Critical issue - server gets overloaded.

Webmin/Virtualmin 3.73GPL on Centos 5.3, Pentium 4, small company, about 5 domains on it (so not a heavy users), had it working for couple of years now, everything was fine, I've been updating it of course on regular basis. Now about every month it gets overloaded or so with something and becomes very slow, sometimes it's just goes to complete "not responding". So someone has to reboot it physically which is no good. To explain in details it starts with this:
I get an email saying:
Monitor on mywebsite.co.uk for 'Apache Webserver' has timed out at at 25/Sep/2009 18:00
Monitor on mywebsite.co.uk for 'Mail Queue Size' has timed out at at 25/Sep/2009 18:00
Monitor on mywebsite.co.uk for 'PostgreSQL Database Server' has timed out at at 25/Sep/2009 18:00
Then I go to either web access via Virtualmin (or via SSH) - it is very slow in response.
Then it shows "CPU load averages 16.12 (1 min) 16.21 (5 mins) 16.54 (15 mins)" which is not normal. usually it is 0.0x%
Also memory shows:
Real memory 503.37 MB total, 465.95 MB used
Virtual memory 1023.99 MB total, 804.14 MB used
Which is a lot as well, not normal.
So every time this happens i have to to "shutdown -r now"
Could some help me to find what causing this overload?

In "Running Processes" when I click Memory, biggest daemons are:
2636 nobody 141032 kB clamd.virtualmin -c /etc/clamd.d/virtualmin.conf
2528 mysql 140832 kB /usr/libexec/mysqld --basedir=/usr --datadir=/var/lib/mysql --user=mysql --pid-f ...
4201 root 130736 kB clamscan --no-summary --stdout -
4204 root 130736 kB clamscan --no-summary --stdout -

Is it something to do with Clamscan?
Thanks

Status: 
Closed (fixed)

Comments

Looks like a memory problem .. most likely due to those other clamscan processes. How many of these are running, and what is their parent processes?

Here is full listing:

Real memory: 503.37 MB total / 168.87 MB free Swap space: 1023.99 MB total / 322.17 MB free

