High CPU on EX4 seems to be caused by ClamAV

My Cloud OS 3 Personal & Network Attached Storage My Cloud EX4
1

I have an issue on my EX4 where the device become unresponsive after a day or so.
I was doing a hard reset to get it back to normal but thats not really a solution!
I tried disabling everything I could on the system cos all I use it for is file storage (i.e. no media DNLA or apps etc)
So I enabled SSH and was looking today when it happened again.
run the top command and noticed lots of clamav processes running and when I did a killall on clamav the system went back to normal and I can browse the EX4 web interface.

I didn’t realize the system did any virus scanning but as its there rather not just disable it.

The had a look at the cron table “contab -l” and it looks like the clamav is configured to run multiple times. i.e.

0 6 * * * clamav -f /mnt/HD/HD_a2/.systemfile/clamav/log/DailyScan.log -a DailyScan -c jobstop &
0 0 * * * clamav -f /mnt/HD/HD_a2/.systemfile/clamav/log/DailyScan.log -a DailyScan -c jobrun &
0 6 * * * clamav -f /mnt/HD/HD_a2/.systemfile/clamav/log/DailyScan.log -a DailyScan -c jobstop &
0 0 * * * clamav -f /mnt/HD/HD_a2/.systemfile/clamav/log/DailyScan.log -a DailyScan -c jobrun &
0 6 * * * clamav -f /mnt/HD/HD_a2/.systemfile/clamav/log/DailyScan.log -a DailyScan -c jobstop &
0 0 * * * clamav -f /mnt/HD/HD_a2/.systemfile/clamav/log/DailyScan.log -a DailyScan -c jobrun &
0 6 * * * clamav -f /mnt/HD/HD_a2/.systemfile/clamav/log/DailyScan.log -a DailyScan -c jobstop &
0 0 * * * clamav -f /mnt/HD/HD_a2/.systemfile/clamav/log/DailyScan.log -a DailyScan -c jobrun &
0 6 * * * clamav -f /mnt/HD/HD_a2/.systemfile/clamav/log/DailyScan.log -a DailyScan -c jobstop &
0 0 * * * clamav -f /mnt/HD/HD_a2/.systemfile/clamav/log/DailyScan.log -a DailyScan -c jobrun &
0 6 * * * clamav -f /mnt/HD/HD_a2/.systemfile/clamav/log/DailyScan.log -a DailyScan -c jobstop &
0 0 * * * clamav -f /mnt/HD/HD_a2/.systemfile/clamav/log/DailyScan.log -a DailyScan -c jobrun &
0 6 * * * clamav -f /mnt/HD/HD_a2/.systemfile/clamav/log/DailyScan.log -a DailyScan -c jobstop &
…
…
about the same number x3!

This looks to me like the source of the problem, i.e. its starting the clamAv process about 50 times.

I haven’t touched any settings via SSH or actually even via the web interface just created users/shares so not sure how this was changed if it is the issue.

Can I go ahead and remove all but 2 entries (i.e. start and stop)?

2

Ok an update after realizing that the anti-virus is the installed App: Anti-Virus Essentials :slight_smile:

After remove all jobs manully using crontab -e
Remove/Add Daily Scan for 2am - 8am
crontab -l
0 2 * * * clamav -f /mnt/HD/HD_a2/.systemfile/clamav/log/Daily_Scan.log -a Daily_Scan -c jobrun &
0 8 * * * clamav -f /mnt/HD/HD_a2/.systemfile/clamav/log/Daily_Scan.log -a Daily_Scan -c jobstop &

After reboot, crontab -l, looks like it was duplicated
0 2 * * * clamav -f /mnt/HD/HD_a2/.systemfile/clamav/log/Daily_Scan.log -a Daily_Scan -c jobrun &
0 8 * * * clamav -f /mnt/HD/HD_a2/.systemfile/clamav/log/Daily_Scan.log -a Daily_Scan -c jobstop &
0 2 * * * clamav -f /mnt/HD/HD_a2/.systemfile/clamav/log/Daily_Scan.log -a Daily_Scan -c jobrun &
0 8 * * * clamav -f /mnt/HD/HD_a2/.systemfile/clamav/log/Daily_Scan.log -a Daily_Scan -c jobstop &

After another reboot and gets duplicated again
0 2 * * * clamav -f /mnt/HD/HD_a2/.systemfile/clamav/log/Daily_Scan.log -a Daily_Scan -c jobrun &
0 8 * * * clamav -f /mnt/HD/HD_a2/.systemfile/clamav/log/Daily_Scan.log -a Daily_Scan -c jobstop &
0 2 * * * clamav -f /mnt/HD/HD_a2/.systemfile/clamav/log/Daily_Scan.log -a Daily_Scan -c jobrun &
0 8 * * * clamav -f /mnt/HD/HD_a2/.systemfile/clamav/log/Daily_Scan.log -a Daily_Scan -c jobstop &
0 2 * * * clamav -f /mnt/HD/HD_a2/.systemfile/clamav/log/Daily_Scan.log -a Daily_Scan -c jobrun &
0 8 * * * clamav -f /mnt/HD/HD_a2/.systemfile/clamav/log/Daily_Scan.log -a Daily_Scan -c jobstop &

Go into Anti-Virus Essentials config and click on Save, removes all and back to 1 start/stop pair
0 2 * * * clamav -f /mnt/HD/HD_a2/.systemfile/clamav/log/Daily_Scan.log -a Daily_Scan -c jobrun &
0 8 * * * clamav -f /mnt/HD/HD_a2/.systemfile/clamav/log/Daily_Scan.log -a Daily_Scan -c jobstop &

So it looks like its a bug in the Anti-Virus Essentials application? would a fix for this come from WD or from ClamAV? or is there other anti-virus options?

3

Hi,

As a recommendation, try creating a case with WD directly to see if they have any information about a future update.

https://support.wdc.com/support/case.aspx?lang=en