Over the past few weeks, I have a server that is using very high CPU when Amavis and Clamscan are running. I've had to restart the server several times because it just brings it to a halt. Below is what I pulled from the error logs. Hoping someone can point me into the right direction. Code: Mon Oct 26 07:25:04 2015 -> SelfCheck: Database status OK. Mon Oct 26 07:48:20 2015 -> --- Stopped at Mon Oct 26 07:48:20 2015 Mon Oct 26 07:48:32 2015 -> +++ Started at Mon Oct 26 07:48:32 2015 Mon Oct 26 07:48:32 2015 -> Received 1 file descriptor(s) from systemd. Mon Oct 26 07:48:32 2015 -> clamd daemon 0.98.7 (OS: linux-gnu, ARCH: x86_64, CPU: x86_64) Mon Oct 26 07:48:32 2015 -> Running as user clamav (UID 113, GID 123) Mon Oct 26 07:48:32 2015 -> Log file size limited to 4294967295bytes. Mon Oct 26 07:48:32 2015 -> Reading databases from /var/lib/clamav Mon Oct 26 07:48:32 2015 -> Not loading PUA signatures. Mon Oct 26 07:48:32 2015 -> Bytecode: Security mode set to "TrustSigned". Mon Oct 26 07:48:42 2015 -> Loaded 4049404 signatures. Mon Oct 26 07:48:44 2015 -> TCP: No tcp AF_INET/AF_INET6 SOCK_STREAM socket received from systemd. Mon Oct 26 07:48:44 2015 -> LOCAL: Received AF_UNIX SOCK_STREAM socket from systemd. Mon Oct 26 07:48:44 2015 -> Limits: Global size limit set to 104857600 bytes. Mon Oct 26 07:48:44 2015 -> Limits: File size limit set to 26214400 bytes. Mon Oct 26 07:48:44 2015 -> Limits: Recursion level limit set to 10. Mon Oct 26 07:48:44 2015 -> Limits: Files limit set to 10000. Mon Oct 26 07:48:44 2015 -> Limits: MaxEmbeddedPE limit set to 10485760 bytes. Mon Oct 26 07:48:44 2015 -> Limits: MaxHTMLNormalize limit set to 10485760 bytes. Mon Oct 26 07:48:44 2015 -> Limits: MaxHTMLNoTags limit set to 2097152 bytes. Mon Oct 26 07:48:44 2015 -> Limits: MaxScriptNormalize limit set to 5242880 bytes. Mon Oct 26 07:48:44 2015 -> Limits: MaxZipTypeRcg limit set to 1048576 bytes. Mon Oct 26 07:48:44 2015 -> Limits: MaxPartitions limit set to 50. Mon Oct 26 07:48:44 2015 -> Limits: MaxIconsPE limit set to 100. Mon Oct 26 07:48:44 2015 -> Archive support enabled. Mon Oct 26 07:48:44 2015 -> Algorithmic detection enabled. Mon Oct 26 07:48:44 2015 -> Portable Executable support enabled. Mon Oct 26 07:48:44 2015 -> ELF support enabled. Mon Oct 26 07:48:44 2015 -> Mail files support enabled. Mon Oct 26 07:48:44 2015 -> OLE2 support enabled. Mon Oct 26 07:48:44 2015 -> PDF support enabled. Mon Oct 26 07:48:44 2015 -> SWF support enabled. Mon Oct 26 07:48:44 2015 -> HTML support enabled. Mon Oct 26 07:48:44 2015 -> Self checking every 3600 seconds. Mon Oct 26 07:48:44 2015 -> WARNING: lstat() failed on: /var/lib/amavis/tmp/amavis-20151026T074837-01381-FkA2kla4/parts Mon Oct 26 07:48:44 2015 -> WARNING: lstat() failed on: /var/lib/amavis/tmp/amavis-20151026T074837-01380-N7AoW57b/parts Mon Oct 26 07:48:58 2015 -> WARNING: lstat() failed on: /var/lib/amavis/tmp/amavis-20151026T074837-01381-FkA2kla4/parts Mon Oct 26 07:49:05 2015 -> WARNING: lstat() failed on: /var/lib/amavis/tmp/amavis-20151026T074837-01380-N7AoW57b/parts Mon Oct 26 07:49:12 2015 -> WARNING: lstat() failed on: /var/lib/amavis/tmp/amavis-20151026T074837-01381-FkA2kla4/parts