ID Owner Size Command
2639 nobody 141032 kB clamd.virtualmin -c /etc/clamd.d/virtualmin.conf
2534 mysql 139120 kB /usr/libexec/mysqld --basedir=/usr --datadir=/var/lib/mysql --user=mysql --pid-f ...
2800 info.user1 130692 kB /usr/bin/clamscan -
2802 fred.user1 130692 kB /usr/bin/clamscan -
2804 info.user1 130692 kB /usr/bin/clamscan -
2998 apache 108864 kB /usr/sbin/httpd
3022 apache 102572 kB /usr/sbin/httpd
2999 apache 98800 kB /usr/sbin/httpd
3000 apache 98800 kB /usr/sbin/httpd
3001 apache 98800 kB /usr/sbin/httpd
3002 apache 98800 kB /usr/sbin/httpd
3003 apache 98800 kB /usr/sbin/httpd
3004 apache 98800 kB /usr/sbin/httpd
3005 apache 98800 kB /usr/sbin/httpd
3021 apache 98800 kB /usr/sbin/httpd
3023 apache 98800 kB /usr/sbin/httpd
2868 root 98664 kB /usr/sbin/httpd
2798 fred.user1 90992 kB /usr/bin/clamscan -
2114 named 38608 kB /usr/sbin/named -u named -t /var/named/chroot
3183 root 34624 kB /usr/libexec/webmin/virtual-server/lookup-domain-daemon.pl
2995 root 32560 kB /usr/bin/perl /usr/libexec/webmin/virtual-server/collectinfo.pl
3387 gdm 31408 kB /usr/libexec/gdmgreeter
3349 root 27360 kB /usr/libexec/gdm-rh-security-token-helper
3406 root 25524 kB /usr/bin/python -tt /usr/sbin/yum-updatesd
2979 root 25480 kB /usr/bin/python -tt /usr/sbin/yum-updatesd
2305 root 22968 kB pcscd
2602 postgres 21032 kB /usr/bin/postmaster -p 5432 -D /var/lib/pgsql/data
2630 postgres 21032 kB postgres: writer process
2875 apache 20612 kB /usr/sbin/httpd
3448 root 18564 kB /usr/libexec/webmin/security-updates/update.cgi
3473 root 16560 kB /usr/libexec/webmin/proc/index_size.cgi
3347 root 16144 kB /usr/sbin/gdm-binary -nodaemon
3244 root 15420 kB /usr/sbin/gdm-binary -nodaemon
2397 root 13356 kB python ./hpssd.py
2041 root 12516 kB auditd
3194 root 12292 kB /usr/lib/rpm/rpmq -q --all --queryformat %{NAME}\n%{VERSION}-%{RELEASE}\n%{EPOCH ...
2043 root 12068 kB /sbin/audispd
2631 postgres 11812 kB postgres: stats buffer process
3479 root 11420 kB /usr/bin/perl /usr/libexec/webmin/miniserv.pl /etc/webmin/miniserv.conf
3476 root 11416 kB /usr/bin/perl /usr/libexec/webmin/miniserv.pl /etc/webmin/miniserv.conf
2361 root 11412 kB automount
3474 root 11412 kB /usr/bin/perl /usr/libexec/webmin/miniserv.pl /etc/webmin/miniserv.conf
3352 root 11384 kB /usr/bin/Xorg :0 -br -audit 0 -auth /var/gdm/:0.Xauth -nolisten tcp vt7
3231 root 11272 kB /usr/bin/perl /usr/libexec/webmin/miniserv.pl /etc/webmin/miniserv.conf
3216 root 11256 kB /usr/bin/perl /usr/libexec/usermin/miniserv.pl /etc/usermin/miniserv.conf
2632 postgres 11044 kB postgres: stats collector process
2628 postgres 10812 kB postgres: logger process
3018 root 10032 kB sshd: root@pts/1
2409 root 10024 kB cupsd
3475 root 8100 kB smtpd -n smtp -t inet -u -o smtpd_sasl_auth_enable yes
2620 root 7704 kB dovecot-auth
2705 postfix 7476 kB qmgr -l -t fifo -u
3480 postfix 7088 kB smtp -t unix -u
3455 postfix 7044 kB cleanup -z -t unix -u
2423 root 7020 kB /usr/sbin/sshd
2717 postfix 7012 kB local -t unix
2732 postfix 7012 kB local -t unix
2733 postfix 7012 kB local -t unix
2737 postfix 7012 kB local -t unix
2738 postfix 7012 kB local -t unix
2756 postfix 7012 kB local -t unix
2768 postfix 7012 kB local -t unix
3226 postfix 7012 kB local -t unix
3478 postfix 6960 kB bounce -z -t unix -u
3485 postfix 6960 kB bounce -z -t unix -u
3486 postfix 6960 kB bounce -z -t unix -u
2709 postfix 6928 kB trivial-rewrite -n rewrite -t unix -u
2704 postfix 6924 kB pickup -l -t fifo -u
2695 root 6860 kB /usr/libexec/postfix/master
2710 nobody 5968 kB proftpd: (accepting connections)
3016 haldaemon 5920 kB hald
2994 root 5864 kB crond
