Rspamd soft reject

NethServer Version: NethServer release 7.7.1908 (final)
Module: Rspamd
Active mail users: 43
VPS:
Fabrikant QEMU
Model Standard PC (i440FX + PIIX, 1996)
Model processor 3 x Westmere E56xx/L56xx/X56xx (Nehalem-C)
RAM: 7168 MB

Hi,

This morning I notice that Rspamd marked every mail (started around 18:20 PM yesterday) as soft reject.
I had this one time before and saw in the log file a lot of “daemonize() failed: Cannot allocate memory” so I upgraded the RAM of my VPS (after I read different forum post about it on the internet).
Until now I didn’t had this issue again.
After a restart no more mails where marked as ‘soft reject’ and slowly the ‘soft reject’ marked mails where delivered in the users mailbox.

How can I fixed this issue and prevent that this would happen again?

Many thanks in advance.

See below the mail log file

Citaat
Mar 7 18:55:38 mail clamd[11482]: Log file size limited to 1048576 bytes. Mar 7 18:55:38 mail clamd[11482]: Reading databases from /var/lib/clamav Mar 7 18:55:38 mail clamd[11482]: Not loading PUA signatures. Mar 7 18:55:38 mail clamd[11482]: Bytecode: Security mode set to “TrustSigned”. Mar 7 18:55:41 mail rspamd[14799]: <665zzt>; lua; bayes_expiry.lua:437: finished expiry step 37: 991 items checked, 138 significant (0 made persistent), 1 insignificant (0 ttls set), 1 common (0 discriminated), 851 infrequent (0 ttls set), 3 mean, 7 std Mar 7 18:55:41 mail postfix/smtpd[11483]: connect from localhost[127.0.0.1] Mar 7 18:55:41 mail rspamd[14798]: ; proxy; proxy_accept_socket: accepted milter connection from /var/run/rspamd/worker-proxy port 0 Mar 7 18:55:41 mail postfix/smtpd[11484]: connect from localhost[127.0.0.1] Mar 7 18:55:41 mail rspamd[14798]: <5a07b6>; proxy; proxy_accept_socket: accepted milter connection from /var/run/rspamd/worker-proxy port 0 Mar 7 18:55:41 mail postfix/smtpd[11484]: 702D34C1BAB: client=localhost[127.0.0.1] Mar 7 18:55:41 mail rspamd[14798]: <5a07b6>; milter; rspamd_milter_process_command: got connection from 127.0.0.1:36636 Mar 7 18:55:41 mail postfix/smtpd[11483]: 739184C2EEE: client=localhost[127.0.0.1] Mar 7 18:55:41 mail rspamd[14798]: ; milter; rspamd_milter_process_command: got connection from 127.0.0.1:36634 Mar 7 18:55:41 mail postfix/cleanup[11486]: 702D34C1BAB: message-id=20200307175541.702D34C1BAB@mail.DOMAIN.eu Mar 7 18:55:41 mail postfix/cleanup[11487]: 739184C2EEE: message-id=20200307175541.739184C2EEE@mail.DOMAIN.eu Mar 7 18:55:41 mail rspamd[14798]: <5a07b6>; proxy; rspamd_message_parse: loaded message; id: 20200307175541.702D34C1BAB@mail.DOMAIN.eu; queue-id: <702D34C1BAB>; size: 6034; checksum: Mar 7 18:55:41 mail rspamd[14798]: <5a07b6>; proxy; rspamd_mime_part_detect_language: detected part language: nl Mar 7 18:55:41 mail rspamd[14798]: <5a07b6>; proxy; rspamd_mime_part_detect_language: detected part language: nl Mar 7 18:55:41 mail rspamd[14798]: <5a07b6>; lua; greylist.lua:184: skip greylisting for local networks and/or authorized users Mar 7 18:55:41 mail rspamd[14798]: <5a07b6>; proxy; spf_symbol_callback: skip SPF checks for local networks and authorized users Mar 7 18:55:41 mail rspamd[14798]: <5a07b6>; proxy; dkim_symbol_callback: skip DKIM checks for local networks and authorized users Mar 7 18:55:41 mail rspamd[14798]: <5a07b6>; lua; dmarc.lua:572: skip DMARC checks for local networks and authorized users Mar 7 18:55:41 mail rspamd[14798]: <5a07b6>; lua; once_received.lua:98: Skipping once_received for authenticated user or local network Mar 7 18:55:41 mail rspamd[14798]: ; proxy; rspamd_message_parse: loaded message; id: 20200307175541.739184C2EEE@mail.DOMAIN.eu; queue-id: <739184C2EEE>; size: 6033; checksum: Mar 7 18:55:41 mail rspamd[14798]: ; proxy; rspamd_mime_part_detect_language: detected part language: nl Mar 7 18:55:41 mail rspamd[14798]: ; proxy; rspamd_mime_part_detect_language: detected part language: nl Mar 7 18:55:41 mail rspamd[14798]: ; lua; greylist.lua:184: skip greylisting for local networks and/or authorized users Mar 7 18:55:41 mail rspamd[14798]: ; proxy; spf_symbol_callback: skip SPF checks for local networks and authorized users Mar 7 18:55:41 mail rspamd[14798]: ; proxy; dkim_symbol_callback: skip DKIM checks for local networks and authorized users Mar 7 18:55:41 mail rspamd[14798]: ; lua; dmarc.lua:572: skip DMARC checks for local networks and authorized users Mar 7 18:55:41 mail rspamd[14798]: ; lua; once_received.lua:98: Skipping once_received for authenticated user or local network Mar 7 18:55:41 mail rspamd[14798]: <>; ; rspamd_inet_address_connect: connect unix:/var/run/clamd@rspamd/clamav failed: 2, ‘Bestand of map bestaat niet’ Mar 7 18:55:41 mail rspamd[14798]: ; proxy; lua_tcp_make_connection: cannot connect to /var/run/clamd@rspamd/clamav (/var/run/clamd@rspamd/clamav): Bestand of map bestaat niet Mar 7 18:55:41 mail rspamd[14798]: <>; ; rspamd_inet_address_connect: connect unix:/var/run/clamd@rspamd/clamav failed: 2, ‘Bestand of map bestaat niet’ Mar 7 18:55:41 mail rspamd[14798]: ; proxy; lua_tcp_make_connection: cannot connect to /var/run/clamd@rspamd/clamav (/var/run/clamd@rspamd/clamav): Bestand of map bestaat niet Mar 7 18:55:41 mail rspamd[14798]: <>; ; rspamd_inet_address_connect: connect unix:/var/run/clamd@rspamd/clamav failed: 2, ‘Bestand of map bestaat niet’ Mar 7 18:55:41 mail rspamd[14798]: ; proxy; lua_tcp_make_connection: cannot connect to /var/run/clamd@rspamd/clamav (/var/run/clamd@rspamd/clamav): Bestand of map bestaat niet Mar 7 18:55:41 mail rspamd[14798]: ; lua; clamav.lua:119: clamav: failed to scan, maximum retransmits exceed Mar 7 18:55:41 mail rspamd[14798]: ; lua; common.lua:107: clamav: result - FAILED with error: “failed to scan and retransmits exceed - score: 0” Mar 7 18:55:41 mail rspamd[14798]: ; proxy; rspamd_add_passthrough_result: 20200307175541.739184C2EEE@mail.DOMAIN.eu: set pre-result to ‘soft reject’ (no score): ‘Cannot validate the message now. Try again later’ from force_actions(1) Mar 7 18:55:41 mail rspamd[14798]: <>; ; rspamd_inet_address_connect: connect unix:/var/run/clamd@rspamd/clamav failed: 2, ‘Bestand of map bestaat niet’ Mar 7 18:55:41 mail rspamd[14798]: <5a07b6>; proxy; lua_tcp_make_connection: cannot connect to /var/run/clamd@rspamd/clamav (/var/run/clamd@rspamd/clamav): Bestand of map bestaat niet Mar 7 18:55:41 mail rspamd[14798]: <>; ; rspamd_inet_address_connect: connect unix:/var/run/clamd@rspamd/clamav failed: 2, ‘Bestand of map bestaat niet’ Mar 7 18:55:41 mail rspamd[14798]: <5a07b6>; proxy; lua_tcp_make_connection: cannot connect to /var/run/clamd@rspamd/clamav (/var/run/clamd@rspamd/clamav): Bestand of map bestaat niet Mar 7 18:55:41 mail rspamd[14798]: <>; ; rspamd_inet_address_connect: connect unix:/var/run/clamd@rspamd/clamav failed: 2, ‘Bestand of map bestaat niet’ Mar 7 18:55:41 mail rspamd[14798]: <5a07b6>; proxy; lua_tcp_make_connection: cannot connect to /var/run/clamd@rspamd/clamav (/var/run/clamd@rspamd/clamav): Bestand of map bestaat niet Mar 7 18:55:41 mail rspamd[14798]: <5a07b6>; lua; clamav.lua:119: clamav: failed to scan, maximum retransmits exceed Mar 7 18:55:41 mail rspamd[14798]: <5a07b6>; lua; common.lua:107: clamav: result - FAILED with error: “failed to scan and retransmits exceed - score: 0” Mar 7 18:55:41 mail rspamd[14798]: <5a07b6>; proxy; rspamd_add_passthrough_result: 20200307175541.702D34C1BAB@mail.DOMAIN.eu: set pre-result to ‘soft reject’ (no score): ‘Cannot validate the message now. Try again later’ from force_actions(1) Mar 7 18:55:41 mail rspamd[14798]: <5a07b6>; proxy; rspamd_task_write_log: id: 20200307175541.702D34C1BAB@mail.DOMAIN.eu, qid: <702D34C1BAB>, ip: 127.0.0.1, from: no-reply@DOMAIN.eu, (default: F (soft reject): [-0.10/12.90] [MIME_GOOD(-0.10){multipart/alternative;text/plain;},CLAM_VIRUS_FAIL(0.00){failed to scan and retransmits exceed;},FORCE_ACTION_CLAM_VIRUS_FAIL(0.00){soft reject;},FROM_EQ_ENVFROM(0.00){},FROM_HAS_DN(0.00){},GENERIC_REPUTATION(0.00){-0.48425642650355;},MIME_TRACE(0.00){0:+;1:+;2:~;},PRECEDENCE_BULK(0.00){},RCPT_COUNT_ONE(0.00){1;},RCVD_COUNT_ZERO(0.00){0;},TO_DN_NONE(0.00){},TO_DOM_EQ_FROM_DOM(0.00){},TO_MATCH_ENVRCPT_ALL(0.00){}]), len: 6034, time: 248.183ms, dns req: 7, digest: , rcpts: USER@DOMAIN.eu, mime_rcpts: USER@DOMAIN.eu, forced: soft reject “Cannot validate the message now. Try again later”; score=nan (set by force_actions) Mar 7 18:55:41 mail rspamd[14798]: <5a07b6>; proxy; rspamd_protocol_http_reply: regexp statistics: 0 pcre regexps scanned, 3 regexps matched, 184 regexps total, 94 regexps cached, 0B scanned using pcre, 7.29KiB scanned total Mar 7 18:55:41 mail postfix/cleanup[11486]: 702D34C1BAB: milter-reject: END-OF-MESSAGE from localhost[127.0.0.1]: 4.7.1 Cannot validate the message now. Try again later; from=no-reply@DOMAIN.eu to=USER@DOMAIN.eu proto=ESMTP helo=<teamchat.DOMAIN.eu> Mar 7 18:55:41 mail postfix/smtpd[11484]: disconnect from localhost[127.0.0.1] Mar 7 18:55:41 mail rspamd[14798]: <305e15>; proxy; proxy_milter_finish_handler: finished milter connection Mar 7 18:55:41 mail rspamd[14798]: ; proxy; rspamd_task_write_log: id: 20200307175541.739184C2EEE@mail.DOMAIN.eu, qid: <739184C2EEE>, ip: 127.0.0.1, from: no-reply@DOMAIN.eu, (default: F (soft reject): [-0.10/12.90] [MIME_GOOD(-0.10){multipart/alternative;text/plain;},CLAM_VIRUS_FAIL(0.00){failed to scan and retransmits exceed;},FORCE_ACTION_CLAM_VIRUS_FAIL(0.00){soft reject;},FROM_EQ_ENVFROM(0.00){},FROM_HAS_DN(0.00){},GENERIC_REPUTATION(0.00){-0.48425642650355;},MIME_TRACE(0.00){0:+;1:+;2:~;},PRECEDENCE_BULK(0.00){},RCPT_COUNT_ONE(0.00){1;},RCVD_COUNT_ZERO(0.00){0;},TO_DN_NONE(0.00){},TO_DOM_EQ_FROM_DOM(0.00){},TO_MATCH_ENVRCPT_ALL(0.00){}]), len: 6033, time: 270.992ms, dns req: 7, digest: , rcpts: USER@DOMAIN.eu, mime_rcpts: USER@DOMAIN.eu, forced: soft reject “Cannot validate the message now. Try again later”; score=nan (set by force_actions) Mar 7 18:55:41 mail rspamd[14798]: ; proxy; rspamd_protocol_http_reply: regexp statistics: 0 pcre regexps scanned, 3 regexps matched, 184 regexps total, 94 regexps cached, 0B scanned using pcre, 7.29KiB scanned total Mar 7 18:55:41 mail postfix/cleanup[11487]: 739184C2EEE: milter-reject: END-OF-MESSAGE from localhost[127.0.0.1]: 4.7.1 Cannot validate the message now. Try again later; from=no-reply@DOMAIN.eu to=USER@DOMAIN.eu proto=ESMTP helo=<teamchat.DOMAIN.eu> Mar 7 18:55:41 mail postfix/smtpd[11483]: disconnect from localhost[127.0.0.1] Mar 7 18:55:41 mail rspamd[14798]: <609487>; proxy; proxy_milter_finish_handler: finished milter connection Mar 7 18:55:50 mail clamd[11482]: Loaded 6928517 signatures. Mar 7 18:55:53 mail clamd[11482]: LOCAL: Unix socket file /var/run/clamd@rspamd/clamav Mar 7 18:55:53 mail clamd[11482]: LOCAL: Setting connection queue length to 200 Mar 7 18:55:53 mail clamd[11482]: daemonize() failed: Cannot allocate memory Mar 7 18:55:53 mail clamd[11482]: Socket file removed. Mar 7 18:55:55 mail clamd[11493]: Received 0 file descriptor(s) from systemd. Mar 7 18:55:55 mail clamd[11493]: clamd daemon 0.101.5 (OS: linux-gnu, ARCH: x86_64, CPU: x86_64) Mar 7 18:55:55 mail clamd[11493]: Log file size limited to 1048576 bytes. Mar 7 18:55:55 mail clamd[11493]: Reading databases from /var/lib/clamav Mar 7 18:55:55 mail clamd[11493]: Not loading PUA signatures. Mar 7 18:55:55 mail clamd[11493]: Bytecode: Security mode set to “TrustSigned”. Mar 7 18:56:09 mail clamd[11493]: Loaded 6928517 signatures. Mar 7 18:56:14 mail clamd[11493]: LOCAL: Unix socket file /var/run/clamd@rspamd/clamav Mar 7 18:56:14 mail clamd[11493]: LOCAL: Setting connection queue length to 200 Mar 7 18:56:14 mail clamd[11493]: daemonize() failed: Cannot allocate memory Mar 7 18:56:14 mail clamd[11493]: Socket file removed. Mar 7 18:56:16 mail clamd[11514]: Received 0 file descriptor(s) from systemd. Mar 7 18:56:16 mail clamd[11514]: clamd daemon 0.101.5 (OS: linux-gnu, ARCH: x86_64, CPU: x86_64) Mar 7 18:56:16 mail clamd[11514]: Log file size limited to 1048576 bytes. Mar 7 18:56:16 mail clamd[11514]: Reading databases from /var/lib/clamav Mar 7 18:56:16 mail clamd[11514]: Not loading PUA signatures. Mar 7 18:56:16 mail clamd[11514]: Bytecode: Security mode set to “TrustSigned”. Mar 7 18:56:27 mail clamd[11514]: Loaded 6928517 signatures. Mar 7 18:56:31 mail clamd[11514]: LOCAL: Unix socket file /var/run/clamd@rspamd/clamav Mar 7 18:56:31 mail clamd[11514]: LOCAL: Setting connection queue length to 200 Mar 7 18:56:31 mail clamd[11514]: daemonize() failed: Cannot allocate memory Mar 7 18:56:31 mail clamd[11514]: Socket file removed. Mar 7 18:56:32 mail clamd[11530]: Received 0 file descriptor(s) from systemd. Mar 7 18:56:32 mail clamd[11530]: clamd daemon 0.101.5 (OS: linux-gnu, ARCH: x86_64, CPU: x86_64) Mar 7 18:56:32 mail clamd[11530]: Log file size limited to 1048576 bytes. Mar 7 18:56:32 mail clamd[11530]: Reading databases from /var/lib/clamav Mar 7 18:56:32 mail clamd[11530]: Not loading PUA signatures. Mar 7 18:56:32 mail clamd[11530]: Bytecode: Security mode set to “TrustSigned”. Mar 7 18:56:44 mail clamd[11530]: Loaded 6928517 signatures. Mar 7 18:56:45 mail rspamd[14799]: <665zzt>; lua; bayes_expiry.lua:437: finished expiry step 38: 989 items checked, 157 significant (0 made persistent), 3 insignificant (0 ttls set), 5 common (0 discriminated), 824 infrequent (29 ttls set), 3 mean, 8 std Mar 7 18:56:48 mail clamd[11530]: LOCAL: Unix socket file /var/run/clamd@rspamd/clamav Mar 7 18:56:48 mail clamd[11530]: LOCAL: Setting connection queue length to 200 Mar 7 18:56:48 mail clamd[11530]: daemonize() failed: Cannot allocate memory Mar 7 18:56:48 mail clamd[11530]: Socket file removed. Mar 7 18:56:50 mail clamd[11544]: Received 0 file descriptor(s) from systemd. Mar 7 18:56:50 mail clamd[11544]: clamd daemon 0.101.5 (OS: linux-gnu, ARCH: x86_64, CPU: x86_64) Mar 7 18:56:50 mail clamd[11544]: Log file size limited to 1048576 bytes. Mar 7 18:56:50 mail clamd[11544]: Reading databases from /var/lib/clamav Mar 7 18:56:50 mail clamd[11544]: Not loading PUA signatures. Mar 7 18:56:50 mail clamd[11544]: Bytecode: Security mode set to “TrustSigned”. Mar 7 18:57:02 mail clamd[11544]: Loaded 6928517 signatures. Mar 7 18:57:06 mail clamd[11544]: LOCAL: Unix socket file /var/run/clamd@rspamd/clamav Mar 7 18:57:06 mail clamd[11544]: LOCAL: Setting connection queue length to 200 Mar 7 18:57:06 mail clamd[11544]: daemonize() failed: Cannot allocate memory Mar 7 18:57:06 mail clamd[11544]: Socket file removed. Mar 7 18:57:08 mail clamd[11570]: Received 0 file descriptor(s) from systemd. Mar 7 18:57:08 mail clamd[11570]: clamd daemon 0.101.5 (OS: linux-gnu, ARCH: x86_64, CPU: x86_64) Mar 7 18:57:08 mail clamd[11570]: Log file size limited to 1048576 bytes. Mar 7 18:57:08 mail clamd[11570]: Reading databases from /var/lib/clamav Mar 7 18:57:08 mail clamd[11570]: Not loading PUA signatures. Mar 7 18:57:08 mail clamd[11570]: Bytecode: Security mode set to “TrustSigned”. Mar 7 18:57:20 mail clamd[11570]: Loaded 6928517 signatures. Mar 7 18:57:23 mail clamd[11570]: LOCAL: Unix socket file /var/run/clamd@rspamd/clamav Mar 7 18:57:23 mail clamd[11570]: LOCAL: Setting connection queue length to 200 Mar 7 18:57:23 mail clamd[11570]: daemonize() failed: Cannot allocate memory Mar 7 18:57:23 mail clamd[11570]: Socket file removed. Mar 7 18:57:25 mail clamd[11575]: Received 0 file descriptor(s) from systemd. Mar 7 18:57:25 mail clamd[11575]: clamd daemon 0.101.5 (OS: linux-gnu, ARCH: x86_64, CPU: x86_64) Mar 7 18:57:25 mail clamd[11575]: Log file size limited to 1048576 bytes. Mar 7 18:57:25 mail clamd[11575]: Reading databases from /var/lib/clamav Mar 7 18:57:25 mail clamd[11575]: Not loading PUA signatures. Mar 7 18:57:25 mail clamd[11575]: Bytecode: Security mode set to “TrustSigned”. Mar 7 18:57:36 mail clamd[11575]: Loaded 6928517 signatures. Mar 7 18:57:39 mail clamd[11575]: LOCAL: Unix socket file /var/run/clamd@rspamd/clamav Mar 7 18:57:39 mail clamd[11575]: LOCAL: Setting connection queue length to 200 Mar 7 18:57:39 mail clamd[11575]: daemonize() failed: Cannot allocate memory Mar 7 18:57:39 mail clamd[11575]: Socket file removed. Mar 7 18:57:41 mail clamd[11595]: Received 0 file descriptor(s) from systemd. Mar 7 18:57:41 mail clamd[11595]: clamd daemon 0.101.5 (OS: linux-gnu, ARCH: x86_64, CPU: x86_64) Mar 7 18:57:41 mail clamd[11595]: Log file size limited to 1048576 bytes. Mar 7 18:57:41 mail clamd[11595]: Reading databases from /var/lib/clamav Mar 7 18:57:41 mail clamd[11595]: Not loading PUA signatures. Mar 7 18:57:41 mail clamd[11595]: Bytecode: Security mode set to “TrustSigned”. Mar 7 18:57:53 mail clamd[11595]: Loaded 6928517 signatures. Mar 7 18:57:56 mail postfix/anvil[11318]: statistics: max connection rate 1/60s for (submission:192.241.233.165) at Mar 7 18:53:14 Mar 7 18:57:56 mail postfix/anvil[11318]: statistics: max connection count 1 for (submission:192.241.233.165) at Mar 7 18:53:14 Mar 7 18:57:56 mail postfix/anvil[11318]: statistics: max cache size 1 at Mar 7 18:53:14 Mar 7 18:57:57

