[clamav-users] ClamAV UnOfficial Database

[Bond Masuda]

I have to agree on the memory requirements for clamd being high. I 
wonder if it would make sense to store the data set of signatures in a 
tiered hierarchy, with some of the less used data being on disk until 
there's a hit? i don't know enough about the internals and scanning 
algorithm used in clamd to speak meaningfully about it...


On 05/04/2017 10:36 AM, Henrik K wrote:
> On Thu, May 04, 2017 at 02:57:51PM +0200, Reindl Harald wrote:
>> it's unacceptable having a clamd process which wastes nearly 1 GB of RAM
>> hanging around when he don't catch anything
> For once I have to agree..
>
> My stats:
> ClamAV - 10 million sigs (includes most sanesecurity stuff)
> Sophos - 13 million sigs
>
> # /usr/bin/time -f '\t%E real, \t%M kBmem' /usr/local/clamav/bin/clamscan /etc/hosts
> <snip>
>          0:28.18 real,   1096492 kBmem
>
> # /usr/bin/time -f '\t%E real, \t%M kBmem' /opt/sophos-av/bin/savscan /etc/hosts
> <snip>
>          0:05.99 real,   231504 kBmem
>
> Perhaps ClamAV devs should start innovating a little on how to handle all
> the sigs, instead of keeping bloating a glorified in-memory hash-database.
> ;-D Jeez one could probably simply precompile a CDB database from all the
> hashes and dramatically reduce memory usage, probably wouldn't even slow
> down much..
>
> _______________________________________________
> clamav-users mailing list
> clamav-users at lists.clamav.net
> http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
>
>
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
>
> http://www.clamav.net/contact.html#ml