Suddenly very high CPU usage - since 8 June.

[David Gessel]

There's been no indication this has been a problem before, and it isn't going away.  No (intentional) changes to the server environment. 

If I reboot the server, there's no issue for a few hours, then CPU usage spikes and stays high.

vscan     1326 100.0  0.2 302296 152628  -  RJ    8:47PM 259:14.14 /usr/local/sbin/amavisd (ch19-01326-19) (perl)
vscan     3686 100.0  0.2 294104 148056  -  RJ   10:13PM  58:20.42 /usr/local/sbin/amavisd (ch8-03686-08) (perl)
vscan     4038 100.0  0.2 306392 157836  -  RJ   10:27PM 130:49.56 /usr/local/sbin/amavisd (ch3-04038-03) (perl)
vscan     5016 100.0  0.2 294104 144776  -  RJ   11:07PM 215:25.47 /usr/local/sbin/amavisd (ch1-05016-01) (perl)
vscan    14423 100.0  0.2 294104 145000  -  RJ    5:24PM 592:52.04 /usr/local/sbin/amavisd (ch7-14423-07) (perl)
vscan     3635   0.0  0.2 298200 149484  -  IJ   10:12PM   0:39.91 /usr/local/sbin/amavisd (ch15-avail) (perl)
vscan     4861   0.0  0.2 294104 147072  -  IJ   11:01PM   0:30.49 /usr/local/sbin/amavisd (ch12-avail) (perl)
vscan     4982   0.0  0.2 302296 152800  -  IJ   11:06PM   0:43.86 /usr/local/sbin/amavisd (ch11-avail) (perl)
vscan    31016   0.0  0.2 288648 142588  -  SsJ   3:44PM   0:03.94 /usr/local/sbin/amavisd (master) (perl)
root     82272   0.0  0.0  18608   2072  3  S+J   4:02AM   0:00.00 grep perl



last pid: 84777;  load averages:  5.67,  5.57,  5.53   up 40+04:27:30  04:05:22
71 processes:  6 running, 65 sleeping
CPU: 65.7% user,  0.0% nice,  2.1% system,  0.0% interrupt, 32.2% idle
Mem: 781M Active, 18G Inact, 41G Wired, 156M Cache, 1655M Buf, 1863M Free
ARC: 30G Total, 18G MFU, 6768M MRU, 1021K Anon, 505M Header, 5649M Other
Swap: 24G Total, 104K Used, 24G Free

  PID USERNAME     THR PRI NICE   SIZE    RES STATE   C   TIME    WCPU COMMAND
14423 vscan          1 103    0   287M   142M CPU5    5 595:42 100.00% perl
 1326 vscan          1 103    0   295M   149M RUN     6 262:05 100.00% perl
 5016 vscan          1 103    0   287M   141M CPU2    2 218:16 100.00% perl
 4038 vscan          1 103    0   299M   154M CPU4    4 133:40 100.00% perl
 3686 vscan          1 103    0   287M   145M CPU0    0  61:11 100.00% perl


FreeBSD 10.3-RELEASE-p28 #0 r330946: Thu Mar 15 00:23:40 PDT 2018 



amavisd-new-2.11.0_2,1 
clamav-0.100.0_1
dovecot-2.3.1_3
dovecot-pigeonhole-0.5.1
perl5-5.26.2
postfix-3.3.1,1 
spamassassin-3.4.1_11


Possibly just an attack using all resources?  I'm not seeing much in the logs - but the hints are that it doesn't begin again immediately after a restart, no installed software changes, and there has been a significant uptick in random SSH login attempts.