Maybe some process is leaking the system memory. If it happens attach the output of this command (just found with a quick search):

ps -o pid,user,%mem,command ax | sort -b -k3 -r

If the culprit is clamav itself, disable the official signatures: they are a waste of memory and it seems they are not so effective:

https://docs.nethserver.org/en/v7/antivirus.html

Clamd is down due to a memory issue

Hi David,

Sorry for the late reaction. Today the same issue happened again.
I noticed it when I did some updates, after the update I received a certain amount of mails in my inbox.

Below you found the output of the command. I hope that the output is helpful because I did it after the updates and not at the moment of the problem

  PID USER     %MEM COMMAND
 5060 suricata  7.6 /sbin/suricata -c /etc/suricata/suricata.yaml --pidfile /var/run/suricata.pid -q 0 --user suricata
 1955 mysql     6.3 /usr/libexec/mysqld --basedir=/usr --datadir=/var/lib/mysql --plugin-dir=/usr/lib64/mysql/plugin --log-error=/var/log/mariadb/mariadb.log --pid-file=/var/run/mariadb/mariadb.pid --socket=/var/lib/mysql/mysql.sock
12897 virgilh+  4.2 /usr/lib64/firefox/firefox -contentproc -childID 4 -isForBrowser -prefsLen 6722 -prefMapSize 191946 -parentBuildID 20200217171646 -greomni /usr/lib64/firefox/omni.ja -appomni /usr/lib64/firefox/browser/omni.ja -appdir /usr/lib64/firefox/browser 12705 tab
12705 virgilh+  2.7 /usr/lib64/firefox/firefox
 3250 virgilh+  2.6 /usr/bin/gnome-shell
  820 redis     2.2 /usr/bin/redis-server 127.0.0.1:0
 1153 matterm+  1.5 /opt/mattermost/bin/mattermost
18461 _rspamd  14.1 /usr/sbin/clamd -c /etc/clamd.d/rspamd.conf
 1320 _rspamd   1.0 rspamd: main process; 0.1 msg/sec, 0.0 msg/sec spam, 0.1 msg/sec ham
 5165 _rspamd   1.0 rspamd: hs_helper process
 5164 _rspamd   1.0 rspamd: controller process (127.0.0.1:11334)
21039 sogo      0.9 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
16719 sogo      0.9 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
16046 sogo      0.9 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
15212 sogo      0.9 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
13186 sogo      0.9 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
 1347 suricata  0.9 /usr/bin/evebox server -c /etc/evebox/evebox.yaml
 8702 sogo      0.8 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
 8237 sogo      0.8 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
29060 sogo      0.8 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
26685 sogo      0.8 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
20691 sogo      0.8 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
19276 sogo      0.8 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
19260 sogo      0.8 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
18957 sogo      0.8 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
17299 sogo      0.8 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
15912 sogo      0.8 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
15583 sogo      0.8 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
15530 sogo      0.8 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
15378 sogo      0.8 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
13098 sogo      0.8 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
12998 sogo      0.8 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
11794 sogo      0.8 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
10973 sogo      0.8 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
12778 virgilh+  0.8 /usr/lib64/firefox/firefox -contentproc -childID 1 -isForBrowser -prefsLen 1 -prefMapSize 191946 -parentBuildID 20200217171646 -greomni /usr/lib64/firefox/omni.ja -appomni /usr/lib64/firefox/browser/omni.ja -appdir /usr/lib64/firefox/browser 12705 tab
 5163 _rspamd   0.8 rspamd: rspamd_proxy process (/var/run/rspamd/worker-proxy mode=0770 owner=_rspamd group=mail)
29004 sogo      0.7 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
25622 sogo      0.7 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
18552 sogo      0.7 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
15768 sogo      0.7 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
 1155 sogo      0.7 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
 1920 root      0.7 /usr/bin/X :0 -background none -noreset -audit 4 -verbose -auth /run/gdm/auth-for-gdm-OP2Cxf/database -seat seat0 -nolisten tcp vt1
 5162 _rspamd   0.7 rspamd: fuzzy process (localhost:11335)
23362 sogo      0.6 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
20032 sogo      0.6 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
18870 sogo      0.6 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
15809 sogo      0.6 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
12834 sogo      0.6 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
 7764 root      0.6 /usr/bin/python -s /usr/bin/fail2ban-server -xf start
25631 sogo      0.5 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
24718 sogo      0.5 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
22233 sogo      0.5 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
14129 sogo      0.5 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
12991 sogo      0.5 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
 8737 ldap      0.5 /usr/sbin/slapd -u ldap -h ldapi:/// ldap:/// ldaps:///
 1287 unbound   0.4 /usr/sbin/unbound -d
 7790 sogo      0.4 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
16753 sogo      0.4 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
15706 sogo      0.4 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
13160 sogo      0.4 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