2952 root 5584 kB /usr/sbin/saslauthd -m /var/run/saslauthd -a pam
2954 root 5584 kB /usr/sbin/saslauthd -m /var/run/saslauthd -a pam
2955 root 5584 kB /usr/sbin/saslauthd -m /var/run/saslauthd -a pam
2956 root 5584 kB /usr/sbin/saslauthd -m /var/run/saslauthd -a pam
2957 root 5584 kB /usr/sbin/saslauthd -m /var/run/saslauthd -a pam
2207 root 5512 kB rpc.idmapd
2882 root 5288 kB crond
2392 root 5144 kB ./hpiod
2636 dovecot 4896 kB imap-login
2637 dovecot 4896 kB imap-login
2638 dovecot 4896 kB imap-login
2906 dovecot 4892 kB pop3-login
3209 dovecot 4892 kB pop3-login
3438 dovecot 4892 kB pop3-login
3036 root 4532 kB -bash
2484 root 4528 kB /bin/sh /usr/bin/mysqld_safe --datadir=/var/lib/mysql --socket=/var/lib/mysql/my ...
2449 ntp 4392 kB ntpd -u ntp:ntp -p /var/run/ntpd.pid -g
3471 root 4260 kB /usr/bin/perl /usr/libexec/webmin/virtual-server/lookup-domain.pl fred.user1 ...
2920 xfs 3856 kB xfs -droppriv -daemon
3484 info.user2 3796 kB /usr/bin/perl /etc/webmin/virtual-server/clam-wrapper.pl /usr/bin/clamscan
3200 root 3508 kB /usr/sbin/smartd -q never
3017 root 3152 kB hald-runner
2226 dbus 2740 kB dbus-daemon --system
2435 root 2720 kB xinetd -stayalive -pidfile /var/run/xinetd.pid
2991 avahi 2588 kB avahi-daemon: running [myip.local]
2992 avahi 2588 kB avahi-daemon: chroot helper
3468 root 2552 kB /usr/libexec/gam_server
435 root 2448 kB /sbin/udevd -d
2797 fred.user1 2404 kB sh -c \/usr\/bin\/clamscan - >/tmp/clamwrapper.2794
2799 info.user1 2404 kB sh -c \/usr\/bin\/clamscan - >/tmp/clamwrapper.2795
2801 fred.user1 2404 kB sh -c \/usr\/bin\/clamscan - >/tmp/clamwrapper.2796
2803 info.user1 2404 kB sh -c \/usr\/bin\/clamscan - >/tmp/clamwrapper.2793
3193 root 2404 kB sh -c rpm -q -a --queryformat "%{NAME}\n%{VERSION}-%{RELEASE}\n%{EPOCH}\n%{GROUP ...
3082 root 2324 kB top
2941 root 2264 kB /usr/sbin/atd
2237 root 2164 kB /usr/sbin/hcid
1 root 2064 kB init [5]
3034 haldaemon 2012 kB hald-addon-acpi: listening on acpid socket /var/run/acpid.socket
3041 haldaemon 2012 kB hald-addon-keyboard: listening on /dev/input/event0
3060 root 1968 kB hald-addon-storage: polling /dev/hda
3227 info.user2 1928 kB /usr/bin/procmail-wrapper -o -a myweb.co.uk -d info.user2 ...
3469 root 1928 kB /usr/bin/procmail-wrapper -o -a myweb.co.uk -d fred.user1 ...
3470 root 1928 kB /usr/bin/procmail-wrapper -o -a myweb.co.uk -d fred.user1 ...
2325 root 1908 kB /usr/bin/hidd --server
2722 root 1900 kB gpm -m /dev/input/mice -t exps2
2616 root 1872 kB /usr/sbin/dovecot
2167 rpcuser 1852 kB rpc.statd
2134 rpc 1808 kB portmap
2243 root 1740 kB /usr/sbin/sdpd
2060 root 1720 kB syslogd -m 0
2063 root 1672 kB klogd -x
2381 root 1668 kB /usr/sbin/acpid
2931 root 1668 kB anacron -s
3238 root 1656 kB /sbin/mingetty tty1
3239 root 1656 kB /sbin/mingetty tty2
3240 root 1656 kB /sbin/mingetty tty3
3241 root 1656 kB /sbin/mingetty tty4
3242 root 1656 kB /sbin/mingetty tty5
3243 root 1656 kB /sbin/mingetty tty6
2 root 0 kB [migration/0]
3 root 0 kB [ksoftirqd/0]
4 root 0 kB [watchdog/0]
5 root 0 kB [events/0]
6 root 0 kB [khelper]
7 root 0 kB [kthread]
10 root 0 kB [kblockd/0]
11 root 0 kB [kacpid]
101 root 0 kB [cqueue/0]
104 root 0 kB [khubd]
106 root 0 kB [kseriod]
166 root 0 kB [kswapd0]
167 root 0 kB [aio/0]
324 root 0 kB [kpsmoused]
347 root 0 kB [ata/0]
348 root 0 kB [ata_aux]
353 root 0 kB [kstriped]
362 root 0 kB [ksnapd]
373 root 0 kB [kjournald]
401 root 0 kB [kauditd]
1452 root 0 kB [kmpathd/0]
1453 root 0 kB [kmpath_handlerd]
1476 root 0 kB [kjournald]
2200 root 0 kB [rpciod/0]
2266 root 0 kB [krfcommd]
3394 root 0 kB [miniserv.pl]
3402 root 0 kB [pdflush]
3453 root 0 kB [pdflush]

