Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 12 replies
  • Subscribers 2 subscribers
  • Views 8468 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

cssd high cpu load

Revan
Good morning,

i noticed a high cpu load on our utm since yesterday.
I had a look with the "top" command and it turns out that the process "cssd" is causing the load.

In my smtp log there is cssd mentioned:

2014:12:04-08:26:30 utm-1 exim-in[2362]: 2014-12-04 08:26:30 1XwQlm-0000c6-1W malware acl condition: cssd: unable to read from socket (Connection timed out)
2014:12:04-08:26:30 utm-1 exim-in[2362]: 2014-12-04 08:26:30 1XwQlm-0000c6-1W H=smtp.schlafhorst-electronics.de [62.159.121.211]:22925 Warning: ACL "warn" statement skipped: condition test deferred 


Searching in the forums regarding the error messages shows me an unsolved thread from 2011.

Could anyone help me on this?

Edit: The problem persists after a complete reboot.


This thread was automatically locked due to age.
Parents
  • 0
    Hi, Revan, you've not been venturing much out of the German Forum recently.  [;)]

    I think (this is an educated guess) that happens when cssd rebuilds the Avira anti-virus database after pattern updates.  Until it's finished, it just gobbles memory and CPU cycles.

    I have two clients that can't afford to upgrade, so I set their pattern updates to manual and then added the following line to /etc/crontab-static (check after major Up2dates that it's still in place) to have pattern updates occur every morning at 4AM:

    0 4 * * 0,1,2,3,4,5,6 root /sbin/audld.plx --nosys --trigger


    The real solution may be to replace the 220s with SG 135s or 210s.

    Cheers - Bob
    PS To force WebAdmin to regenerate /etc/crontab immediately, toggle 'Firmware download interval': '"Monthly" [Apply] "Manual" [Apply].
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Reply
  • 0
    Hi, Revan, you've not been venturing much out of the German Forum recently.  [;)]

    I think (this is an educated guess) that happens when cssd rebuilds the Avira anti-virus database after pattern updates.  Until it's finished, it just gobbles memory and CPU cycles.

    I have two clients that can't afford to upgrade, so I set their pattern updates to manual and then added the following line to /etc/crontab-static (check after major Up2dates that it's still in place) to have pattern updates occur every morning at 4AM:

    0 4 * * 0,1,2,3,4,5,6 root /sbin/audld.plx --nosys --trigger


    The real solution may be to replace the 220s with SG 135s or 210s.

    Cheers - Bob
    PS To force WebAdmin to regenerate /etc/crontab immediately, toggle 'Firmware download interval': '"Monthly" [Apply] "Manual" [Apply].
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Children
No Data
Unfiltered HTML