[clamav-users] clamonacc high increase of disk usage

[CamZie]

Hello everyone,

We are using ClamAV and have noticed a high increase of disk usage while running clamonacc real time scan on our server.

Checking the current disk usage with "df -h" it shows:

Filesystem Size Used Avail Use% Mounted on
/dev/xvda1 99G 98G 0 100% /

However, checking with "du -hs" it unfortunately does not show where all the space is being used:

49G var2.5G usr1.9G tmp535M opt79M boot

We then restarted the "clamonacc" service, and after that it freed up the space that was not being shown with "du -hs". And after a while it happens again.

These are the clamd configuration that we are using to scan the whole system (/):

User root
FollowDirectorySymlinks true
FollowFileSymlinks true
OnAccessMountPath /
OnAccessExtraScanning yes
OnAccessExcludeRootUID yes
OnAccessExcludeUname clamav
OnAccessExcludeUname clamdVirusEvent /opt/clamav-response

In the clamonacc log file we only receive the following timeouts however it still works:

ERROR: ClamClient: Connection to clamd failed, Couldn't connect to server.
ClamClient: Connection to clamd re-established.

We are running ClamAV on the following server:

- OS: Debian 11 (bullseye)
- ClamAV version: 0.103.7+dfsg-0+deb11u1

Below is our system configuration for "clamonacc" process:

/etc/systemd/system/clamonacc.service

[Unit]
Description=ClamAV On Access Scanner
Requires=clamav-daemon.service
After=clamav-daemon.service syslog.target network.target

[Service]
Type=simple
User=root
ExecStartPre=/bin/bash -c "while [ ! -S /var/run/clamav/clamd.ctl ]; do sleep 1; done"
ExecStart=/usr/sbin/clamonacc -F --config-file=/etc/clamav/clamd.conf --log=/var/log/clamav/clamonacc.log
Restart=on-failure
RestartSec=120s

[Install]
WantedBy=multi-user.target

Does anyone have an idea what we can do to scan the whole filesystem without having these issues?

Thanks in advance!
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.clamav.net/pipermail/clamav-users/attachments/20230414/1c6eba14/attachment.htm>