12102 sogo      0.4 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
10545 sogo      0.4 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
12814 virgilh+  0.4 /usr/lib64/firefox/firefox -contentproc -childID 3 -isForBrowser -prefsLen 5936 -prefMapSize 191946 -parentBuildID 20200217171646 -greomni /usr/lib64/firefox/omni.ja -appomni /usr/lib64/firefox/browser/omni.ja -appdir /usr/lib64/firefox/browser 12705 tab
21769 sogo      0.3 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
21757 sogo      0.3 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
22393 virgilh+  0.3 /usr/libexec/gnome-terminal-server
 1165 root      0.3 php-fpm: master process (/etc/opt/rh/rh-php71/php-fpm.conf)
 9501 srvmgr    0.2 /usr/sbin/httpd -f /etc/httpd/admin-conf/httpd.conf -c MaxConnectionsPerChild 12 -DFOREGROUND
 9500 srvmgr    0.2 /usr/sbin/httpd -f /etc/httpd/admin-conf/httpd.conf -c MaxConnectionsPerChild 12 -DFOREGROUND
 9490 srvmgr    0.2 /usr/sbin/httpd -f /etc/httpd/admin-conf/httpd.conf -c MaxConnectionsPerChild 12 -DFOREGROUND
 8823 srvmgr    0.2 /usr/sbin/httpd -f /etc/httpd/admin-conf/httpd.conf -c MaxConnectionsPerChild 12 -DFOREGROUND
 8821 srvmgr    0.2 /usr/sbin/httpd -f /etc/httpd/admin-conf/httpd.conf -c MaxConnectionsPerChild 12 -DFOREGROUND
 8814 srvmgr    0.2 /usr/sbin/httpd -f /etc/httpd/admin-conf/httpd.conf -c MaxConnectionsPerChild 12 -DFOREGROUND
21900 srvmgr    0.2 /usr/sbin/httpd -f /etc/httpd/admin-conf/httpd.conf -c MaxConnectionsPerChild 12 -DFOREGROUND
  483 root      0.2 /usr/lib/systemd/systemd-journald
13569 virgilh+  0.2 /usr/lib64/firefox/firefox -contentproc -childID 5 -isForBrowser -prefsLen 6923 -prefMapSize 191946 -parentBuildID 20200217171646 -greomni /usr/lib64/firefox/omni.ja -appomni /usr/lib64/firefox/browser/omni.ja -appdir /usr/lib64/firefox/browser 12705 tab
  926 srvmgr    0.2 /usr/bin/perl /usr/libexec/nethserver/smwingsd
15055 memcach+  0.2 /usr/bin/memcached -u memcached -p 11211 -m 64 -c 1024
 3491 virgilh+  0.2 nautilus-desktop --force
 1635 sogo      0.1 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
30153 root      0.1 /usr/sbin/rsyslogd -n
30229 root      0.1 /usr/sbin/libvirtd
 8816 srvmgr    0.1 /usr/sbin/httpd -f /etc/httpd/admin-conf/httpd.conf -c MaxConnectionsPerChild 12 -DFOREGROUND
21905 srvmgr    0.1 /usr/sbin/httpd -f /etc/httpd/admin-conf/httpd.conf -c MaxConnectionsPerChild 12 -DFOREGROUND
21904 srvmgr    0.1 /usr/sbin/httpd -f /etc/httpd/admin-conf/httpd.conf -c MaxConnectionsPerChild 12 -DFOREGROUND
 1293 root      0.1 /usr/sbin/httpd -f /etc/httpd/admin-conf/httpd.conf -c MaxConnectionsPerChild 12 -DFOREGROUND
 8297 apache    0.1 /usr/sbin/httpd -DFOREGROUND
 5391 apache    0.1 /usr/sbin/httpd -DFOREGROUND
 4393 apache    0.1 /usr/sbin/httpd -DFOREGROUND
32593 apache    0.1 /usr/sbin/httpd -DFOREGROUND
31705 apache    0.1 /usr/sbin/httpd -DFOREGROUND
31541 apache    0.1 /usr/sbin/httpd -DFOREGROUND
22277 apache    0.1 /usr/sbin/httpd -DFOREGROUND
22148 apache    0.1 /usr/sbin/httpd -DFOREGROUND
22113 apache    0.1 /usr/sbin/httpd -DFOREGROUND
21895 apache    0.1 /usr/sbin/httpd -DFOREGROUND
21893 apache    0.1 /usr/sbin/httpd -DFOREGROUND
21520 apache    0.1 /usr/sbin/httpd -DFOREGROUND
21500 apache    0.1 /usr/sbin/httpd -DFOREGROUND
20370 apache    0.1 /usr/sbin/httpd -DFOREGROUND
20369 apache    0.1 /usr/sbin/httpd -DFOREGROUND
20162 apache    0.1 /usr/sbin/httpd -DFOREGROUND
20145 apache    0.1 /usr/sbin/httpd -DFOREGROUND
19892 apache    0.1 /usr/sbin/httpd -DFOREGROUND
19613 apache    0.1 /usr/sbin/httpd -DFOREGROUND
19195 apache    0.1 /usr/sbin/httpd -DFOREGROUND
18684 apache    0.1 /usr/sbin/httpd -DFOREGROUND
18678 apache    0.1 /usr/sbin/httpd -DFOREGROUND
18429 apache    0.1 /usr/sbin/httpd -DFOREGROUND
18148 apache    0.1 /usr/sbin/httpd -DFOREGROUND
18091 apache    0.1 /usr/sbin/httpd -DFOREGROUND
18083 apache    0.1 /usr/sbin/httpd -DFOREGROUND
17017 apache    0.1 /usr/sbin/httpd -DFOREGROUND
16760 apache    0.1 /usr/sbin/httpd -DFOREGROUND
16479 apache    0.1 /usr/sbin/httpd -DFOREGROUND
16468 apache    0.1 /usr/sbin/httpd -DFOREGROUND
16271 apache    0.1 /usr/sbin/httpd -DFOREGROUND
16268 apache    0.1 /usr/sbin/httpd -DFOREGROUND
16263 apache    0.1 /usr/sbin/httpd -DFOREGROUND
16261 apache    0.1 /usr/sbin/httpd -DFOREGROUND
14310 apache    0.1 /usr/sbin/httpd -DFOREGROUND
13933 apache    0.1 /usr/sbin/httpd -DFOREGROUND
13345 apache    0.1 /usr/sbin/httpd -DFOREGROUND
13343 apache    0.1 /usr/sbin/httpd -DFOREGROUND
13341 apache    0.1 /usr/sbin/httpd -DFOREGROUND
 1317 root      0.1 /usr/sbin/httpd -DFOREGROUND
12749 apache    0.1 /usr/sbin/httpd -DFOREGROUND
12739 apache    0.1 /usr/sbin/httpd -DFOREGROUND
12052 apache    0.1 /usr/sbin/httpd -DFOREGROUND
11743 apache    0.1 /usr/sbin/httpd -DFOREGROUND
  827 polkitd   0.1 /usr/lib/polkit-1/polkitd --no-debug
 3561 virgilh+  0.1 /usr/libexec/tracker-store
 3521 virgilh+  0.1 /usr/libexec/tracker-extract
30223 root      0.1 /usr/libexec/sssd/sssd_be --domain teamzorg.eu --uid 0 --gid 0 --logger=files
 3437 virgilh+  0.1 /usr/libexec/gsd-media-keys
 3425 virgilh+  0.1 /usr/libexec/gsd-color
 3327 virgilh+  0.1 /usr/libexec/goa-daemon
 3553 virgilh+  0.1 /usr/libexec/evolution-calendar-factory-subprocess --factory all --bus-name org.gnome.evolution.dataserver.Subprocess.Backend.Calendarx3516x2 --own-path /org/gnome/evolution/dataserver/Subprocess/Backend/Calendar/3516/2
 1161 root      0.1 /usr/bin/python2 -Es /usr/sbin/tuned -l -P
19329 postgres  0.1 postgres: mattuser mattermost 127.0.0.1(34604) idle
19328 postgres  0.1 postgres: mattuser mattermost 127.0.0.1(34602) idle
19327 postgres  0.1 postgres: mattuser mattermost 127.0.0.1(34600) idle