It looks like clamscan is being run as well as clamd, which is needless duplication.

In Virtualmin, go to Email Messages -> Spam and Virus Scanning, and change the "Virus scanning program" to "Server scanner (clamdscan)", then click "Save". Wait a while, and you should see those clamscan processes disappear..

seems fixed now thanks Jamie!

Automatically closed -- issue fixed for 2 weeks with no activity.

I did everything like Jamie said, it helped. I only had one process instead of two simultaneous. Anyway, it lasted for about 2 months without any problems and just 3 days ago I found my server in a same state - overloaded, hard drive led light was on all the time, I've checked procesess with command "top", rebooted - same thing, it was down to spamd and clam processess, so I had to switch them all OFF on every of my domain names to stop it (you cannot switch it off for all of them in one click). It works fine now (i dont have any antivirus or antispam protection though). I know there is an article about this on Virtualmin and how consuming it is to processor and memory but is there a way to find like recommended limits for hardware and emails, this server is run in local network with 8 PCs, it is Pentium 4 2.4Ghz with 512Mb Ram, it can't be that overloading, can it? I am not sure if it is a good idea to turn Antispam/Antivirus again on server. Thanks for your time guys reading this.

That could occur if you're seeing a high volume of email... for example, if someone on your server were sending out a mailing list newsletter to a large number of people, the number of bounces it generates could cause clam and spamassassin to take up a lot of resources. I've also seen that happen a lot when bots break into old versions of web apps, and use them to send out spam.

You may want to take a peek at your Postfix queue to see what's sitting in it (you can run the mailq command).

Also, 512M of RAM may be a little too low .. if you see the hard drive on all the time, it typically indicates swapping, which means low RAM. I would recommend getting more RAM if you can.

Thanks for your quick response guys. No, no one is sending newsletters for sure, we have a lot of junk coming in every day though. I will install more memory this week, but right now still have this problem popping again and again. Do not know how to completely disable Antivirus/Antispam. I've disabled it in Virtualmin "Features and Plugins", in "Bootup and Shutdown" in Webmin (had a message here though: Stopping spamd: [FAILED]) and rebooted the server. Server works fine for a day or so and eventually it gets overloaded again, in processess there is "clamscan" which shouldn't be there at all and another strange thing - 4 processess of httpd. "killall clamscan" helps to clear the memory for a minute but then - it appears in processess again... Appreciate your help!

To completely disable spam and virus filtering for all domains, you can use a command like :

virtualmin disable-feature --spam --virus --all-domains

0) virtualmin disable-feature --spam --virus --all-domains

The --spam option cannot be used unless the feature is enabled in the module configuration

Enables features for one or more domains specified on the command line.

1) virtualmin enable-feature --spam --virus --all-domains ..all done...

2) virtualmin disable-feature --spam --virus --all-domains ..all done.. (with "procmail entry not found..." for some domains)

3) "clamscan" is still running and using all resources. Has antivirus taken the other side, the dark one? =)

Not sure what to do here... Thanks

You may need to manually kill all running clamscan processes, as there may be some running from email received prior to turning it off..

I just did, they keep popping up with a new PID.

