I resolved this by running yum update. Seems it was some bug which got fixed with an update.

Clamd high CPU usage

So this morning our server reported the message

Sep 5 05:10:36 server kernel: Out of memory: Kill process 4433 (clamd) score 43 or sacrifice child
Sep 5 05:10:36 server kernel: Killed process 4433 (clamd) total-vm:3062016kB, anon-rss:72932kB, file-rss:0kB, shmem-rss:0kB
Sep 5 05:10:36 server systemd-logind: Failed to start session scope session-133706.scope: Connection timed out (null)
Sep 5 05:10:36 server systemd-logind: Failed to start session scope session-133705.scope: Connection timed out (null)
Sep 5 05:10:36 server systemd: clamd.service: main process exited, code=killed, status=9/KILL
Sep 5 05:10:36 server systemd: Unit clamd.service entered failed state.
Sep 5 05:10:36 server systemd: clamd.service failed.
Sep 5 05:10:36 server systemd: clamd.service holdoff time over, scheduling restart.

After that it seems the clamd / clamscan services started using close to 100% CPU usage.

I checked the clamd.log and i can see this reoccurring message below.

Thu Sep 5 09:41:10 2019 -> +++ Started at Thu Sep 5 09:41:10 2019
Thu Sep 5 09:41:10 2019 -> Received 0 file descriptor(s) from systemd.
Thu Sep 5 09:41:10 2019 -> clamd daemon 0.99.2 (OS: linux-gnu, ARCH: x86_64, CPU: x86_64)
Thu Sep 5 09:41:10 2019 -> Running as user clam (UID 989, GID 988)
Thu Sep 5 09:41:10 2019 -> Log file size limited to 4294967295 bytes.
Thu Sep 5 09:41:10 2019 -> Reading databases from /var/lib/clamav
Thu Sep 5 09:41:10 2019 -> Not loading PUA signatures.
Thu Sep 5 09:41:10 2019 -> Bytecode: Security mode set to "TrustSigned".
Thu Sep 5 09:42:41 2019 -> +++ Started at Thu Sep 5 09:42:41 2019
Thu Sep 5 09:42:41 2019 -> Received 0 file descriptor(s) from systemd.
Thu Sep 5 09:42:41 2019 -> clamd daemon 0.99.2 (OS: linux-gnu, ARCH: x86_64, CPU: x86_64)
Thu Sep 5 09:42:41 2019 -> Running as user clam (UID 989, GID 988)
Thu Sep 5 09:42:41 2019 -> Log file size limited to 4294967295 bytes.
Thu Sep 5 09:42:41 2019 -> Reading databases from /var/lib/clamav
Thu Sep 5 09:42:41 2019 -> Not loading PUA signatures.
Thu Sep 5 09:42:41 2019 -> Bytecode: Security mode set to "TrustSigned".
Thu Sep 5 09:44:11 2019 -> +++ Started at Thu Sep 5 09:44:11 2019
Thu Sep 5 09:44:11 2019 -> Received 0 file descriptor(s) from systemd.
Thu Sep 5 09:44:11 2019 -> clamd daemon 0.99.2 (OS: linux-gnu, ARCH: x86_64, CPU: x86_64)
Thu Sep 5 09:44:11 2019 -> Running as user clam (UID 989, GID 988)
Thu Sep 5 09:44:11 2019 -> Log file size limited to 4294967295 bytes.
Thu Sep 5 09:44:11 2019 -> Reading databases from /var/lib/clamav
Thu Sep 5 09:44:11 2019 -> Not loading PUA signatures.
Thu Sep 5 09:44:11 2019 -> Bytecode: Security mode set to "TrustSigned".
Thu Sep 5 09:45:42 2019 -> +++ Started at Thu Sep 5 09:45:42 2019
Thu Sep 5 09:45:42 2019 -> Received 0 file descriptor(s) from systemd.
Thu Sep 5 09:45:42 2019 -> clamd daemon 0.99.2 (OS: linux-gnu, ARCH: x86_64, CPU: x86_64)
Thu Sep 5 09:45:42 2019 -> Running as user clam (UID 989, GID 988)
Thu Sep 5 09:45:42 2019 -> Log file size limited to 4294967295 bytes.
Thu Sep 5 09:45:42 2019 -> Reading databases from /var/lib/clamav
Thu Sep 5 09:45:42 2019 -> Not loading PUA signatures.
Thu Sep 5 09:45:42 2019 -> Bytecode: Security mode set to "TrustSigned".

