Cobra Forum

Symptoms

• Imunify360 cronjob processes cause Plesk server resources overload.
• Hundreds of processes as below can be found:
  
  Code Select Expand
  \_ /bin/sh -c echo '{"command": ["malware", "on-demand", "check-detached"], "params":
{}}' | nc -U /var/run/defence360agent/simple_rpc.sock > /dev/null 2>&1 || :
7971 ? S 0:00 | \_ nc -U /var/run/defence360agent/simple_rpc.sock


Cause

Imunify360 bug  DEF-25815 which will be fixed in version 7.5.3.

Resolution

As a workaround:

• Log in to Plesk via SSH
• Back up cronjob file:
  
  Code Select Expand
  # cp /etc/cron.d/imunify-antivirus /root/imunify-antivirus.bak
• Apply the fix:
  
  Code Select Expand
  # cat > /etc/cron.d/imunify-antivirus <<EOF
PATH=/usr/local/sbin:/usr/sbin:/sbin:/usr/local/bin:/usr/bin:/bin
# Every Saturday at 1:25
25 1 * * 6 root /usr/bin/tmpwatch 168 /var/imunify360/tmp
# Every 5 minutes. Ignore "ERROR: imunify360 service is running."
*/5 * * * * root echo '{"command": ["malware", "on-demand", "check-detached"],
"params": {}}' | socat -T 5 - UNIX-CONNECT:/var/run/defence360agent/simple_rpc.sock
> /dev/null 2>&1 || :
17 4 * * * root /usr/libexec/report-command-error
/opt/imunify360/venv/share/imunify360/scripts/update_components_versions.py >
/dev/null 2>&1
EOF
• Kill the hung processes:
  
  Code Select Expand
  # ps aux | grep defence360agent | grep -v grep | awk '{print $2}' | xargs kill -9