Try killing them all again, and any running procmail processes.

it doesnt seem to help
I also get number of emails to root:
----------------------------------
The mail system
(expanded from ): Command time
limit exceeded: "/usr/bin/procmail-wrapper -o -a $DOMAIN -d $LOGNAME"
----------------------------------

"top" shows:

ID Owner Size Command
2479 nobody 146004 kB clamd.virtualmin -c /etc/clamd.d/virtualmin.conf
2375 mysql 144564 kB /usr/libexec/mysqld --basedir=/usr --datadir=/var/lib/mysql --user=mysql --pid-f ...
5804 apache 106788 kB /usr/sbin/httpd
5471 apache 106304 kB /usr/sbin/httpd
4687 apache 106220 kB /usr/sbin/httpd
5770 apache 105816 kB /usr/sbin/httpd
5798 apache 105800 kB /usr/sbin/httpd
5470 apache 105772 kB /usr/sbin/httpd
5783 apache 105756 kB /usr/sbin/httpd
5767 apache 105732 kB /usr/sbin/httpd
5776 apache 105696 kB /usr/sbin/httpd
2652 apache 105636 kB /usr/sbin/httpd
5491 apache 105632 kB /usr/sbin/httpd
5786 apache 105560 kB /usr/sbin/httpd
5802 apache 105556 kB /usr/sbin/httpd
5474 apache 104344 kB /usr/sbin/httpd
5779 apache 104252 kB /usr/sbin/httpd
5485 apache 104164 kB /usr/sbin/httpd
5490 apache 104148 kB /usr/sbin/httpd
5765 apache 103984 kB /usr/sbin/httpd
5782 apache 103460 kB /usr/sbin/httpd
5473 apache 103452 kB /usr/sbin/httpd
2612 root 99324 kB /usr/sbin/httpd
8845 root 80024 kB clamscan --no-summary --stdout -
8849 root 79512 kB clamscan --no-summary --stdout -
8839 root 77464 kB clamscan --no-summary --stdout -
8836 root 76696 kB clamscan --no-summary --stdout -
7664 root 58800 kB /usr/bin/perl /usr/libexec/webmin/virtual-server/collectinfo.pl
4389 root 39408 kB /usr/bin/python -tt /usr/libexec/yum-updatesd-helper --check --dbus
1987 named 39104 kB /usr/sbin/named -u named -t /var/named/chroot
8718 root 36940 kB /usr/bin/perl /usr/libexec/webmin/virtual-server/bw.pl
3912 root 32832 kB /usr/libexec/webmin/virtual-server/lookup-domain-daemon.pl
3044 gdm 32532 kB /usr/libexec/gdmgreeter
8389 root 30492 kB /bin/sort
2222 root 30332 kB automount
3008 root 28612 kB /usr/libexec/gdm-rh-security-token-helper
3052 root 26776 kB /usr/bin/python -tt /usr/sbin/yum-updatesd
2155 root 23112 kB pcscd
2446 postgres 22220 kB /usr/bin/postmaster -p 5432 -D /var/lib/pgsql/data
2470 postgres 22220 kB postgres: writer process
2621 apache 20776 kB /usr/sbin/httpd
3006 root 17288 kB /usr/sbin/gdm-binary -nodaemon
2901 root 16672 kB /usr/sbin/gdm-binary -nodaemon
8871 root 16552 kB /usr/libexec/webmin/proc/index_size.cgi
8388 root 15216 kB /usr/lib/rpm/rpmq -q --all --qf %{name}-%{version}-%{release}.%{arch}.rpm\n
2244 root 14560 kB python ./hpssd.py
2495 postgrey 14372 kB /usr/sbin/postgrey -d --unix=/var/spool/postfix/postgrey/socket
1919 root 13108 kB /sbin/audispd
2471 postgres 13000 kB postgres: stats buffer process
1917 root 12548 kB auditd
2472 postgres 12180 kB postgres: stats collector process
2467 postgres 12000 kB postgres: logger process
3009 root 11488 kB /usr/bin/Xorg :0 -br -audit 0 -auth /var/gdm/:0.Xauth -nolisten tcp vt7
8876 root 11424 kB /usr/bin/perl /usr/libexec/webmin/miniserv.pl /etc/webmin/miniserv.conf
8879 root 11424 kB /usr/bin/perl /usr/libexec/webmin/miniserv.pl /etc/webmin/miniserv.conf
8880 root 11424 kB /usr/bin/perl /usr/libexec/webmin/miniserv.pl /etc/webmin/miniserv.conf
2887 root 11292 kB /usr/bin/perl /usr/libexec/webmin/miniserv.pl /etc/webmin/miniserv.conf
2879 root 11268 kB /usr/bin/perl /usr/libexec/usermin/miniserv.pl /etc/usermin/miniserv.conf
2254 root 11232 kB cupsd
3426 root 10060 kB sshd: root@pts/1
8820 postfix 8412 kB smtpd -n smtp -t inet -u -o smtpd_sasl_auth_enable yes
8874 postfix 8388 kB smtpd -n smtp -t inet -u -o smtpd_sasl_auth_enable yes
2466 root 7828 kB dovecot-auth
2554 postfix 7208 kB qmgr -l -t fifo -u
2266 root 7076 kB /usr/sbin/sshd
2586 postfix 7060 kB local -t unix
7957 postfix 7060 kB local -t unix
8063 postfix 7060 kB local -t unix
8770 postfix 7060 kB local -t unix
7660 root 6988 kB crond
8711 root 6984 kB crond
8713 root 6984 kB crond
8736 root 6984 kB crond
8877 root 6984 kB crond
8878 root 6984 kB crond
8765 postfix 6976 kB trivial-rewrite -n rewrite -t unix -u
8625 postfix 6972 kB pickup -l -t fifo -u
8823 postfix 6964 kB anvil -l -t unix -u
8853 root 6964 kB /usr/sbin/sendmail -FCronDaemon -i -odi -oem -oi -t
8854 root 6936 kB /usr/sbin/postdrop -r
2548 root 6908 kB /usr/libexec/postfix/master
2622 root 6408 kB crond
2729 haldaemon 6004 kB hald
2560 nobody 5980 kB proftpd: (accepting connections)
3441 root 5648 kB -bash
2325 root 5644 kB /bin/sh /usr/bin/mysqld_safe --datadir=/var/lib/mysql --socket=/var/lib/mysql/my ...
2687 root 5596 kB /usr/sbin/saslauthd -m /var/run/saslauthd -a pam
2688 root 5596 kB /usr/sbin/saslauthd -m /var/run/saslauthd -a pam
2689 root 5596 kB /usr/sbin/saslauthd -m /var/run/saslauthd -a pam
2690 root 5596 kB /usr/sbin/saslauthd -m /var/run/saslauthd -a pam
2691 root 5596 kB /usr/sbin/saslauthd -m /var/run/saslauthd -a pam
4266 root 5596 kB /bin/bash /usr/bin/run-parts /etc/cron.daily
8385 root 5596 kB /bin/sh /etc/cron.daily/rpm
2061 root 5520 kB rpc.idmapd
8386 root 5336 kB awk -v progname=/etc/cron.daily/rpm progname {????? print progname ":\n"????? pr ...
2239 root 5156 kB ./hpiod
7264 dovecot 4904 kB imap-login
8457 dovecot 4904 kB imap-login
8473 dovecot 4904 kB imap-login
8563 dovecot 4900 kB pop3-login
8729 dovecot 4900 kB pop3-login
8732 dovecot 4900 kB pop3-login
2292 ntp 4400 kB ntpd -u ntp:ntp -p /var/run/ntpd.pid -g
2659 xfs 3864 kB xfs -droppriv -daemon
8739 root 3808 kB /usr/bin/perl /usr/share/awstats/tools/awstats_updateall.pl now -configdir=/etc/ ...
2866 root 3516 kB /usr/sbin/smartd -q never
2730 root 3164 kB hald-runner
2076 dbus 2756 kB dbus-daemon --system
2280 root 2728 kB xinetd -stayalive -pidfile /var/run/xinetd.pid
2720 avahi 2600 kB avahi-daemon: chroot helper
