[clamav-users] reloading database problem

[Matus UHLAR - fantomas]

>>>>On Wed, 9 Feb 2022, Matus UHLAR - fantomas wrote:
>>>>>I have clamav 0.103.5 installed on debian 11 and I'm getting too often
>>>>>errors when reloading database.
>>>>>
>>>>>looking back this problem started appearing on:
>>>>>
>>>>>Mon May 10 11:51:15 2021 -> Database correctly reloaded (12721518 signatures)
>>>>>Mon May 10 12:48:11 2021 -> ERROR: reload_th: Database load failed: Malformed database
>
>>>>>this machine has 4G of RAM and some swap, clamd currently eats ~1.5 GB ...
>
>>>>>I wonder if this problem may be caused by i386 architecture with 3GB limit ...
>>>>>Does clamd reload signature database in the same process?

>On 13.02.22 11:14, Matus UHLAR - fantomas wrote:
>>I have rebooted into 64-bit kernel, without changing any installed software.
>>looks like database updates work flawlessly since:
>[...]
>
>>So the 3GB barrier applies to clamav (no wonder) when reloading signatures.
>>- unlike other SW, no new clamd instance after reload.

On 13.02.22 13:16, Matus UHLAR - fantomas wrote:
>I just encountered the DB reload, watched it closely:
>
>Sun Feb 13 12:46:13 2022 -> Reading databases from /var/lib/clamav
>Sun Feb 13 12:46:50 2022 -> Database correctly reloaded (12732534 signatures)
>Sun Feb 13 12:46:50 2022 -> Activating the newly loaded database...
>
>meanwhile clamd usage doubled and crossed 3.350G
>after 2-3 minutes it dropped back to 1.7G.
>
>I'd invite clamd logging message about database successfully activated.
>
>I'm enabling zswap again, hopefully this time it won't kill system 
>performance.

notes after some time:

after moving to 64-bit OS with 4G available for 32-bit clamav swap issue 
became a bit better, swap usage was higher, but the system was not killed by 
continuously swapping when trying to reload the database (and failing).


I have removed the biggest database "securiteinfoold.hdb" that took about 
300MB on disk (IIRC, the size was close to main and daily)
- number of signatures lowered from 12733384 to 9148084
- RAM usage lowered from 1705796 virt/ 1.5G res to 1364984 virt / 1.2g res
   (TOP output)

I currently have 0.5G of swap used.

I will keep it running like this for some time and then fetch 
securiteinfoold.hdb and then see how many of mails it catches.

-- 
Matus UHLAR - fantomas, uhlar at fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
My mind is like a steel trap - rusty and illegal in 37 states.