Imunify360 RustBolit duplicate scan processes cause high CPU, RAM, and I/O usage

Issue

On servers protected by Imunify360, multiple RustBolit (ai-bolit) malware scanner processes accumulate for the same account instead of a single scan running and exiting normally. Administrators see dozens to hundreds of /opt/rustbolit/rustbolit processes running at once, all scanning the same path (--path /home/<account>) and the same scan ID (--detached <scan_id>), consuming increasing amounts of CPU, RAM, and disk I/O. Left unaddressed, this can exhaust the server's available memory and crash it. Killing the processes once does not resolve the issue permanently — new duplicates reappear every few minutes as long as the underlying scan is still active.

Environment

• CloudLinux 8/9
• Imunify360
• Malware Scanner
• Confirmed on imunify360-agent 8.13.6 with rustbolit 33.3.14 — upgrading to this version does not resolve the issue
• cPanel/WHM

Solution

There is no permanent fix yet — the issue is tracked internally as DEF-49872 and is still in progress. The steps below recover an affected server now and reduce the chance of recurrence until the fix ships.

---

If the server is already under CPU or memory pressure:

1. Stop all running malware scans: 
   imunify360-agent malware on-demand stop --all
2. Terminate any remaining RustBolit processes: 
   pkill -9 -f 'rustbolit'
3. Remove leftover scan run directories: 
   rm -rf /var/imunify360/aibolit/run/
4. Confirm memory was reclaimed and no duplicate processes remain: 
   free -h ps aux | grep -c '[r]ustbolit'

To reduce the chance of recurrence while the fix is pending:

5. Identify the account that triggers the loop. It appears in the --path argument of the duplicate RustBolit processes (for example, /home/<account>); the associated scan ID is the hexadecimal string that follows --detached.
6. Add that account to the Malware Scanner ignore list and scan it manually, outside peak hours, instead of relying on the automatic background or scheduled scan.
7. Move scheduled and background scans to off-peak hours, and lower scan resource limits (CPU, I/O, RAM) to the minimum under Imunify360 dashboard, Settings > Malware > Resource Consumption. See docs.imunify360.com/dashboard/#resource-consumption for details.

Cause

When a per-account scan (background or on-demand) runs for an unusually long time — typically because the account is very large — Imunify360's scan supervisor periodically checks for scans that appear stuck and relaunches them, roughly every ten minutes. The previous RustBolit (ai-bolit) worker process for that scan is not stopped when this happens, because the agent tracks only the process ID of the most recently launched worker for a given scan ID; earlier worker processes are no longer referenced anywhere and are never cleaned up.

Each leaked worker holds roughly 380 MB of RAM and also competes with the others for the same scan lock, CPU, and I/O, which slows the scan further and can trigger additional relaunches — a feedback loop that keeps adding worker processes. Given enough time, this produces dozens to hundreds of duplicate processes for the same account and scan, exhausting server memory and CPU. RustBolit's scanning speed itself is not the underlying cause: run in isolation, without duplicates competing for the same resources, RustBolit scans at normal speed.

This is tracked internally as DEF-49872 (in progress). A related, earlier-opened task, DEF-45866, covers a different symptom — a scan that hangs at "Preparing File List" without duplicating processes — and is a separate issue from the one described here.

Useful Links

• Internal Tasks: 
  • DEF-49872
  • DEF-45866
  • DEF-38636
• https://cloudlinux.zendesk.com/hc/en-us/articles/27736174999196-Imunify360-RustBolt-wrapper-consumes-excessive-memory-or-swap
• https://docs.imunify360.com/dashboard/#resource-consumption