3055 root 2564 kB /usr/libexec/gam_server
434 root 2476 kB /sbin/udevd -d
8721 root 2412 kB /bin/bash /usr/share/clamav/freshclam-sleep
8738 root 2412 kB /bin/bash /usr/bin/run-parts /etc/cron.hourly
8865 root 2336 kB top
2676 root 2276 kB /usr/sbin/atd
2091 root 2172 kB /usr/sbin/hcid
8740 root 2152 kB awk -v progname=/etc/cron.hourly/awstats progname {????? print progname ":\n"??? ...
1 root 2072 kB init [5]
2741 haldaemon 2020 kB hald-addon-acpi: listening on acpid socket /var/run/acpid.socket
2745 haldaemon 2020 kB hald-addon-keyboard: listening on /dev/input/event0
2754 root 1976 kB hald-addon-storage: polling /dev/hda
8771 root 1936 kB /usr/bin/procmail-wrapper -o -a myhost.co.uk -d corparc.man ...
8772 root 1936 kB /usr/bin/procmail-wrapper -o -a myhost.co.uk -d root
8773 root 1936 kB /usr/bin/procmail-wrapper -o -a myhost.co.uk -d root
8782 root 1936 kB /usr/bin/procmail-wrapper -o -a myhost.co.uk -d corparc.man ...
8835 root 1936 kB /usr/bin/procmail-wrapper -o -a myhost.co.uk -d root
8838 root 1936 kB /usr/bin/procmail-wrapper -o -a myhost.co.uk -d root
8844 root 1936 kB /usr/bin/procmail-wrapper -o -a myhost.co.uk -d corparc.man ...
8848 root 1936 kB /usr/bin/procmail-wrapper -o -a myhost.co.uk -d corparc.man ...
2183 root 1916 kB /usr/bin/hidd --server
2570 root 1908 kB gpm -m /dev/input/mice -t exps2
2458 root 1880 kB /usr/sbin/dovecot
2037 rpcuser 1868 kB rpc.statd
2005 rpc 1816 kB portmap
2097 root 1748 kB /usr/sbin/sdpd
1935 root 1728 kB syslogd -m 0
2668 root 1720 kB anacron -s
1938 root 1680 kB klogd -x
2166 root 1676 kB /usr/sbin/acpid
8725 root 1668 kB sleep 7328
2895 root 1664 kB /sbin/mingetty tty1
2896 root 1664 kB /sbin/mingetty tty2
2897 root 1664 kB /sbin/mingetty tty3
2898 root 1664 kB /sbin/mingetty tty4
2899 root 1664 kB /sbin/mingetty tty5
2900 root 1664 kB /sbin/mingetty tty6
2 root 0 kB [migration/0]
3 root 0 kB [ksoftirqd/0]
4 root 0 kB [watchdog/0]
5 root 0 kB [events/0]
6 root 0 kB [khelper]
7 root 0 kB [kthread]
10 root 0 kB [kblockd/0]
11 root 0 kB [kacpid]
101 root 0 kB [cqueue/0]
104 root 0 kB [khubd]
106 root 0 kB [kseriod]
167 root 0 kB [kswapd0]
168 root 0 kB [aio/0]
326 root 0 kB [kpsmoused]
349 root 0 kB [ata/0]
350 root 0 kB [ata_aux]
355 root 0 kB [kstriped]
364 root 0 kB [ksnapd]
375 root 0 kB [kjournald]
401 root 0 kB [kauditd]
1373 root 0 kB [kmpathd/0]
1374 root 0 kB [kmpath_handlerd]
1397 root 0 kB [kjournald]
2031 root 0 kB [rpciod/0]
2120 root 0 kB [krfcommd]
8421 root 0 kB [pdflush]
8652 root 0 kB [pdflush]

Were you able to disable virus scanning globally with the command :

virtualmin disable-feature --spam --virus --all-domains

Or did it complain that the virus filtering feature was not enabled? If so, you should re-enable it at System Settings -> Features and Plugins.

I've got 2 gig of RAM now, everything seems ok, only 500mb in use after I've switched on antivirus/antispam back on again..