[clamav-users] ClamAV performance overhead on RHEL & Solaris

[Dennis Peterson]

I ran it on dozens of enterprise systems, real and virtual, under RHEL and 
Oracle Linux. As a mail scanner running on demand it was never a great issue 
regarding performance as they were dedicated servers. But we found that when 
scanning file systems for compliance it would thrash the disk cache and Oracle 
performance would suffer. The thrashing would happen because the scans would 
crawl seldom and never accessed files which bumped active files out of cache. 
There are moderating options available in Oracle to mediate this.

I used to run it on older Sparc systems and noticed that compared to x86 Solaris 
and Linux the Sparc systems to several minutes longer to refresh the signatures 
following an update. This was moderated the only way possible by lowering the 
update rate and running it off hours when off hours existed. I've not run it on 
contemporary Sparc systems. It would rail a bound proc during the refresh.

dp

On 3/17/18 11:04 AM, Len Sanschargrin wrote:
> OMG, Why are you guys trying to make this so difficult?
>
> Ok, Here's where I am. We are planning to implement ClamAV on all Solaris & RHEL servers (medium sized with 1500 total servers - 4 core, 36gb mem).  The keyword being "PLANNING". We have not implemented it anywhere yet. So I'm looking for GENERAL guidance about what kind of overhead has been observed on a single server with ClamAV running. It's no more difficult than that. So if you have some observations worth sharing, thanks. Otherwise we'll get our own metrics when we install and test it in a month or so... The idea of a user group is for users to share experiences. I'm not trying to get free support, just user experience/observations and no I'm not addressing a performance problem and yes I understand that we won't have the exact same configuration. Think of it more as an expectation-setting & capacity-planning exercise....
>
> Thanks very much, Len
>