Kill antimalware threads

[dan.letkeman]

I noticed sometimes that the antimalware engine will eat up the cpu at 350% for more than 30 minutes.  If I run this command: /opt/mwg/bin/mwg-antimalware -S threads

I get this kind of output:

Thread Status at 2015-09-22 16:36:19

Thread Limits:   count: 29,   stack usage: 30408704 bytes

-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Thread ID   Thread type                       constructed           started               last ping             Status     Info

-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

8943        CAMVersionControlThread           2015-09-11 00:45:17   2015-09-11 00:45:17   2015-09-22 16:36:19   Stepping   [status] waiting for command

31769       CAMProcessThread                  2015-09-22 15:49:23   2015-09-22 15:49:23   2015-09-22 16:36:19   Stepping   [status] working on command kExFuScanMemory, URL http://chuck.nodeservers.net/containers/atl//libraries/launcher/guava-17.0.jar, object com/google/common/escape/ArrayBasedUnicodeEscaper.class

31762       CAMProcessThread                  2015-09-22 15:49:23   2015-09-22 15:49:23   2015-09-22 16:36:19   Stepping   [status] working on command kExFuScanMemory, URL http://bruce.nodeservers.net/containers/atl//libraries/launcher/guava-17.0.jar, object com/google/common/collect/ImmutableMapEntrySet.class

31753       CAMProcessThread                  2015-09-22 15:49:23   2015-09-22 15:49:23   2015-09-22 16:36:19   Stepping   [status] working on command kExFuScanMemory, URL http://download.nodecdn.net/containers/atl//libraries/launcher/guava-17.0.jar, object com/google/common/collect/Maps$DescendingMap.class

31745       CAMProcessThread                  2015-09-22 15:49:23   2015-09-22 15:49:23   2015-09-22 16:36:19   Stepping   [status] working on command kExFuScanMemory, URL http://bill.nodeservers.net/containers/atl//libraries/launcher/guava-17.0.jar, object com/google/common/collect/LinkedHashMultiset.class

8942        CAMVersionAbortedThreadsManager   2015-09-11 00:45:17   2015-09-11 00:45:17   2015-09-22 16:36:18   Stepping

8937        main                              2015-09-11 00:45:17   2015-09-11 00:45:17   2015-09-22 16:36:19   Running    [status] processing message

31765       CAMProcessThread                  2015-09-22 15:49:23   2015-09-22 15:49:23   2015-09-22 16:36:19   Stepping   [status] working on command kExFuScanMemory, URL http://lisa.nodeservers.net/containers/atl//libraries/launcher/guava-17.0.jar, object com/google/common/collect/MapMakerInternalMap$EntryFactory$8.class

-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Is there anyway I can kill these threads?

Thanks,

Dan.

[trishoar]

Hi Dan,

You would do better tuning the policy to exclude requests from Anti-Malware that you don't want to scan rather than randomly killing threads. I'd guess the most probable outcome of doing that is crashing the Anti-Malware process.

Tris

[dan.letkeman]

I have added these url's to the exclude list, but the web gateway will scan these files for hours, and short of restarting the gateway I didn't find a solution to stop the cpu from being pinned.