[clamav-users] clamav-daemon crashing periodically

[Jesús Arnáiz]

Hi,

Thanks for your kind message.

Indeed it looks as an issue related to RAM. Reading Freshclam logs all 
issues came exactly at that moment when a new DB started to be processed.

Very well explained.

*** I sent this message days ago, but I used the wrong account and it 
was returned recently, sorry if I was not quicker with the feedback.

Best Regards,
Jesús.


El 03/06/2020 a las 14:53, G.W. Haywood escribió:
> Hi there,
> 
> On Wed, 3 Jun 2020, Stefan Bauer via clamav-users wrote:
>> Am Mi., 3. Juni 2020 schrieb Jesus Arnaiz via clamav-users
>>
>> > It normally works fine, but, apparently it is crashing everyday more
>> > than once, meaning a manual restart is needed once or twice per day.
>> >
>> > I don't see anything relevant on the logs...
>> > Any ideas?
>> >
>> > My system is:
>> > ...
>>
>> ... Clamav needs a [decent] amount of RAM ...
>>
>> - especially when using 3rd-party signatures. As there are random updates
>> over the day, the reloads could lead to your noticed behavior.
> 
> It might help the OP to know that clamd *normally* uses ~1Gbyte of RAM
> when it LOADS the 'official' signatures (and more than that of course
> if it uses third-party signatures, of which there are many available).
> 
> This memory usage is when clamd starts from the 'cold' state, when it
> was not previously running, but things are different when it RELOADS
> the signature databases while it is running.
> 
> In addition to the normal RAM usage, clamd normally uses twice as much
> RAM when it RELOADS the signature databases because it has one copy in
> its RAM already.  This copy may be used to serve scan requests during
> the time when it is RELOADING the databases after they have changed.
> During the reload, clamd makes a second copy of its data.  After this
> second copy is loaded and tested, and after any scan request which is
> using the first copy has completed, the first copy is deleted and the
> RAM which it used is returned to the operating system's free pool.  It
> usually takes at least some seconds to reload the signature database,
> but if the machine is slow it may take several minutes.  You really do
> not want to drive the machine into using swap space, performance then
> will be very poor indeed.
> 
> This means that at present - and this will change as more signatures
> are added to the databases - you need a minimum of at least 2Gbytes of
> RAM to run clamd with automatic database updates, and probably more
> than that if the box is to do anything useful.  At present I recommend
> a minimum of 4Gbytes RAM for a system which runs clamd.  In addition,
> if you use clamscan, while it scans you will need an *extra* 1 Gbyte
> of RAM over and above the RAM used by clamd.  Note that clamscan and
> clamdscan behave very differently in that clamdscan uses clamd, but
> clamscan does not.  Of course you can use alternate ways of reloading
> the databases, but then you will lose the ability to scan while clamd
> is loading signatures.  That may be acceptable to you, to others it is
> not and the issue has caused some discussion on this list in the past.
> 
> Signature database reloads may be triggered in more than one way.  If
> you use freshclam to update the signatures automatically, it can send
> a signal to clamd to cause a reload; if clamd is itself configured to
> check, and notices that the a database has changed, it will start the
> reload itself; and you can send a 'reload' signal to clamd using its
> listening socket, the API is documented in e.g. the clamd man page.
> 


-- 
El software de antivirus Avast ha analizado este correo electrónico en busca de virus.
https://www.avast.com/antivirus