I tried to restart clamd which just timed out.

I guessed it was a system-mysqld issue. So I tried

service system-mysqld restart

which gave me the message

Failed to restart system-mysqld.service: Unit not found.

I've been searching through the forums trying to see how I can rebuild the system-mysqld without success.

Does anyone have an idea on what the issue could be and how to resolve it?

Hi,

I tried that with little success.

If i run the df -h command, then I see that the /dev/mapper.clearos-root is using 781Gb of the drive.



If i then run the du -h --max-depth=1 / it points me to the /var/flexshare folder.



However i have moved the data for /var/flexshare/shares/photos, /var/flexshare/shares/development and /var/flexshare/shares/backups to the 2Tb drive mounted on /Backups with bind mounts to the /var/flexshare/shares folder. Have I done something wrong in the fstab file?

Hi,

Thanks for the offer - I would happily accept help on this as it has me stumped. I've output the commands below:

Hi,

Thanks for the responses. No, I have not completely resolved this. I moved my flexshares to an external drive and then used bind mounts for them. This brought my disc usage down from 100% to <90%. It's not ideal, but at least I can change/modify configuration without the Ooops message. The disc usage tool shows I'm only using <40Gb where the system report shows I'm using 780Gb. I think i may get a replacement solid state and do a fresh install. Then I can check the drive without hampering the live server.

Thanks!

Server is running low on available disk space

My system (ClearOS V7.3.0) has started popping up with the message

Ooooops: Server is running low on available disk space - preventing further modifications via API until disk space issues are resolved.

.

My system summary shows the /dev/mapper/clearos-root as being 100% used. This is a 1Tb solid state drive. The biggest directory is my VAR at 165Gb, but the next biggest is the USR at only 2.3Gb. In total, i shouldn't be using more than 200Gb.



I ran the command below, but this didn't highlight anything other than my flexshare folders.


I just can't seem to see where 916Gb is being used. Any ideas?

Manual Phrase Lists

I'm running the business version of ClearOS 7 and am having issues recently with the content filter. Recently we are receiving allot of emails regarding weight loss and diet pills. I have selected all the relevant phrase lists in the content filter, but it's not picking up these emails. For the most part, the SPAM filter is picking them up, but the level is not enough for them to be automatically discarded by the antispam. My content filter is updating as it should - i'm just guessing these these are new phrases and yet to be added to the content filter.

Is there a way to manually add phrases to the content filter? Or is there a way to suggest additions to the content filter moderators to add to the next update?

Thanks in advance.

Is there any permanent fix to using SSL on the clearOS7 system? I have SSL on multiple virtual sites running on ClearOS7, but it's a pain as each time there is an update, the flex-80.conf file is autocreated and I have to manually remove the section below from the file. Is there specific folder permissions i need to apply or something?

<Directory /var/www/virtual/websitename.com>
Options +Indexes +FollowSymLinks -IncludesNOExec
AllowOverride All
Require all granted
</Directory>

I found out that the <Directory....</Directory> in the flex-80.conf file is what is breaking the system. No matter what options you select in the webconfig, this just stops the pointing. I have deleted this and my site is working and the SSL is working too. It's just a pain that this is an autocreated file so I have no idea how long it's going to work for.

<Directory /var/www/html>
Options +Indexes -FollowSymLinks -IncludesNOExec
AllowOverride All
Require all granted
</Directory>

Little checking since my last post. The httpd service failed due to SSL certificate (Unable to configure RSA server private key). If I don't use SSL, then the httpd server starts up. However it does not direct to virtual sites. I see that webconfig has now created a file /etc/http/conf.d/flex-80.conf as well as flex-443.conf files. However they don't seem to have any affect. If I copy my old virtual.website.com.conf file into the /etc/httpd/conf.d directory then the directing to the virtual website works again. However I'm back at square one where I can't use the SSL.