Hi there,
On Wed, 3 Jun 2020, Stefan Bauer via clamav-users wrote:
Am Mi., 3. Juni 2020 schrieb Jesus Arnaiz via clamav-users
> It normally works fine, but, apparently it is crashing everyday more
> than once, meaning a manual restart is needed once or twice per day.
>
> I don't see anything relevant on the logs...
> Any ideas?
>
> My system is:
> ...
... Clamav needs a [decent] amount of RAM ...
- especially when using 3rd-party signatures. As there are random updates
over the day, the reloads could lead to your noticed behavior.
It might help the OP to know that clamd *normally* uses ~1Gbyte of RAM
when it LOADS the 'official' signatures (and more than that of course
if it uses third-party signatures, of which there are many available).
This memory usage is when clamd starts from the 'cold' state, when it
was not previously running, but things are different when it RELOADS
the signature databases while it is running.
In addition to the normal RAM usage, clamd normally uses twice as much
RAM when it RELOADS the signature databases because it has one copy in
its RAM already. This copy may be used to serve scan requests during
the time when it is RELOADING the databases after they have changed.
During the reload, clamd makes a second copy of its data. After this
second copy is loaded and tested, and after any scan request which is
using the first copy has completed, the first copy is deleted and the
RAM which it used is returned to the operating system's free pool. It
usually takes at least some seconds to reload the signature database,
but if the machine is slow it may take several minutes. You really do
not want to drive the machine into using swap space, performance then
will be very poor indeed.
This means that at present - and this will change as more signatures
are added to the databases - you need a minimum of at least 2Gbytes of
RAM to run clamd with automatic database updates, and probably more
than that if the box is to do anything useful. At present I recommend
a minimum of 4Gbytes RAM for a system which runs clamd. In addition,
if you use clamscan, while it scans you will need an *extra* 1 Gbyte
of RAM over and above the RAM used by clamd. Note that clamscan and
clamdscan behave very differently in that clamdscan uses clamd, but
clamscan does not. Of course you can use alternate ways of reloading
the databases, but then you will lose the ability to scan while clamd
is loading signatures. That may be acceptable to you, to others it is
not and the issue has caused some discussion on this list in the past.
Signature database reloads may be triggered in more than one way. If
you use freshclam to update the signatures automatically, it can send
a signal to clamd to cause a reload; if clamd is itself configured to
check, and notices that the a database has changed, it will start the
reload itself; and you can send a 'reload' signal to clamd using its
listening socket, the API is documented in e.g. the clamd man page.
--
73,
Ged.
_______________________________________________
clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users
Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq
http://www.clamav.net/contact.html#ml
