[clamav-users] Multiple Clam Daemons on a single system

G.W. Haywood clamav at jubileegroup.co.uk
Thu Mar 5 10:17:11 EST 2020

Hi there,

On Thu, 5 Mar 2020, Ashish Poddar via clamav-users wrote:

> We have a situation where we run a clamav daemon to scan files on a system.
> However, in the process, we only use about 10% CPU in the system. We would
> naturally like to increase this number. We were thus trying to come up with
> a way to scan multiple files in parallel on the same system.

My crystal ball is a little bit foggy this afternoon, you might want
to be more forthcoming about your system.  Sometimes that way you will
get more useful ideas in the replies to your questions.

I suspect that the simplest way to increase your 10% CPU number is to
find _another_ number (probably one which you have not yet measured)
and then find ways to reduce that.  Suggestions might be file I/O
transfer rates, latencies/access times/fragmentation, cache hit rates,
memory bandwith, swap (if any) stats, interrupt service stats.  I'm
quite sure there will be many others.  None of them is particularly
relevant to clamd processes specifically.  I do not understand why you
would want to increase CPU utilization, most of the time I'm trying to
find ways to reduce it.  If you just mean that you want to make your
filesystem scans complete more quickly, then perhaps, instead of what
you have actually said, you should say that.

> Is there a way we can spawn multiple clam daemons to do this?

It is not clear to me that your suggested solution will have the
desired effect, but yes, you can run multiple clamd daemons, and
indeed I do routinely do that - but not for reasons like yours.

> I am aware of the multiscan mode in clamdscan but I want each scan to be a
> separate process so as to not increase the overall scan time of any one
> file. Is there a way to do this?

Perhaps you can explain this to me more fully so that I can be sure
that I understand what you want to do.  If I do understand, it is not
clear to me that causing each scan to be in a separate _process_ will
have the desired effect (it might do the opposite of what you hope).
It will likely be in a separate thread in any case.  Have you read
through the example clamd configuration file in the distribution?

> Or are there any other alternatives to tackle this situation?

I think you will first need to do some instrumentation on your systems
to establish what they are doing, and what they are capable of doing.

> This is my first time posting to this mailing list. I apologize if I
> made any violations while using the mailing list.

I wouldn't claim any violation of etiquette, but if you can give us
more information and clearer, reasoned statements of your requirements
that would help us to help you.



More information about the clamav-users mailing list