[clamav-users] clamd using ~1GB memory on Debian Stretch

[Alan Stern]

On Mon, 13 May 2019, Matus UHLAR - fantomas wrote:

> >> On Mon, 13 May 2019 19:30:12 +0530
> >> Avinash Sonawane <rootkea at gmail.com> wrote:
> >>
> >> > Single email account here. On average, I receive one email a day.
> >> > Devoting 1Gb memory all the time for that seems a poor bargain.
> 
> >On Mon, 13 May 2019, Avinash Sonawane via clamav-users wrote:
> >> Why can't clamd let databases/signatures stay in secondary memory
> >> itself. Just load them when you actually receive message (or performing
> >> the scan explicitly asked by user). Process and then again unload.
> >> Waiting for next message.
> >>
> >> Why clamd needs to have signatures/databases loaded in primary memory
> >> all the time? Even when there is no active scan or incoming email? This
> >> doesn't make sense.
> 
> On 13.05.19 10:34, Alan Stern wrote:
> >What you're asking for is clamscan (as opposed to clamd and clamdscan).
> >It loads the signatures when it runs, and after scanning all the memory
> >is released.
> 
> however, it uses about the same memory:
> 
>   PID USER      PR  NI    VIRT    RES    SHR S  %CPU %MEM     TIME+ COMMAND
>  2634 clamav    20   0  999856 866284  12656 S   0.0 21.0 265:55.79 clamd
> 24906 root      20   0  967288 875404  22844 R  98.3 21.2   0:38.71 clamscan
> 
> but much longer time:
> 
> # time clamscan /tmp/hwinfo
> /tmp/hwinfo: OK
> 
> ----------- SCAN SUMMARY -----------
> Known viruses: 9157095
> Engine version: 0.100.3
> Scanned directories: 0
> Scanned files: 1
> Infected files: 0
> Data scanned: 0.57 MB
> Data read: 0.29 MB (ratio 1.95:1)
> Time: 39.043 sec (0 m 39 s)
> 38.208u 0.652s 0:39.11 99.3%    0+0k 78984+0io 13pf+0w
> 
> 
> # time clamdscan /tmp/hwinfo
> /tmp/hwinfo: OK
> 
> ----------- SCAN SUMMARY -----------
> Infected files: 0
> Time: 0.161 sec (0 m 0 s)
> 0.004u 0.000s 0:00.17 0.0%      0+0k 8+0io 0pf+0w

True, but it has the behavior that Avinash asked for: It doesn't use up
1 GB of memory when it's not busy loading or scanning.  For someone who
only receives about one email per day, trading off 39 seconds execution
time for 1 GB of permanently occupied memory might be worthwhile.

Alan Stern