[clamav-users] clamd using ~1GB memory on Debian Stretch

[Kris Deugau]

Avinash Sonawane via clamav-users wrote:
> On Mon, 13 May 2019 16:21:15 +0200
> Matus UHLAR - fantomas <uhlar at fantomas.sk> wrote:
>   
>> loading takes time, much time.
> 
> How much time are we talking about here? I suppose by 'time' we mean
> loading time (load binary and signatures) + processing time (comparing
> signatures).
> 
> Now, for loading time, when I start firefox within 5-6 seconds it
> immediately fills up 250+ Mb memory so for 950+ Mb (clamd) loading time
> shouldn't be that of an issue.

ClamAV isn't just pushing bits from disk to RAM;  it does some active 
processing to convert the signatures from their plaintext format on disk 
into data structures for its pattern matching engine(s) to work with.

On lightly-loaded higher-end modern hardware, it should run about 15 
seconds IME to load the signatures.

On older or less capable hardware, or systems with lots of other 
processing going on, it can easily hit 30s to load the signatures.

On RAM-limited VPSes, you may be hitting swap, in which case load time 
may well be several minutes at least.  (And scanning isn't going to be 
very fast either.)

> Of course, at scanning time those signs/dbs need to be in memory. At
> scanning time not *all the time*. e.g. I am expecting an email at 6 PM.
> I don't mind clamd taking that much of a memory *at* 6 PM and then
> release it. I find it absolutely inconvenient to having to forgo ~1GB
> memory since the morning. As I said, a poor bargain.

For your use case it sounds like you could do without ClamAV entirely.

-kgd