Hi there,

On Wed, 11 May 2022, John Varghese via clamav-users wrote:

> ...
> Tue May 10 20:14:59 2022 -> Reading databases from /var/lib/clamav
>
> I need help understanding why the clamav service seems to hang after
> the container starts.

Using clamd with Docker is a bit new.  I never tried it - I wouldn't
even consider it until it's bedded down for a couple of years - but
there do seem to be a few people using it.  I guess others with more
experience than I may be able to help if it's a genuine clamd/docker
issue which doesn't appear elsewhere.  There have been one or two of
those recently if you trawl the list archives, I'm afraid I can't be
precise because I more or less ignore things related to Docker.  The
search engines should make it easy to search for anything related to
Docker in the archives.  It should also be easy to search the issues
in Github (unless you're using the same browser that I use, Palemoon,
which apparently can't handle anything with 'git' in the domain name).

But first, are you sure it's hanging?  Is it perhaps just taking some
time to read the signature files?  I've seen some systems take several
minutes to do that.

> Are there any other logs that will help understand the issue?

There are system logs which might help, but I wonder if we can get
more information about what's happening from clamd.  You can increase
the verbosity in the clamd log the clamd configuration file (see docs)
and then you can see what's being loaded as it happens.

What do you see if you run 'top' while you're starting clamd?  I'd
expect if you sort the output by memory consumed that you'd see a
clamd process climb to the top of the list and stay there.  While it's
loading signatures you'll see whatever CPUs it's allowed to use being
fully utilized until the signatures are loaded, then after some time
(depending on the CPU cycles/s available to clamd) CPU usage will drop
away more or less to zero until clamd is instructed to scan something.

If the process just disappears of course you have a problem.  How much
RAM is available?  You should budget at least 2GB for clamd.  I'd say
3GB would be safer, and 4GB not unreasonable.  You can reduce RAM used
during the database reloads with a configuration option at the cost of
not being able to scan anything during a reload.

--

73,
Ged.

_______________________________________________

clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml