[clamav-users] Need help: clamd stops after starting without any error message

[Torge Riedel]

I worked around the "OOM" problem by ordering 1 GB more RAM at my provider and - thanks to VM world - the RAM was increased to 2 GB on the fly.

After that I was able to start clamd. Output of "top -p <clamd.pid>" is:

Tasks:   1 total,   0 running,   1 sleeping,   0 stopped,   0 zombie
Cpu(s):  0.0%us,  0.0%sy,  0.0%ni,100.0%id,  0.0%wa,  0.0%hi, 0.0%si,  0.0%st
Mem:   2097152k total,  1242976k used,   854176k free,        0k buffers
Swap:        0k total,        0k used,        0k free,   188020k cached

   PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+ COMMAND
  9102 clamav    20   0  670m 499m  644 S    0 24.4   0:00.00 clamd

I think 670m / 499m is quite a lot for a small sized VM, although I have to say that this VM is really old and new VM orders always start at minimum of 2 GB of RAM.

Any chance to reduce RAM usage of clamd by configuration?

Torge


Am 19.04.2017 um 13:42 schrieb Torge Riedel:
> Ok, enabled debug.
>
> Find attached the output of
>
> service clamav-daemon start > /tmp/clamd_start.log 2>&1
>
> at the end it says:
>
> LibClamAV debug: main.msb loaded
> LibClamAV debug: Ignoring signature Win.Trojan.AT-8
> LibClamAV debug: Ignoring signature Win.Trojan.Agent-653
> LibClamAV debug: Ignoring signature Email.Phishing.DblDom-53
> LibClamAV debug: Ignoring signature Email.Phishing.DblDom-60
> LibClamAV debug: Ignoring signature Win.Trojan.Qhost-106
> Killed
>    ...fail!
>
> To check where "Killed" is coming from I directly started clamd:
>
> /usr/sbin/clamd
>
> and it prints "Killed" at the end. I think the "   ...fail!" is from "service".
>
> So I googled again with this hint (never saw this before) and found this:
>
> http://forums.interworx.com/threads/8501-Clamd-being-killed
>
> which brought me to the idea to monitor resource usage:
> Connecting with two shells and running a "top" before starting clamd I see that
>
>  1. ~480 MBs RAM is free before starting clamd (server has a total of 1 GB RAM)
>  2. Starting clamd consumes all the free memory and stops with "Killed"
>
> Seems as if the free RAM is no more enough for clamd, but I am wondering why it consumes so much memory? Is this normal?
> Is there a chance to fix that by change of configuration?
>
> I googled but have not found a good answer yet. Only "remove clamav" which is not what I want to do.
>
> Torge
>
>
> Am 19.04.2017 um 12:43 schrieb Steve Basford:
>> On Wed, April 19, 2017 10:13 am, Torge Riedel wrote:
>>> Well, was not enabled. After setting
>>>
>>>
>>> LogSyslog true
>> Might be worth turning on debug temporarily... clamd.conf and freshclam.conf
>>
>> # Enable debug messages in libclamav.
>> # Default: no
>>
>>
>
> _______________________________________________
> clamav-users mailing list
> clamav-users at lists.clamav.net
> http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
>
>
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
>
> http://www.clamav.net/contact.html#ml
>