[clamav-users] Constant CPU Usage

[Micah Snyder (micasnyd)]

Kai,

Clamd doesn’t throttle itself during a scan.  It will use 100% of a processor core per file scanned.  Caching, if enabled, will prevent repeated scans of files that have already been scanned, though it does still have to hash the file to check if it has been scanned before.  It really depends on how often clamdscan is called / how frequently programs or the OS touches the files you’re watching.

The fswatch invocation appears that it’s watching all files on the desktop and downloads directories, excluding .DS_store files:
https://github.com/essandess/macOS-clamAV/blob/master/ClamdScanOnAccess.wrapper#L43

You may be able to reduce processor usage by filtering fswatch to files that have been created or updated:
http://emcrisostomo.github.io/fswatch/doc/1.14.0/fswatch.html/Invoking-fswatch.html#Filtering-by-Event-Type

-Micah


Micah Snyder
ClamAV Development
Talos
Cisco Systems, Inc.


From: clamav-users <clamav-users-bounces at lists.clamav.net> on behalf of Kai Amundsen <kamundsen at mavens.com>
Reply-To: ClamAV users ML <clamav-users at lists.clamav.net>
Date: Thursday, February 7, 2019 at 12:23 PM
To: "clamav-users at lists.clamav.net" <clamav-users at lists.clamav.net>
Subject: [clamav-users] Constant CPU Usage

Clamd process seems to be using a lot of CPU. It goes 0% for a few seconds then 100% (full use of one thread) for a few seconds constantly forever. This seems to be eating our users laptop battery noticeably

We just rolled out ClamAV to all of our users (running macOS of varying versions) using MacPorts and these instructions ( https://github.com/essandess/macOS-clamAV ) to all users who are technical enough to check CPU usage are reporting this.

Is this normal? Any way to change/fix it?

[https://mavens.com/public/signature/mark@2x.png]<https://mavens.com/?utm_source=signature&utm_medium=email&utm_campaign=signature>

Kai Amundsen | 312 775 2407
[https://mavens.com/public/signature/facebook.png]<https://www.facebook.com/MavensConsulting/>

[https://mavens.com/public/signature/twitter.png]<https://twitter.com/mavens>

[https://mavens.com/public/signature/linkedin.png]<https://www.linkedin.com/company/mavens-consulting-inc.>



Medical Information Cloud: The world's most advanced medical information solution. Learn More »<https://mavens.com/identity?utm_source=signature&utm_medium=email&utm_campaign=signature>


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.clamav.net/pipermail/clamav-users/attachments/20190207/b0d06c32/attachment.htm>