[clamav-users] clamd using ~1GB memory on Debian Stretch

[Graeme Fowler]

On 13/05/2019, 15:57, Avinash Sonawane wrote:
> Of course, at scanning time those signs/dbs need to be in memory. At
> scanning time not *all the time*. e.g. I am expecting an email at 6 PM.
> I don't mind clamd taking that much of a memory *at* 6 PM and then
> release it. I find it absolutely inconvenient to having to forgo ~1GB
> memory since the morning. As I said, a poor bargain.

To paraphrase Apple's mistake from a few years back, "You're holding it wrong".

The ClamAV daemon is meant to be a permanently running, on-demand scanning service that can be called by the clamdscan binary, applications that have been linked against libclamav or accessed via the well-documented socket API.

If your use case is intermittent scanning, you probably don't need to use the daemon; as others have pointed out you can just use the clamscan binary instead.

I'm using clamd across a fleet of mail servers, which between them are scanning from 100k to 1 million messages per day. They're using more than just the default signatures and run at between 2GB to 2.5GB VSZ, 1GB RSS. We couldn't afford the signature loading time if we ran clamscan for every message.

If you need the immediacy, you need to accept the memory usage (but memory is cheap, right?). If you need the memory, use the slower method. If you're running a mail server that receives one email per day... maybe do that in a different way so you use your resources for something else!

Graeme