19326 postgres  0.1 postgres: mattuser mattermost 127.0.0.1(34598) idle
19325 postgres  0.1 postgres: mattuser mattermost 127.0.0.1(34596) idle
19320 postgres  0.1 postgres: mattuser mattermost 127.0.0.1(34588) idle
19283 postgres  0.1 postgres: mattuser mattermost 127.0.0.1(34548) idle
 1579 postgres  0.1 postgres: checkpointer process   
 1703 apache    0.1 php-fpm: pool www
 1699 apache    0.1 php-fpm: pool www
 1696 apache    0.1 php-fpm: pool www
 1695 apache    0.1 php-fpm: pool www
 1691 apache    0.1 php-fpm: pool www
 1684 apache    0.1 php-fpm: pool dokuwiki
 1683 apache    0.1 php-fpm: pool dokuwiki
 1679 apache    0.1 php-fpm: pool dokuwiki
 1677 apache    0.1 php-fpm: pool dokuwiki
 1675 apache    0.1 php-fpm: pool dokuwiki
 1345 postgres  0.1 /opt/rh/rh-postgresql94/root/usr/bin/postgres -D /var/opt/rh/rh-postgresql94/lib/pgsql/data
  847 olefy     0.1 /opt/olefy/bin/python /opt/olefy/bin/olefy
22367 vmail     0.1 dovecot/imap imap-postlogin
  802 root      0.0 [xprtiod]
   26 root      0.0 [writeback]
   34 root      0.0 [watchdogd]
   17 root      0.0 [watchdog/2]
   12 root      0.0 [watchdog/1]
   11 root      0.0 [watchdog/0]
 9679 postfix   0.0 verify -l -t unix -u
 2765 root      0.0 /usr/sbin/wpa_supplicant -u -f /var/log/wpa_supplicant.log -c /etc/wpa_supplicant/wpa_supplicant.conf -P /var/run/wpa_supplicant.pid
30221 root      0.0 /usr/sbin/sssd -i --logger=files
 1173 root      0.0 /usr/sbin/sshd -D
  832 root      0.0 /usr/sbin/smartd -n -q never
  799 root      0.0 /usr/sbin/sedispatch
 1358 opendkim  0.0 /usr/sbin/opendkim -x /etc/opendkim.conf -P /var/run/opendkim/opendkim.pid
 1150 root      0.0 /usr/sbin/oddjobd -n -p /var/run/oddjobd.pid -t 300
  839 root      0.0 /usr/sbin/ModemManager
  509 root      0.0 /usr/sbin/lvmetad -f
  829 root      0.0 /usr/sbin/irqbalance --foreground
  859 root      0.0 /usr/sbin/gssproxy -D
 1331 root      0.0 /usr/sbin/gdm
 8659 root      0.0 /usr/sbin/dovecot
 6413 nobody    0.0 /usr/sbin/dnsmasq -k
 2085 root      0.0 /usr/sbin/dnsmasq --conf-file=/var/lib/libvirt/dnsmasq/default.conf --leasefile-ro --dhcp-script=/usr/libexec/libvirt_leaseshelper
 2084 nobody    0.0 /usr/sbin/dnsmasq --conf-file=/var/lib/libvirt/dnsmasq/default.conf --leasefile-ro --dhcp-script=/usr/libexec/libvirt_leaseshelper
 1151 root      0.0 /usr/sbin/cupsd -f
 1329 root      0.0 /usr/sbin/crond -n
  868 chrony    0.0 /usr/sbin/chronyd
 1334 root      0.0 /usr/sbin/atd -f
  828 root      0.0 /usr/sbin/alsactl -s -n 19 -c -E ALSA_CONFIG_PATH=/etc/alsa/alsactl.conf --initfile=/lib/alsa/init/00main rdaemon
  831 root      0.0 /usr/sbin/abrtd -d -s
22419 root      0.0 /usr/sbin/abrt-dbus -t133
19681 root      0.0 /usr/lib/systemd/systemd-udevd
    1 root      0.0 /usr/lib/systemd/systemd --system --deserialize 25
  851 root      0.0 /usr/lib/systemd/systemd-machined
  951 root      0.0 /usr/lib/systemd/systemd-logind
 3303 virgilh+  0.0 /usr/libexec/xdg-permission-store
 2561 root      0.0 /usr/libexec/upowerd
 3343 root      0.0 /usr/libexec/udisks2/udisksd
 3522 virgilh+  0.0 /usr/libexec/tracker-miner-user-guides
 3519 virgilh+  0.0 /usr/libexec/tracker-miner-fs
 3581 virgilh+  0.0 /usr/libexec/tracker-miner-apps
30225 root      0.0 /usr/libexec/sssd/sssd_pam --uid 0 --gid 0 --logger=files
30224 root      0.0 /usr/libexec/sssd/sssd_nss --uid 0 --gid 0 --logger=files
  843 rtkit     0.0 /usr/libexec/rtkit-daemon
 8615 root      0.0 /usr/libexec/postfix/master -w
 3329 virgilh+  0.0 /usr/libexec/mission-control-5
 3093 virgilh+  0.0 /usr/libexec/imsettings-daemon
 3291 virgilh+  0.0 /usr/libexec/ibus-x11 --kill-daemon
 3053 gdm       0.0 /usr/libexec/ibus-x11 --kill-daemon
 3294 virgilh+  0.0 /usr/libexec/ibus-portal
 3587 virgilh+  0.0 /usr/libexec/ibus-engine-simple
 3287 virgilh+  0.0 /usr/libexec/ibus-dconf
 3051 gdm       0.0 /usr/libexec/ibus-dconf
 3337 virgilh+  0.0 /usr/libexec/gvfs-udisks2-volume-monitor
 3373 virgilh+  0.0 /usr/libexec/gvfs-mtp-volume-monitor
 3363 virgilh+  0.0 /usr/libexec/gvfs-gphoto2-volume-monitor
 3368 virgilh+  0.0 /usr/libexec/gvfs-goa-volume-monitor
 3502 virgilh+  0.0 /usr/libexec/gvfsd-trash --spawner :1.4 /org/gtk/gvfs/exec_spaw/0
13350 virgilh+  0.0 /usr/libexec/gvfsd-metadata
 3102 virgilh+  0.0 /usr/libexec/gvfsd-fuse /run/user/1000/gvfs -f -o big_writes
 3666 virgilh+  0.0 /usr/libexec/gvfsd-burn --spawner :1.4 /org/gtk/gvfs/exec_spaw/1
 3097 virgilh+  0.0 /usr/libexec/gvfsd
 3378 virgilh+  0.0 /usr/libexec/gvfs-afc-volume-monitor
 3409 virgilh+  0.0 /usr/libexec/gsd-xsettings
 3413 virgilh+  0.0 /usr/libexec/gsd-wacom
 3405 virgilh+  0.0 /usr/libexec/gsd-sound
 3398 virgilh+  0.0 /usr/libexec/gsd-smartcard
 3397 virgilh+  0.0 /usr/libexec/gsd-sharing
 3390 virgilh+  0.0 /usr/libexec/gsd-screensaver-proxy
 3387 virgilh+  0.0 /usr/libexec/gsd-rfkill
 3386 virgilh+  0.0 /usr/libexec/gsd-print-notifications
 3468 virgilh+  0.0 /usr/libexec/gsd-printer
 3384 virgilh+  0.0 /usr/libexec/gsd-power
 3442 virgilh+  0.0 /usr/libexec/gsd-mouse
 3436 virgilh+  0.0 /usr/libexec/gsd-keyboard
 3433 virgilh+  0.0 /usr/libexec/gsd-housekeeping
 3514 virgilh+  0.0 /usr/libexec/gsd-disk-utility-notify
 3431 virgilh+  0.0 /usr/libexec/gsd-datetime
 3423 virgilh+  0.0 /usr/libexec/gsd-clipboard
 3407 virgilh+  0.0 /usr/libexec/gsd-account
 3418 virgilh+  0.0 /usr/libexec/gsd-a11y-settings
 3350 virgilh+  0.0 /usr/libexec/goa-identity-service
 3308 virgilh+  0.0 /usr/libexec/gnome-shell-calendar-server
 3062 virgilh+  0.0 /usr/libexec/gnome-session-binary --session gnome-classic
 3313 virgilh+  0.0 /usr/libexec/evolution-source-registry
 3516 virgilh+  0.0 /usr/libexec/evolution-calendar-factory
