I had also seen high cpu usage when clamd is updating its virusdb info.
Using a strace -p PID into clamd process shows a read operation followed by
a lot of other lines.
I don't have an output of it right now, but when there is a high cpu usage,
try getting the output of strace process and post here. I will try the same
when it happens.
_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://lurker.clamav.net/list/clamav-users.html
