I worked around the "OOM" problem by ordering 1 GB more RAM at my provider and
- thanks to VM world - the RAM was increased to 2 GB on the fly.
After that I was able to start clamd. Output of "top -p <clamd.pid>" is:
Tasks: 1 total, 0 running, 1 sleeping, 0 stopped, 0 zombie
Cpu(s): 0.0%us, 0.0%sy, 0.0%ni,100.0%id, 0.0%wa, 0.0%hi, 0.0%si, 0.0%st
Mem: 2097152k total, 1242976k used, 854176k free, 0k buffers
Swap: 0k total, 0k used, 0k free, 188020k cached
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
9102 clamav 20 0 670m 499m 644 S 0 24.4 0:00.00 clamd
I think 670m / 499m is quite a lot for a small sized VM, although I have to say
that this VM is really old and new VM orders always start at minimum of 2 GB of
RAM.
Any chance to reduce RAM usage of clamd by configuration?
Torge
Am 19.04.2017 um 13:42 schrieb Torge Riedel:
Ok, enabled debug.
Find attached the output of
service clamav-daemon start > /tmp/clamd_start.log 2>&1
at the end it says:
LibClamAV debug: main.msb loaded
LibClamAV debug: Ignoring signature Win.Trojan.AT-8
LibClamAV debug: Ignoring signature Win.Trojan.Agent-653
LibClamAV debug: Ignoring signature Email.Phishing.DblDom-53
LibClamAV debug: Ignoring signature Email.Phishing.DblDom-60
LibClamAV debug: Ignoring signature Win.Trojan.Qhost-106
Killed
...fail!
To check where "Killed" is coming from I directly started clamd:
/usr/sbin/clamd
and it prints "Killed" at the end. I think the " ...fail!" is from "service".
So I googled again with this hint (never saw this before) and found this:
http://forums.interworx.com/threads/8501-Clamd-being-killed
which brought me to the idea to monitor resource usage:
Connecting with two shells and running a "top" before starting clamd I see that
1. ~480 MBs RAM is free before starting clamd (server has a total of 1 GB RAM)
2. Starting clamd consumes all the free memory and stops with "Killed"
Seems as if the free RAM is no more enough for clamd, but I am wondering why it
consumes so much memory? Is this normal?
Is there a chance to fix that by change of configuration?
I googled but have not found a good answer yet. Only "remove clamav" which is
not what I want to do.
Torge
Am 19.04.2017 um 12:43 schrieb Steve Basford:
On Wed, April 19, 2017 10:13 am, Torge Riedel wrote:
Well, was not enabled. After setting
LogSyslog true
Might be worth turning on debug temporarily... clamd.conf and freshclam.conf
# Enable debug messages in libclamav.
# Default: no
_______________________________________________
clamav-users mailing list
clamav-users@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq
http://www.clamav.net/contact.html#ml
_______________________________________________
clamav-users mailing list
clamav-users@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq
http://www.clamav.net/contact.html#ml
