 files. If you turn off this option, the original files will still be scanned, but without additional processing. Default: yes ScanHWP3 yes #

Mail files

# Enable internal e-mail scanner. If you turn off this option, the original files will still be scanned, but without parsing individual messages/attachments. Default: yes ScanMail yes Scan RFC1341 messages split over many emails. You will need to periodically clean up $TemporaryDirectory/clamav-partial directory. WARNING: This option may open your system to a DoS attack. Never use it on loaded servers. Default: no ScanPartialMessages yes With this option enabled ClamAV will try to detect phishing attempts by using HTML.Phishing and Email.Phishing NDB signatures. Default: yes PhishingSignatures no With this option enabled ClamAV will try to detect phishing attempts by analyzing URLs found in emails using WDB and PDB signature databases. Default: yes PhishingScanURLs no #

Data Loss Prevention (DLP)

# Enable the DLP module Default: No StructuredDataDetection yes This option sets the lowest number of Credit Card numbers found in a file to generate a detect. Default: 3 StructuredMinCreditCardCount 5 This option sets the lowest number of Social Security Numbers found in a file to generate a detect. Default: 3 StructuredMinSSNCount 5 With this option enabled the DLP module will search for valid SSNs formatted as xxx-yy-zzzz Default: yes StructuredSSNFormatNormal yes With this option enabled the DLP module will search for valid SSNs formatted as xxxyyzzzz Default: no StructuredSSNFormatStripped yes #

HTML

# Perform HTML normalisation and decryption of MS Script Encoder code. Default: yes If you turn off this option, the original files will still be scanned, but without additional processing. ScanHTML yes #

Archives

# ClamAV can scan within archives and compressed files. If you turn off this option, the original files will still be scanned, but without unpacking and additional processing. Default: yes ScanArchive yes #

Limits

# The options below protect your system against Denial of Service attacks using archive bombs. This option sets the maximum amount of data to be scanned for each input file. Archives and other containers are recursively extracted and scanned up to this value. Value of 0 disables the limit Note: disabling this limit or setting it too high may result in severe damage to the system. Default: 100M MaxScanSize 150M Files larger than this limit won't be scanned. Affects the input file itself as well as files contained inside it (when the input file is an archive, a document or some other kind of container). Value of 0 disables the limit. Note: disabling this limit or setting it too high may result in severe damage to the system. Default: 25M MaxFileSize 30M Nested archives are scanned recursively, e.g. if a Zip archive contains a RAR file, all files within it will also be scanned. This options specifies how deeply the process should be continued. Note: setting this limit too high may result in severe damage to the system. Default: 16 MaxRecursion 10 Number of files to be scanned within an archive, a document, or any other container file. Value of 0 disables the limit. Note: disabling this limit or setting it too high may result in severe damage to the system. Default: 10000 MaxFiles 15000 Maximum size of a file to check for embedded PE. Files larger than this value will skip the additional analysis step. Note: disabling this limit or setting it too high may result in severe damage to the system. Default: 10M MaxEmbeddedPE 10M Maximum size of a HTML file to normalize. HTML files larger than this value will not be normalized or scanned. Note: disabling this limit or setting it too high may result in severe damage to the system. Default: 10M MaxHTMLNormalize 10M Maximum size of a normalized HTML file to scan. HTML files larger than this value after normalization will not be scanned. Note: disabling this limit or setting it too high may result in severe damage to the system. Default: 2M MaxHTMLNoTags 2M Maximum size of a script file to normalize. Script content larger than this value will not be normalized or scanned. Note: disabling this limit or setting it too high may result in severe damage to the system. Default: 5M MaxScriptNormalize 5M Maximum size of a ZIP file to reanalyze type recognition. ZIP files larger than this value will skip the step to potentially reanalyze as PE. Note: disabling this limit or setting it too high may result in severe damage to the system. Default: 1M MaxZipTypeRcg 1M This option sets the maximum number of partitions of a raw disk image to be scanned. Raw disk images with more partitions than this value will have up to the value number partitions scanned. Negative values are not allowed. Note: setting this limit too high may result in severe damage or impact performance. Default: 50 MaxPartitions 128 This option sets the maximum number of icons within a PE to be scanned. PE files with more icons than this value will have up to the value number icons scanned. Negative values are not allowed. WARNING: setting this limit too high may result in severe damage or impact performance. Default: 100 MaxIconsPE 200 This option sets the maximum recursive calls for HWP3 parsing during scanning. HWP3 files using more than this limit will be terminated and alert the user. Scans will be unable to scan any HWP3 attachments if the recursive limit is reached. Negative values are not allowed. WARNING: setting this limit too high may result in severe damage or impact performance. Default: 16 MaxRecHWP3 16 This option sets the maximum calls to the PCRE match function during an instance of regex matching. Instances using more than this limit will be terminated and alert the user but the scan will continue. For more information on match_limit, see the PCRE documentation. Negative values are not allowed. WARNING: setting this limit too high may severely impact performance. Default: 100000 PCREMatchLimit 20000 This option sets the maximum recursive calls to the PCRE match function during an instance of regex matching. Instances using more than this limit will be terminated and alert the user but the scan will continue. For more information on match_limit_recursion, see the PCRE documentation. Negative values are not allowed and values > PCREMatchLimit are superfluous. WARNING: setting this limit too high may severely impact performance. Default: 2000 PCRERecMatchLimit 10000 This option sets the maximum filesize for which PCRE subsigs will be executed. Files exceeding this limit will not have PCRE subsigs executed unless a subsig is encompassed to a smaller buffer. Negative values are not allowed. Setting this value to zero disables the limit. WARNING: setting this limit too high or disabling it may severely impact performance. Default: 25M PCREMaxFileSize 100M When AlertExceedsMax is set, files exceeding the MaxFileSize, MaxScanSize, or MaxRecursion limit will be flagged with the virus "Heuristics.Limits.Exceeded". Default: no AlertExceedsMax yes #

