Kai,

 

Clamd doesn’t throttle itself during a scan.  It will use 100% of a processor core per file scanned.  Caching, if enabled, will prevent repeated scans of files that have already been scanned, though it does still have to hash the file to check if it has been scanned before.  It really depends on how often clamdscan is called / how frequently programs or the OS touches the files you’re watching.

 

The fswatch invocation appears that it’s watching all files on the desktop and downloads directories, excluding .DS_store files:

https://github.com/essandess/macOS-clamAV/blob/master/ClamdScanOnAccess.wrapper#L43

 

You may be able to reduce processor usage by filtering fswatch to files that have been created or updated:

http://emcrisostomo.github.io/fswatch/doc/1.14.0/fswatch.html/Invoking-fswatch.html#Filtering-by-Event-Type

 

-Micah

 


Micah Snyder
ClamAV Development
Talos
Cisco Systems, Inc.

 

 

From: clamav-users <clamav-users-bounces@lists.clamav.net> on behalf of Kai Amundsen <kamundsen@mavens.com>
Reply-To: ClamAV users ML <clamav-users@lists.clamav.net>
Date: Thursday, February 7, 2019 at 12:23 PM
To: "clamav-users@lists.clamav.net" <clamav-users@lists.clamav.net>
Subject: [clamav-users] Constant CPU Usage

 

Clamd process seems to be using a lot of CPU. It goes 0% for a few seconds then 100% (full use of one thread) for a few seconds constantly forever. This seems to be eating our users laptop battery noticeably

 

We just rolled out ClamAV to all of our users (running macOS of varying versions) using MacPorts and these instructions ( https://github.com/essandess/macOS-clamAV ) to all users who are technical enough to check CPU usage are reporting this.

 

Is this normal? Any way to change/fix it?

 

https://mavens.com/public/signature/mark@2x.png

Kai Amundsen | 312 775 2407

https://mavens.com/public/signature/facebook.png

https://mavens.com/public/signature/twitter.png

https://mavens.com/public/signature/linkedin.png

 

Medical Information Cloud: The world's most advanced medical information solution. Learn More »