Hello everyone,

We are using ClamAV and have noticed a high increase of disk usage while running clamonacc real time scan on our server. 

Checking  the current disk usage with  "df -h" it shows:

Filesystem Size Used Avail Use% Mounted on
/dev/xvda1 99G  98G  0     100% /

However, checking with "du -hs" it unfortunately does not show where all the space is being used:

49G var
2.5G usr
1.9G tmp
535M opt
79M boot

We then restarted the "clamonacc" service, and after that it freed up the space that was not being shown with "du -hs". And after a while it happens again.

These are the clamd configuration that we are using to scan the whole system (/):

User root
FollowDirectorySymlinks true
FollowFileSymlinks true
OnAccessMountPath /
OnAccessExtraScanning yes
OnAccessExcludeRootUID yes
OnAccessExcludeUname clamav
OnAccessExcludeUname clamd
VirusEvent /opt/clamav-response


In the clamonacc log file we only receive the following timeouts however it still works:

ERROR: ClamClient: Connection to clamd failed, Couldn't connect to server.
ClamClient: Connection to clamd re-established.

We are running ClamAV on the following server:

Below is our system configuration for "clamonacc" process:

/etc/systemd/system/clamonacc.service

[Unit]
Description=ClamAV On Access Scanner
Requires=clamav-daemon.service
After=clamav-daemon.service syslog.target network.target

[Service]
Type=simple
User=root
ExecStartPre=/bin/bash -c "while [ ! -S /var/run/clamav/clamd.ctl ]; do sleep 1; done"
ExecStart=/usr/sbin/clamonacc -F --config-file=/etc/clamav/clamd.conf --log=/var/log/clamav/clamonacc.log
Restart=on-failure
RestartSec=120s

[Install]
WantedBy=multi-user.target

Does anyone have an idea what we can do to scan the whole filesystem without having these issues?

Thanks in advance!