[clamav-users] Clamscan reboots the system

[Mehmood, Tariq]

> or do something else which limits RAM use to well within what you have.
Thanks for this pointer. Memory hogging by clamscan was causing the
unstable behavior. I have put a limit on the clamscan process for RAM 
usage by using cgroup and I am able to run clamscan by creating a swap
file and limiting RAM. The only downfall of this approach is the time taken
by clamscan which is acceptable for now.
Thanks for your help
________________________________________
From: clamav-users <clamav-users-bounces at lists.clamav.net> on behalf of G.W. Haywood via clamav-users <clamav-users at lists.clamav.net>
Sent: Thursday, October 21, 2021 3:01 AM
To: ClamAV users ML
Cc: G.W. Haywood
Subject: Re: [clamav-users] Clamscan reboots the system

Hi there,

On Wed, 20 Oct 2021, Mehmood, Tariq wrote:

> I am running clamscan on imx6q sabresd board which has 1GB of RAM.

Even if you only use the 'official' databases, that's not enough RAM.
The minimum recommended is 2GB, see

https://docs.clamav.net/

> A few months back, I got an OOM killer while running clamscan which
> killed the clamscan process. So, as a workaround, I introduced a
> swap of 2GB which worked and fixed the OOM killer issue.

It's a sticking plaster, not a fix.  A fix is to have enough RAM.

> But, now if I create a swap file of 2GB and run clamscan, the board
> reboots sometimes, and sometimes the scan is successful. RAM usage
> is quite high and at times only 5MB of it is left free while running
> clamscan and swap usage goes as high as 500MB.

Running with as little a 5MB free is asking for trouble.  Get more RAM
for the device, or use another device (with more RAM) for the scanner,
or do something else which limits RAM use to well within what you have.

> My concern is the random rebooting of the board. Why running
> clamscan is rebooting the board?

Nothing in the ClamAV suite will deliberately reboot a system, but it
is very common to see things crash when memory is tight.  Part of the
reason is that a lot of software is never tested for its behaviour
with very low memory availability.  Perhaps something is crashing the
system when it runs out of memory, and the board is set up to reboot
after a crash?

> Why swap file is no more effective? I mean, Introducing a swap file
> could cause performance degradation, but a reboot shouldn't occur in
> any case!

In an ideal world a reboot shouldn't occur.  But that world isn't ours.

> Is clamscan supposed to work by introducing swap in low-memory systems?

It certainly isn't recommended, and I doubt it's been well tested, but
the problem might not be with clamscan at all.  It might be something
else entirely which is causing the problem - you just happen to notice
it when there's a low memory condition cause by running a scan.

> What might be causing the board to reboot in this case and how it
> can be fixed?

See above.

What is it that you want ClamAV to do for you, and why?

--

73,
Ged.

_______________________________________________

clamav-users mailing list
clamav-users at lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml