Imunify360 RustBolt/wrapper consumes excessive memory or swap

Issue

/opt/ai-bolit/wrapper or /opt/rustbolit/rustbolit consumes excessive RAM or swap during or after malware scanning.

The server may become slow or unresponsive, and the process may exceed the expected memory limit.

Environment

• Imunify360
• Malware scanner
• RustBolt / ai-bolit
• ai-bolit versions earlier than 32.8.5
• CloudLinux OS
• cPanel

Solution

Update ai-bolit to version 32.8.5 or later.

---

1. Check the currently installed version:

rpm -q ai-bolit

2. If the installed version is earlier than 32.8.5, update ai-bolit:

yum update ai-bolit --disablerepo=* --enablerepo=imunify*

3. Confirm that the updated version is installed:

rpm -q ai-bolit

If the server is currently affected and memory/swap usage needs to be released before the fixed version is available, use the following temporary mitigation:

imunify360-agent malware on-demand status
imunify360-agent malware on-demand stop

systemctl restart aibolit-resident.socket
systemctl restart aibolit-resident.service

systemctl stop imunify360
systemctl start imunify360

The restart only releases the currently consumed resources. Updating ai-bolit to version 32.8.5 or later is required to address the issue permanently.

Cause

A known issue in earlier ai-bolit / RustBolt versions could cause wrapper or rustbolit processes to consume excessive memory or swap. The issue is fixed in ai-bolit 32.8.5.