On-access Scan Settings

# Enable on-access scanning. Currently, this is supported via fanotify. Clamuko/Dazuko support has been deprecated. Default: no ScanOnAccess yes Set the mount point to be scanned. The mount point specified, or the mount point containing the specified directory will be watched. If any directories are specified, this option will preempt the DDD system. This will notify only. It can be used multiple times. (On-access scan only) Default: disabled OnAccessMountPath / OnAccessMountPath /home/user Don't scan files larger than OnAccessMaxFileSize Value of 0 disables the limit. Default: 5M OnAccessMaxFileSize 10M Set the include paths (all files inside them will be scanned). You can have multiple OnAccessIncludePath directives but each directory must be added in a separate line. (On-access scan only) Default: disabled OnAccessIncludePath /home OnAccessIncludePath /students Set the exclude paths. All subdirectories are also excluded. (On-access scan only) Default: disabled OnAccessExcludePath /home/bofh With this option you can whitelist the root UID (0). Processes run under root with be able to access all files without triggering scans or permission denied events. Note that if clamd cannot check the uid of the process that generated an on-access scan event (e.g., because OnAccessPrevention was not enabled, and the process already exited), clamd will perform a scan. Thus, setting OnAccessExcludeRootUID is not guaranteed to prevent every access by the root user from triggering a scan (unless OnAccessPrevention is enabled). Default: no OnAccessExcludeRootUID no With this option you can whitelist specific UIDs. Processes with these UIDs will be able to access all files without triggering scans or permission denied events. This option can be used multiple times (one per line). Using a value of 0 on any line will disable this option entirely. To whitelist the root UID (0) please enable the OnAccessExcludeRootUID option. Also note that if clamd cannot check the uid of the process that generated an on-access scan event (e.g., because OnAccessPrevention was not enabled, and the process already exited), clamd will perform a scan. Thus, setting OnAccessExcludeUID is not guaranteed to prevent every access by the specified uid from triggering a scan (unless OnAccessPrevention is enabled). Default: disabled OnAccessExcludeUID -1 Toggles dynamic directory determination. Allows for recursively watching include paths. (On-access scan only) Default: no OnAccessDisableDDD yes Modifies fanotify blocking behaviour when handling permission events. If off, fanotify will only notify if the file scanned is a virus, and not perform any blocking. (On-access scan only) Default: no OnAccessPrevention yes Toggles extra scanning and notifications when a file or directory is created or moved. Requires the DDD system to kick-off extra scans. NOTE: This feature is disabled until a thread resource leak bug in the OnAccessExtraScanning code can be resolved. (On-access scan only) Default: no OnAccessExtraScanning yes #

Bytecode

# With this option enabled ClamAV will load bytecode from the database. It is highly recommended you keep this option on, otherwise you'll miss detections for many new viruses. Default: yes Bytecode yes Set bytecode security level. Possible values: None - No security at all, meant for debugging. DO NOT USE THIS ON PRODUCTION SYSTEMS. This value is only available if clamav was built with --enable-debug! TrustSigned - Trust bytecode loaded from signed .c[lv]d files, insert runtime safety checks for bytecode loaded from other sources. Paranoid - Don't trust any bytecode, insert runtime checks for all. Recommended: TrustSigned, because bytecode in .cvd files already has these checks. Note that by default only signed bytecode is loaded, currently you can only load unsigned bytecode in --enable-debug mode.

#

Default: TrustSigned BytecodeSecurity TrustSigned Set bytecode timeout in milliseconds. Default: 5000 BytecodeTimeout 1000 #

Statistics gathering and submitting

#

LocalSocketMode 666

Okay, there's a line near the top of that file that simple reads:

Example

Can you comment that out, and then try enabling that ClamAV setting again?

When you say "try enabling setting again", how you want me to do it?

i commented that line but how to enable this setting?

I believe you initially ran into that issue when trying the steps in Comment #9/#10.

My suggestion would be to take a peek at Comment #9, and to try the settings mentioned in there.

If you have any questions on that, please feel free to let us know!

When i do it, i get this error:

The selected virus scanning command does not work : ----------- SCAN SUMMARY ----------- Infected files: 0 Time: 0.000 sec (0 m 0 s)

It's start to be really urgent. Our system is really slow and tons of customers complaints.

Can you help us with this asap please.

If necessary, i will give you access to make some tests.

thanks

If it's urgent, what you may want to due is temporarily disable ClamAV to see if that helps.

That will at least ensure that we're looking at the right place.

When you shared your "ps" list above, it wasn't really looking like ClamAV was using a particularly large amount of resources.

And in fact, the only ClamAV process using a noticeable amount of resources wasn't even being used for email scanning. The lone ClamAV process I see there is the daemon, which currently isn't in use (that is, that's what we're trying to switch to, but at the moment it's just sitting there).

There were no ClamAV process active that were scanning an email. Any resources being used at that time wouldn't be helped by us changing any ClamAV settings.

My suspicion is that one of those other processes we saw above that were using a lot of CPU time is the culprit of any resources issues -- though something could be using up a lot of disk IO as well, that can cause issues too.

Now, I'm more than happy to help switch over to the ClamAV server scanner, as that should work, and it never hurts to rule it out.

As far as making that switch to the ClamAV server scanner --

Just to be super sure I understand what you're saying -- you're saying that when going into Email Messages -> Spam and Virus Scanning, and you set "Virus Scanning Program" to "Local Server Scanner", and then click "Save", you're receiving an error?

That's an odd one, but it could indicate that there's a problem with the ClamAV config.

I'd be curious if you're able to restart ClamAV with this command:

service clamd@scan.service restart

If that doesn't work, what error gets generated in the logs? ClamAV messages on CentOS usually are shown in /var/log/messages.

I was looking into what the problem there could be... I searched on that error, and I believe the most recent occurrence of that same issue was your post from 2014 :-)

You apparently were having the same trouble switching to the server scanner back then, we never did figure that out.

Since restarting the ClamAV service isn't generating an error, I think what I'd need to do is work with Jamie to figure out exactly what command line is being run that isn't working properly. The only trouble there is that he's traveling, so I don't know when exactly he'll be able to respond.

Here's what I'd suggest in the meantime --

Just to rule some things out, what is the output of this command... this will show which ClamAV packages are being used:

rpm -qa | grep -i clamav

And then, would you like a hand with how to temporarily disable ClamAV altogether?

As it might be good just to learn whether or not it really is causing the trouble you're seeing. What we can do is disable the ClamAV feature in Virtualmin, and then stop the ClamAV service -- and then we can look at what sort of performance you get afterwards.