Imunify360 cronjob processes cause Plesk server resources overload: /var/run/defence360agent/simple_rpc.sock

Symptoms

• Imunify360 cronjob processes cause Plesk server resources overload.
• Hundreds of processes as below can be found:

  _ /bin/sh -c echo '{"command": ["malware", "on-demand", "check-detached"], "params": {}}' | nc -U /var/run/defence360agent/simple_rpc.sock > /dev/null 2>&1 || :
  7971 ? S 0:00 | _ nc -U /var/run/defence360agent/simple_rpc.sock

Cause

Imunify360 bug  DEF-25815 which will be fixed in version 7.5.3.

Resolution

As a workaround:

1. Log in to Plesk via SSH
2. Back up cronjob file:

   # cp /etc/cron.d/imunify-antivirus /root/imunify-antivirus.bak

3. Apply the fix:

   # cat > /etc/cron.d/imunify-antivirus <<EOF
   PATH=/usr/local/sbin:/usr/sbin:/sbin:/usr/local/bin:/usr/bin:/bin
   # Every Saturday at 1:25
   25 1 * * 6 root /usr/bin/tmpwatch 168 /var/imunify360/tmp
   # Every 5 minutes. Ignore "ERROR: imunify360 service is running."
   */5 * * * * root echo '{"command": ["malware", "on-demand", "check-detached"], "params": {}}' | socat -T 5 - UNIX-CONNECT:/var/run/defence360agent/simple_rpc.sock > /dev/null 2>&1 || :
   17 4 * * * root /usr/libexec/report-command-error /opt/imunify360/venv/share/imunify360/scripts/update_components_versions.py > /dev/null 2>&1
   EOF

4. Kill the hung processes:

   # ps aux | grep defence360agent | grep -v grep | awk '{print $2}' | xargs kill -9