Mon Oct 26 07:49:23 2015 -> WARNING: lstat() failed on: /var/lib/amavis/tmp/amavis-20151026T074837-01380-N7AoW57b/parts Mon Oct 26 07:49:31 2015 -> WARNING: lstat() failed on: /var/lib/amavis/tmp/amavis-20151026T074837-01381-FkA2kla4/parts Mon Oct 26 07:49:43 2015 -> WARNING: lstat() failed on: /var/lib/amavis/tmp/amavis-20151026T074837-01380-N7AoW57b/parts Mon Oct 26 07:49:50 2015 -> WARNING: lstat() failed on: /var/lib/amavis/tmp/amavis-20151026T074837-01381-FkA2kla4/parts Mon Oct 26 07:50:01 2015 -> WARNING: lstat() failed on: /var/lib/amavis/tmp/amavis-20151026T074837-01380-N7AoW57b/parts Mon Oct 26 07:50:05 2015 -> WARNING: lstat() failed on: /var/lib/amavis/tmp/amavis-20151026T074837-01381-FkA2kla4/parts Mon Oct 26 07:50:18 2015 -> WARNING: lstat() failed on: /var/lib/amavis/tmp/amavis-20151026T074837-01381-FkA2kla4/parts Mon Oct 26 07:50:21 2015 -> WARNING: lstat() failed on: /var/lib/amavis/tmp/amavis-20151026T074837-01380-N7AoW57b/parts Mon Oct 26 07:50:33 2015 -> WARNING: lstat() failed on: /var/lib/amavis/tmp/amavis-20151026T074837-01381-FkA2kla4/parts Mon Oct 26 07:50:42 2015 -> WARNING: lstat() failed on: /var/lib/amavis/tmp/amavis-20151026T074837-01380-N7AoW57b/parts Mon Oct 26 07:50:52 2015 -> WARNING: lstat() failed on: /var/lib/amavis/tmp/amavis-20151026T074837-01381-FkA2kla4/parts Mon Oct 26 07:50:58 2015 -> WARNING: lstat() failed on: /var/lib/amavis/tmp/amavis-20151026T074837-01380-N7AoW57b/parts Mon Oct 26 07:51:06 2015 -> WARNING: lstat() failed on: /var/lib/amavis/tmp/amavis-20151026T074837-01381-FkA2kla4/parts Mon Oct 26 07:51:16 2015 -> WARNING: lstat() failed on: /var/lib/amavis/tmp/amavis-20151026T074837-01380-N7AoW57b/parts Mon Oct 26 07:51:22 2015 -> WARNING: lstat() failed on: /var/lib/amavis/tmp/amavis-20151026T074837-01381-FkA2kla4/parts Mon Oct 26 07:51:33 2015 -> WARNING: lstat() failed on: /var/lib/amavis/tmp/amavis-20151026T074837-01380-N7AoW57b/parts Mon Oct 26 08:51:33 2015 -> No stats for Database check - forcing reload Mon Oct 26 08:51:34 2015 -> Reading databases from /var/lib/clamav Mon Oct 26 08:51:44 2015 -> Database correctly reloaded (4049404 signatures) Mon Oct 26 09:48:46 2015 -> Reading databases from /var/lib/clamav Mon Oct 26 09:48:55 2015 -> Database correctly reloaded (4050119 signatures)
How much ram does the server has and hoch much Amavisd processes do you run? Did you check the mail.log to see how many mails come in or go out? The load that Amavisd and clamav are causing should be directly coupled to the amount of emails that get scanned.
Thanks. It was 2, but I've now got it down to one by using the information from this thread: https://www.howtoforge.com/community/threads/amavisd-processes.64861/ I am still testing to see if that is the issue or not. I just recently come across the error "Reload failed for LSB: Start and stop the mysql database server daemon." which maybe the real cause of my issue. It would be strange in my opinion that amavis is the one bringing the whole server to a halt, however, I still needed to deal with the high CPU usage. Or the MySQL issue could be a by product of the amavis issue.
