[clamav-users] Clamscan reboots the system

[Matus UHLAR - fantomas]

>> or do something else which limits RAM use to well within what you have.

On 21.10.21 12:50, Mehmood, Tariq wrote:
>Thanks for this pointer. Memory hogging by clamscan was causing the
>unstable behavior. I have put a limit on the clamscan process for RAM
>usage by using cgroup and I am able to run clamscan by creating a swap
>file and limiting RAM. The only downfall of this approach is the time taken
>by clamscan which is acceptable for now.

Of course - there are so many virus signatures that they do not fit into
memory.
get computer with more memory, or maybe other antivirus sw (I really don't
know if any fits into memory).


>From: clamav-users <clamav-users-bounces at lists.clamav.net> on behalf of G.W. Haywood via clamav-users <clamav-users at lists.clamav.net>
>Sent: Thursday, October 21, 2021 3:01 AM
>To: ClamAV users ML
>Cc: G.W. Haywood
>Subject: Re: [clamav-users] Clamscan reboots the system
>
>Hi there,
>
>On Wed, 20 Oct 2021, Mehmood, Tariq wrote:
>
>> I am running clamscan on imx6q sabresd board which has 1GB of RAM.
>
>Even if you only use the 'official' databases, that's not enough RAM.
>The minimum recommended is 2GB, see
>
>https://docs.clamav.net/
>
>> A few months back, I got an OOM killer while running clamscan which
>> killed the clamscan process. So, as a workaround, I introduced a
>> swap of 2GB which worked and fixed the OOM killer issue.
>
>It's a sticking plaster, not a fix.  A fix is to have enough RAM.
>
>> But, now if I create a swap file of 2GB and run clamscan, the board
>> reboots sometimes, and sometimes the scan is successful. RAM usage
>> is quite high and at times only 5MB of it is left free while running
>> clamscan and swap usage goes as high as 500MB.
>
>Running with as little a 5MB free is asking for trouble.  Get more RAM
>for the device, or use another device (with more RAM) for the scanner,
>or do something else which limits RAM use to well within what you have.
>
>> My concern is the random rebooting of the board. Why running
>> clamscan is rebooting the board?
>
>Nothing in the ClamAV suite will deliberately reboot a system, but it
>is very common to see things crash when memory is tight.  Part of the
>reason is that a lot of software is never tested for its behaviour
>with very low memory availability.  Perhaps something is crashing the
>system when it runs out of memory, and the board is set up to reboot
>after a crash?
>
>> Why swap file is no more effective? I mean, Introducing a swap file
>> could cause performance degradation, but a reboot shouldn't occur in
>> any case!
>
>In an ideal world a reboot shouldn't occur.  But that world isn't ours.
>
>> Is clamscan supposed to work by introducing swap in low-memory systems?
>
>It certainly isn't recommended, and I doubt it's been well tested, but
>the problem might not be with clamscan at all.  It might be something
>else entirely which is causing the problem - you just happen to notice
>it when there's a low memory condition cause by running a scan.
>
>> What might be causing the board to reboot in this case and how it
>> can be fixed?
>
>See above.
>
>What is it that you want ClamAV to do for you, and why?
>
>--
>
>73,
>Ged.
>
>_______________________________________________
>
>clamav-users mailing list
>clamav-users at lists.clamav.net
>https://lists.clamav.net/mailman/listinfo/clamav-users
>
>
>Help us build a comprehensive ClamAV guide:
>https://github.com/vrtadmin/clamav-faq
>
>http://www.clamav.net/contact.html#ml
>
>_______________________________________________
>
>clamav-users mailing list
>clamav-users at lists.clamav.net
>https://lists.clamav.net/mailman/listinfo/clamav-users
>
>
>Help us build a comprehensive ClamAV guide:
>https://github.com/vrtadmin/clamav-faq
>
>http://www.clamav.net/contact.html#ml

-- 
Matus UHLAR - fantomas, uhlar at fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Your mouse has moved. Windows NT will now restart for changes to take
to take effect. [OK]