On Wed, 2 Dec 2020, PenguinWhispererThe via clamav-users wrote:

> Hi,
>
> I have a webserver with 4GB of memory that also functions as a mailserver.
> The mail volume is rather low (perhaps a few hundred mails/day).
> Almost every day around the same time I get a swap usage warning and once
> in a while clamd crashes because it has no more swap space available
> blocking mails from being processed.
>
> Right now it uses about 1.3GB and all is fine. I'm using FreeBSD. I'm
> trying to see the logic why every day around the same time clamd decides to
> need so much more memory. It's not like it needs it to process the emails.
>
> I've searched and read that clamd uses a lot of memory (30% is indeed quite
> a lot). But nowhere I see these kinds of numbers (multiple gigabytes).
> Having it use 60% memory (at least 2.3GB when it crashes) is getting
> ridiculous. Since all mails are being processed just fine when clamd uses
> 1.3GB I don't want to just increase the memory as it might start using 60GB
> at some point for no clear reason.
>
> I didn't modify cronjobs recently so I'm unclear on why this seems to be a
> periodic thing. I had it like weeks in a row at around 15:45. Then it
> seemed to have switched to 17:45 and had it now once at 19:45. There seems
> to be this 2 hour change in it or it's something that happens every 2 hours
> and circumstances get "just right" later and later.
>
> Anyone experienced the same? Knows what's going on? Has a solution to this
> (not looking for "don't run clamAV as a daemon")?

https://blog.clamav.net/2020/09/clamav-01030-released.html says

Major changes

     clamd can now reload the signature database without blocking scanning.
This multi-threaded database reload improvement was made possible thanks
to a community effort.
         Non-blocking database reloads are now the default behavior. Some
systems that are more constrained on RAM may need to disable non-blocking
reloads, as it will temporarily consume double the amount of memory. We
added a new clamd config option ConcurrentDatabaseReload, which may be set
to no.

--
Andrew C. Aitchison                                     Kendal, UK
                        andrew@aitchison.me.uk