 3629 virgilh+  0.0 /usr/libexec/evolution-addressbook-factory-subprocess --factory all --bus-name org.gnome.evolution.dataserver.Subprocess.Backend.AddressBookx3611x2 --own-path /org/gnome/evolution/dataserver/Subprocess/Backend/AddressBook/3611/2
 3611 virgilh+  0.0 /usr/libexec/evolution-addressbook-factory
 3599 virgilh+  0.0 /usr/libexec/dconf-service
 2841 colord    0.0 /usr/libexec/colord
 2761 root      0.0 /usr/libexec/boltd
 3214 virgilh+  0.0 /usr/libexec/at-spi-bus-launcher
 3221 virgilh+  0.0 /usr/libexec/at-spi2-registryd --use-gnome-session
  949 root      0.0 /usr/libexec/accounts-daemon
 3190 virgilh+  0.0 /usr/bin/ssh-agent /bin/sh -c exec -l /bin/bash -c "env GNOME_SHELL_SESSION_MODE=classic gnome-session --session gnome-classic"
 1178 redis     0.0 /usr/bin/redis-server 127.0.0.1:6379
 3263 virgilh+  0.0 /usr/bin/pulseaudio --start --log-target=syslog
  836 libstor+  0.0 /usr/bin/lsmd -d
 3039 virgilh+  0.0 /usr/bin/gnome-keyring-daemon --daemonize --login
  821 dbus      0.0 /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation
 3072 virgilh+  0.0 /usr/bin/dbus-daemon --fork --print-pid 5 --print-address 7 --session
 3219 virgilh+  0.0 /usr/bin/dbus-daemon --config-file=/usr/share/defaults/at-spi2/accessibility.conf --nofork --print-address 3
  853 root      0.0 /usr/bin/abrt-watch-log -F BUG: WARNING: at WARNING: CPU: INFO: possible recursive locking detected ernel BUG at list_del corruption list_add corruption do_IRQ: stack overflow: ear stack overflow (cur: eneral protection fault nable to handle kernel ouble fault: RTNL: assertion failed eek! page_mapcount(page) went negative! adness at NETDEV WATCHDOG ysctl table check failed : nobody cared IRQ handler type mismatch Kernel panic - not syncing: Machine Check Exception: Machine check events logged divide error: bounds: coprocessor segment overrun: invalid TSS: segment not present: invalid opcode: alignment check: stack segment: fpu exception: simd exception: iret exception: /var/log/messages -- /usr/bin/abrt-dump-oops -xtD
  837 root      0.0 /usr/bin/abrt-watch-log -F Backtrace /var/log/Xorg.0.log -- /usr/bin/abrt-dump-xorg -xD
  369 root      0.0 [ttm_swap]
 9147 postfix   0.0 tlsmgr -l -t unix -u
22450 root      0.0 su
22497 root      0.0 sort -b -k3 -r
22355 root      0.0 sleep 60
  297 root      0.0 [scsi_tmf_1]
  288 root      0.0 [scsi_tmf_0]
  291 root      0.0 [scsi_eh_1]
  284 root      0.0 [scsi_eh_0]
  849 root      0.0 /sbin/rngd -f
  795 root      0.0 /sbin/auditd
  797 root      0.0 /sbin/audispd
  801 root      0.0 [rpciod]
    9 root      0.0 [rcu_sched]
    8 root      0.0 [rcu_bh]
 8617 postfix   0.0 qmgr -l -t fifo -u
22496 root      0.0 ps -o pid,user,%mem,command ax
 1580 postgres  0.0 postgres: writer process   
 1581 postgres  0.0 postgres: wal writer process   
 1583 postgres  0.0 postgres: stats collector process   
 1510 postgres  0.0 postgres: logger process   
 1582 postgres  0.0 postgres: autovacuum launcher process   
22237 postfix   0.0 pickup -l -t fifo -u
   24 root      0.0 [netns]
   18 root      0.0 [migration/2]
   13 root      0.0 [migration/1]
    7 root      0.0 [migration/0]
   32 root      0.0 [md]
   10 root      0.0 [lru-add-drain]
11868 root      0.0 [kworker/u6:2]
17163 root      0.0 [kworker/u6:1]
21695 root      0.0 [kworker/2:2]
  453 root      0.0 [kworker/2:1H]
15236 root      0.0 [kworker/2:1]
   21 root      0.0 [kworker/2:0H]
20905 root      0.0 [kworker/1:2]
  371 root      0.0 [kworker/1:1H]
21823 root      0.0 [kworker/1:1]
   16 root      0.0 [kworker/1:0H]
21297 root      0.0 [kworker/0:2]
  384 root      0.0 [kworker/0:1H]
22178 root      0.0 [kworker/0:1]
    4 root      0.0 [kworker/0:0H]
19836 root      0.0 [kworker/0:0]
   51 root      0.0 [kthrotld]
    2 root      0.0 [kthreadd]
   40 root      0.0 [kswapd0]
   19 root      0.0 [ksoftirqd/2]
   14 root      0.0 [ksoftirqd/1]
    6 root      0.0 [ksoftirqd/0]
   41 root      0.0 [ksmd]
   56 root      0.0 [kpsmoused]
   53 root      0.0 [kmpath_rdacd]
   27 root      0.0 [kintegrityd]
   25 root      0.0 [khungtaskd]
   42 root      0.0 [khugepaged]
   23 root      0.0 [kdevtmpfs]
   31 root      0.0 [kblockd]
  106 root      0.0 [kauditd]
   54 root      0.0 [kaluad]
  389 root      0.0 [jbd2/vda2-8]
   58 root      0.0 [ipv6_addrconf]
 3283 virgilh+  0.0 ibus-daemon --xim --panel disable
 3048 gdm       0.0 ibus-daemon --xim --panel disable
22400 virgilh+  0.0 gnome-pty-helper
 3031 root      0.0 gdm-session-worker [pam/gdm-password]
  737 root      0.0 [ext4-rsv-conver]
  390 root      0.0 [ext4-rsv-conver]
   33 root      0.0 [edac-poller]
 8662 root      0.0 dovecot/log
22384 vmail     0.0 dovecot/imap imap-postlogin
22377 vmail     0.0 dovecot/imap imap-postlogin
22371 vmail     0.0 dovecot/imap imap-postlogin
22363 vmail     0.0 dovecot/imap imap-postlogin
22344 vmail     0.0 dovecot/imap imap-postlogin
22335 vmail     0.0 dovecot/imap imap-postlogin
22330 vmail     0.0 dovecot/imap imap-postlogin
22313 vmail     0.0 dovecot/imap imap-postlogin
22257 vmail     0.0 dovecot/imap imap-postlogin
22249 vmail     0.0 dovecot/imap imap-postlogin
22231 vmail     0.0 dovecot/imap imap-postlogin
22195 vmail     0.0 dovecot/imap imap-postlogin
22189 vmail     0.0 dovecot/imap imap-postlogin
22164 vmail     0.0 dovecot/imap imap-postlogin
22153 vmail     0.0 dovecot/imap imap-postlogin
22145 vmail     0.0 dovecot/imap imap-postlogin
22115 vmail     0.0 dovecot/imap imap-postlogin
22078 vmail     0.0 dovecot/imap imap-postlogin
22066 vmail     0.0 dovecot/imap imap-postlogin
22062 vmail     0.0 dovecot/imap imap-postlogin
22028 vmail     0.0 dovecot/imap imap-postlogin
21998 vmail     0.0 dovecot/imap imap-postlogin
21983 vmail     0.0 dovecot/imap imap-postlogin
21946 vmail     0.0 dovecot/imap imap-postlogin
21938 vmail     0.0 dovecot/imap imap-postlogin
21807 vmail     0.0 dovecot/imap imap-postlogin
21513 vmail     0.0 dovecot/imap imap-postlogin
21466 vmail     0.0 dovecot/imap imap-postlogin
21440 vmail     0.0 dovecot/imap imap-postlogin
21277 vmail     0.0 dovecot/imap imap-postlogin
21255 vmail     0.0 dovecot/imap imap-postlogin
21203 vmail     0.0 dovecot/imap imap-postlogin
21161 vmail     0.0 dovecot/imap imap-postlogin
17192 vmail     0.0 dovecot/imap imap-postlogin
 8664 root      0.0 dovecot/config
22362 root      0.0 dovecot/auth -w
 8782 dovecot   0.0 dovecot/auth
 8661 dovecot   0.0 dovecot/anvil
   71 root      0.0 [deferwq]
 3071 virgilh+  0.0 dbus-launch --sh-syntax --exit-with-session
   43 root      0.0 [crypto]
   30 root      0.0 [bioset]
   29 root      0.0 [bioset]
   28 root      0.0 [bioset]
 1432 mysql     0.0 /bin/sh /usr/bin/mysqld_safe --basedir=/usr
  888 root      0.0 /bin/bash /usr/sbin/ksmtuned
22453 root      0.0 bash
22401 virgilh+  0.0 bash
  848 avahi     0.0 avahi-daemon: running [mail.local]
  860 avahi     0.0 avahi-daemon: chroot helper
  240 root      0.0 [ata_sff]
 3585 virgilh+  0.0 abrt-applet
  PID USER     %MEM COMMAND
 5060 suricata  7.6 /sbin/suricata -c /etc/suricata/suricata.yaml --pidfile /var/run/suricata.pid -q 0 --user suricata
 1955 mysql     6.3 /usr/libexec/mysqld --basedir=/usr --datadir=/var/lib/mysql --plugin-dir=/usr/lib64/mysql/plugin --log-error=/var/log/mariadb/mariadb.log --pid-file=/var/run/mariadb/mariadb.pid --socket=/var/lib/mysql/mysql.sock
12897 virgilh+  4.2 /usr/lib64/firefox/firefox -contentproc -childID 4 -isForBrowser -prefsLen 6722 -prefMapSize 191946 -parentBuildID 20200217171646 -greomni /usr/lib64/firefox/omni.ja -appomni /usr/lib64/firefox/browser/omni.ja -appdir /usr/lib64/firefox/browser 12705 tab
12705 virgilh+  2.7 /usr/lib64/firefox/firefox
 3250 virgilh+  2.6 /usr/bin/gnome-shell
  820 redis     2.2 /usr/bin/redis-server 127.0.0.1:0
 1153 matterm+  1.5 /opt/mattermost/bin/mattermost
18461 _rspamd  14.1 /usr/sbin/clamd -c /etc/clamd.d/rspamd.conf
 1320 _rspamd   1.0 rspamd: main process; 0.1 msg/sec, 0.0 msg/sec spam, 0.1 msg/sec ham
 5165 _rspamd   1.0 rspamd: hs_helper process
 5164 _rspamd   1.0 rspamd: controller process (127.0.0.1:11334)
21039 sogo      0.9 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
16719 sogo      0.9 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
16046 sogo      0.9 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
15212 sogo      0.9 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
13186 sogo      0.9 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
 1347 suricata  0.9 /usr/bin/evebox server -c /etc/evebox/evebox.yaml
 8702 sogo      0.8 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
 8237 sogo      0.8 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
29060 sogo      0.8 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
26685 sogo      0.8 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
20691 sogo      0.8 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
19276 sogo      0.8 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
19260 sogo      0.8 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
18957 sogo      0.8 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
17299 sogo      0.8 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
15912 sogo      0.8 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
15583 sogo      0.8 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
15530 sogo      0.8 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
15378 sogo      0.8 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
13098 sogo      0.8 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
12998 sogo      0.8 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
11794 sogo      0.8 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
10973 sogo      0.8 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
12778 virgilh+  0.8 /usr/lib64/firefox/firefox -contentproc -childID 1 -isForBrowser -prefsLen 1 -prefMapSize 191946 -parentBuildID 20200217171646 -greomni /usr/lib64/firefox/omni.ja -appomni /usr/lib64/firefox/browser/omni.ja -appdir /usr/lib64/firefox/browser 12705 tab
 5163 _rspamd   0.8 rspamd: rspamd_proxy process (/var/run/rspamd/worker-proxy mode=0770 owner=_rspamd group=mail)
29004 sogo      0.7 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
25622 sogo      0.7 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
18552 sogo      0.7 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
15768 sogo      0.7 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
 1155 sogo      0.7 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
 1920 root      0.7 /usr/bin/X :0 -background none -noreset -audit 4 -verbose -auth /run/gdm/auth-for-gdm-OP2Cxf/database -seat seat0 -nolisten tcp vt1
 5162 _rspamd   0.7 rspamd: fuzzy process (localhost:11335)
23362 sogo      0.6 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
20032 sogo      0.6 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
18870 sogo      0.6 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
15809 sogo      0.6 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
12834 sogo      0.6 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log
 7764 root      0.6 /usr/bin/python -s /usr/bin/fail2ban-server -xf start
25631 sogo      0.5 /usr/sbin/sogod -WOWorkersCount 45 -WOPidFile /var/run/sogo/sogo.pid -WOLogFile /var/log/sogo/sogo.log

…(and more)

It seems you installed a desktop environment on NethServer. I wouldn’t do it: as you can see Firefox and Gnome eat a lot of RAM.

Did you disable official signatures?