[clamav-users] clamscan suddenly taking 25 minutes for a single mail

[Andrew C Aitchison]

On Tue, 6 Apr 2021, Eddie via clamav-users wrote:

> A POP3 proxy program I have running on a Debian 10.8 system, uses clamscan to 
> check incoming e-mails.  At some point in the very early morning (US West 
> Coast time) it suddenly started taking a very long time to scan each mail,  
> So much that the controlling process would time out before clamscan 
> finished.  Up to this point it was running fine.
>
> Running a test from the command line, on a very simple 1-line mail took 
> around 25 minutes:
>
> root at CleanMail:~# date ; clamscan test.msg -v  --no-summary ; date
> Mon 05 Apr 2021 11:59:10 AM PDT
> Scanning /root/test.msg
> /root/test.msg: OK
> Mon 05 Apr 2021 12:24:06 PM PDT
> root at CleanMail:~#
>
> Looking through the logs, I can't see anything happening in the period 
> between the last good scan and the sloooooow ones.
>
> Where should I be going next to track this down.

How much RAM does the machine have ?
Is something else using much RAM ?
Ideally I wouldn't run clamd on a machine with less than 4GB RAM.

If you are running freshclam and clamd, there is a setting which
will stop them using double memory while updating.

-- 
Andrew C. Aitchison					Kendal, UK
 			andrew at aitchison.me.uk