Hi All, > The graph shows two sudden increases in memory consumption, both > consist of more than one step change. The first group of events is a > change from 30 to 56 Megabytes at 04:50 on July 18 and from 56 to 61 > Megabytes at 08:55 on the same day. The second is on July 27 when > memory consumption changed from 62 to 91 Megabytes and 91 to 118 > Megabytes on at 14:49 and 16:49 respectively. > > There is a striking similarity between the graphs around the two large > changes in memory consumption; on July 18 and July 27. In both cases > there is a large step increase followed by several smaller increases > followed by a period of relative stability. > > Times are all British Summer Time, UTC+0100. Freshclam is updating > every hour. The clamav configuration includes phishing detection. > The clamav-milter daemon is started and left to run indefinitely, so > each graph shows the memory consumption for a single process. If > you'd like to see these graphs and you can't because I'm firewalling > your IP, please post your email address to the List and I'll send them > to you. They're only about 4kBytes each. The raw data is available > if you want it.
I have been investigating this problem for a few days now. Here is what I know so far, but I am running out of ideas. 1. I am unable to reliably reproduce the sudden increases in memory usage. However, they have occurred after clamd has been running for at least an hour. 2. Once the memory increase has occurred once, I can sometimes cause it to gobble up a bunch more memory by sending clamd SIGUSR2 to reload the databases. After doing this, memory usage may jump from 70MB to 110MB. 3. If I send a SIGUSR2 to clamd and it does not increase the memory usage as in (2), then it will drop back to the previous memory usage (e.g. from 110MB to 70MB) and then back up (to 110MB). This implies to me that this is not a memory leak, but some sort of mis-allocation. 4. I have run gdb and valgrind against clamd looking form memory leaks and have not found anything significant. 5. One theory I have is that it may have to do with a difference between cvd and text file virus signatures. We are running a very large number of custom signatures that are obviously text files. Removing these signature files seems to alleviate much of the problem (since the vast majority of the remaining signatures are in cvd files). When I extract the cvd files with sigtool to be text files (and remove the cvd files), clamd memory usage again increases unacceptably. I am unable to create cvd files from our custom signatures to see if this resolves the problem. I am happy to test patches or configuration changes, but am running out of ideas. Thank you, Joshua Rubin -- Joshua Rubin [EMAIL PROTECTED] Software Development Engineer Tel: 303-444-1600 Engineering Department Ext: 3238 eSoft, Inc. Fax: 303-444-1640 295 Interlocken Blvd Broomfield, CO 80021
signature.asc
Description: OpenPGP digital signature
_______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://lurker.clamav.net/list/clamav-users.html
