Hi Dave, Thanks for getting back to me. I think from your email, the answer is quite simply that the minimum processes clamd needs is two, a controller and at least one worker but can create more workers up to MaxThreads. The amount of memory shown is a reserved amount by clamd when it starts which it shares over it's worker threads.
I would like to see how much RAM it shows when another worker is created but I doubt that will ever happen as it has very low email traffic and there isnt enough RAM for another one :) Kind regards, Christian Salway -----Original Message----- From: clamav-users-boun...@lists.clamav.net [mailto:clamav-users-boun...@lists.clamav.net] On Behalf Of David Raynor Sent: 18 March 2013 15:43 To: ClamAV users ML Subject: Re: [clamav-users] duplicate clamd processes On Sun, Mar 17, 2013 at 3:21 AM, Christian Salway <ccsal...@itmanx.com>wrote: > Thanks for getting back to me, Jim. > > Its just one core. The server is an Amazon EC2 micro instance server. > > Christian > > -----Original Message----- > From: Jim Preston <jimli...@commspeed.net> > Sender: clamav-users-boun...@lists.clamav.net > Date: Sat, 16 Mar 2013 20:36:40 > To: ClamAV users ML<clamav-users@lists.clamav.net> > Reply-To: ClamAV users ML <clamav-users@lists.clamav.net> > Subject: Re: [clamav-users] duplicate clamd processes > > On 03/16/2013 10:44 AM, Christian Salway wrote: > > At the moment when I start clamd, it spawns two processes with > > different PID's, the problem is I don't have enough memory to run > > two so I have > been > > trying to figure out how to spawn only one. > > > > > > > > I've searched the internet, I've also asked around on forums and > > looked > in > > the manuals, but no one seems to know how to limit it. Can anyone help? > > > > > > > > You can see an image of the problem here > > http://unix.stackexchange.com/questions/68155/limit-clamav-to-one-th > > read > > > > > > > > Hope someone can help > > > > > > > > Kind regards, > > > > Christian > > > > _______________________________________________ > > Help us build a comprehensive ClamAV guide: visit > > http://wiki.clamav.net http://www.clamav.net/support/ml > > > How many cores / processors are in the system? Could this be a case of > 1 daemon/processor(core)? > > Jim > > -- > Jim Preston > > > _______________________________________________ > Help us build a comprehensive ClamAV guide: visit > http://wiki.clamav.net http://www.clamav.net/support/ml > _______________________________________________ > Help us build a comprehensive ClamAV guide: visit > http://wiki.clamav.net http://www.clamav.net/support/ml > The design of clamd is to run a manager/controller thread and one or more worker threads to do the scanning. The MaxThreads setting in clamd.conf controls the number of worker threads. Clamd will not do scanning inside the manager thread. Did you try a MaxThreads setting of 2 and have a problem? The biggest chunk of the memory footprint is shared. I think the dashboard picture you posted is showing individual threads with their unique PIDs and then showing how much memory is accessible to each thread, which then makes those memory totals start double-counting when there are multiple threads that can all access the same ranges of memory [note that those memory totals are also exactly the same]. Hope this helps, Dave R. -- --- Dave Raynor Sourcefire Vulnerability Research Team dray...@sourcefire.com _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://www.clamav.net/support/ml _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://www.clamav.net/support/ml
