Hello,
I'm using clamav 1.4.1.
In the Message;
Subject: [clamav-users] Clamd CPU usage
Message-ID : <3d9ff8d4-005e-4f14-a632-b0c481a54...@fibertel.com.ar>
Date & Time: Mon, 14 Oct 2024 11:06:59 +0200
Limaunion via clamav-users has written:
[...]
> /dev/urandom test:
> CMD1: time -
Hi Ray,
Sorry, chunking won't work. Clam treats files differently based on file type,
and signatures are written based on looking at the whole file.
Thanks,
Andy
From: clamav-users on behalf of Ray
Sent: Thursday, August 31, 2023 2:41 AM
To: ClamAV users ML
I am not an authority here, but do recall having seen previous responses to
similar suggestions and such an approach was not recommended. This has to do
with the way many of the signatures are designed to look for multiple ascii or
hex strings that could well occur with such strings located in d
Ok, thank you.
El sáb, 5 mar 2022 a las 8:48, G.W. Haywood via clamav-users (<
clamav-users@lists.clamav.net>) escribió:
> Hi there,
>
> On Fri, 4 Mar 2022, Jorge Elissalde via clamav-users wrote:
>
> > ...
> > Trying to be more forthcoming I can explain the code I'm making.
> >
> > - I get the f
Hi there,
On Fri, 4 Mar 2022, Jorge Elissalde via clamav-users wrote:
...
Trying to be more forthcoming I can explain the code I'm making.
- I get the full list of files under c:\windows\system32 folder, just
files, not folders (4913 files in my case).
- I send every file name to clamd using t
Thank you for your answer.
Trying to be more forthcoming I can explain the code I'm making.
- I get the full list of files under c:\windows\system32 folder, just
files, not folders (4913 files in my case).
- I send every file name to clamd using the SCAN command.
The whole process takes almost 5
Thank you for your answer.
Trying to be more forthcoming I can explain the code I'm making.
- I get the full list of files under c:\windows\system32 folder, just
files, not folders (4913 files in my case).
- I send every file name to clamd using the SCAN command.
The whole process takes almost 5
Hi there,
On Fri, 4 Mar 2022, Jorge Elissalde via clamav-users wrote:
...
If I send the command "MULTISCAN c:\windows\system32", the recursive
scanning will scan everything including folders, which is not what I want.
This scanning must be processed using multi threads ...
Can you be more fo
Hi there,
On Mon, 1 Nov 2021, Robert M. Stockmann via clamav-users wrote:
... If ... system invokes a perl based tool, anything can happen. ...
Er, if you let it. :)
I run a couple of Perl milters which do the heavy lifting for our mail
filtering. One of them _is_ pretty heavy but I only al
On Sun, 31 Oct 2021, Mark G Thomas wrote:
> Date: Sun, 31 Oct 2021 13:05:35 -0400
> From: Mark G Thomas
>
> I'm running sendmail+mimedefang+clamav on a bunch of MX servers.
>
> This morning over a period of several hours each of my instances
> appear to have caused clamd to consume all RAM and
Hi,
On Sun, Oct 31, 2021 at 08:32:00PM -0400, Michael Orlitzky via clamav-users
wrote:
> On Sun, 2021-10-31 at 13:05 -0400, Mark G Thomas wrote:
> >
> > Has anyone else had similar experiences recently?
>
> Not recently per se, but it happens. Do you limit the number of scans
> that can be run
Hi there,
On Sun, 31 Oct 2021, Mark G Thomas wrote:
I'm running sendmail+mimedefang+clamav on a bunch of MX servers.
This morning over a period of several hours each of my instances
appear to have caused clamd to consume all RAM and swap. Normally
swap is empty and 10GB of the 16GB per host is
On Sun, 2021-10-31 at 13:05 -0400, Mark G Thomas wrote:
>
> Has anyone else had similar experiences recently?
>
Not recently per se, but it happens. Do you limit the number of scans
that can be run simultaneously, if (for example) some doofus BCCs a
20MB nested zip file to everyone in his organ
Hi there,
On Sat, 28 Nov 2020, Will Watters via clamav-users wrote:
When the clamd daemon is running and automatically detects a virus -
Nothing is "automatically detected". The daemon will scan something
when you tell it to. How you do that is up to you. Read the manual
about 'clamdscan'
Hi there,
On Thu, 26 Nov 2020, Will Watters via clamav-users wrote:
Is there anywhere to get clamd freshclam file to run as a daemon for
Centos 6 please, so the service can be stopped and started, etc.
Yes of course there is. There are several ways to do such a trivial
administrative task, b
On Thu, 26 Nov 2020, Will Watters via clamav-users wrote:
Hello,
Is there anywhere to get clamd freshclam file to run as a daemon for
Centos 6 please, so the service can be stopped and started, etc.
I have this for Centos 7 but is systemd residing in
/lib/systemd/system/clamd-freshclam.service
Hi there,
On Sat, 31 Oct 2020, Tsutomu Oyamada wrote:
Scanning certain files will result in a memory error in clamd version 0.101.5.
In the context of virus scanning, one year old is very old indeed.
On Sat, 31 Oct 2020, G.W. Haywood wrote:
That is rather an old version, released over a ye
Hi, Mark
Thank you for your reply.
The RAM size of my system is 4GB.
I think it's not a system spec issue, it's a CVD issue.
This is because an event occurred in the CVD update.
Regards
T.Oyamada
On Sat, 31 Oct 2020 14:10:29 +
Mark Fortescue via clamav-users wrote:
> How much memory is a
Hi there,
On Sat, 31 Oct 2020, Tsutomu Oyamada wrote:
Scanning certain files will result in a memory error in clamd version 0.101.5.
That is rather an old version, released over a year ago. There have
been some significant changes since then. You should upgrade.
The platform is AIX. This
Hi Tsutomu,
How much memory is available on your AIX system ?
Recommendations vary but I think the general rule will be you need
4GBytes or more for any server that has to do more than just run Clamd.
Anything less that 2GBytes is going to be very slow or fail.
Regards
Mark.
On 31/1
Hi there,
On Wed, 7 Oct 2020, Dave Sill via clamav-users wrote:
"G.W. Haywood via clamav-users" wrote:
Perhaps try enabling libclamav debug logging.
I poked around a bit and didn't see an obvious way to do that ...
You just need a line
Debug yes
in clamd.conf. There might be a "Debug
"G.W. Haywood via clamav-users" wrote:
>
> Perhaps try enabling libclamav debug logging.
I poked around a bit and didn't see an obvious way to do that, like a
configure option or a .h file. Couldn't really tell where it would be
logging.
> During your scans I suspect that ClamAV may be reaching
Hello again,
On Sat, 3 Oct 2020, G.W. Haywood via clamav-users wrote:
Stay tuned.
Perhaps try enabling libclamav debug logging.
During your scans I suspect that ClamAV may be reaching some limit(s)
which is causing caching to be disabled. The limits are mostly
tunable (in some cases perhaps
Hi there,
On Fri, 2 Oct 2020, G.W. Haywood wrote:
Trying a bigger directory, this is going to take a while...
Doesn't look like telling us anything this side of Christmas so I've
killed the process. Time to think a bit harder. Stay tuned.
--
73,
Ged.
_
Dave Sill via clamav-users wrote:
>
> Both of my test systems are RHEL 7, so off to try another platform.
On Fedora 32:
# find ~dave/Mail -type f|wc -l
26671
# clamdscan --fdpass ~dave/Mail
Time: 932.395 sec (15 m 32 s)
# clamdscan --fdpass ~dave/Mail
Time: 489.627 sec (8 m 9 s)
So
On the desktop system:
$ find Mail -type f|wc -l
123719
# clamdscan --fdpass ~de5/Mail
Time: 2137.531 sec (35 m 37 s)
# clamdscan --fdpass ~de5/Mail
Time: 2138.778 sec (35 m 38 s)
So, still not seeing a benefit from the cache.
Both of my test systems are RHEL 7, so off to try another platform.
"G.W. Haywood via clamav-users" wrote:
>
> Only 4GB on my clamd server.
>
> $ du -sh images/
> 16G images/
> $ find ./images -type f | wc -l
> 11586
> $ clamdscan images/
> ...
> Time: 12547.333 sec (209 m 7 s)
> ...
> $ clamdscan images/
> ...
> Time: 1477.782 sec (24 m 37 s)
That's a nic
Hi there,
On Thu, 1 Oct 2020, Dave Sill via clamav-users wrote:
"G.W. Haywood via clamav-users" wrote:
It might be too soon to draw that conclusion. It's possible that the
daemon reloaded its database during your test, and I'd expect that to
cause any cached results to be discarded for obvio
ks at present. I'll try to keep an eye on the
thread to see if something comes up that I can be of help with.
-Micah
-Original Message-
From: clamav-users On Behalf Of Dave
Sill via clamav-users
Sent: Thursday, October 1, 2020 11:02 AM
To: G.W. Haywood via clamav-users
Cc: Dave S
"G.W. Haywood via clamav-users" wrote:
> Hi there,
>
> On Thu, 1 Oct 2020, Dave Sill via clamav-users wrote:
>
> >It looks like my point was lost in the noise ...
>
> Sorry, I guess it was late and I was in a hurry to get to bed. :(
No worries. Thanks for your help.
> >... on a much smaller
Hi there,
On Thu, 1 Oct 2020, Dave Sill via clamav-users wrote:
It looks like my point was lost in the noise ...
Sorry, I guess it was late and I was in a hurry to get to bed. :(
The cache only saved a little over a minute on a 24 minute scan.
I tried something similar here on a directory
It looks like my point was lost in the noise so I'll try to distill it.
I ran clamdscan twice on my /home (69k files) and got:
# clamdscan --fdpass /home
...
Time: 1428.433 sec (23 m 48 s)
# clamdscan --fdpass /home
...
Time: 1355.057 sec (22 m 35 s)
#
The cache only saved a little over a minut
Hi there,
On Wed, 30 Sep 2020, Dave Sill via clamav-users wrote:
Unfortunately, it looks like the cache is too small to help.
I ran clamdscan twice on my /home (69k files) and got:
# clamdscan --fdpass /home
/home/de5/eicar.tar.gz: Eicar-Signature FOUND
WARNING: /home/de5/.cisco/hostscan/.lib
0.32 for case-insensitive patterns.
>
> If you have a sample and signature that cause the issue, I’d love a copy so I
> can investigate further.
>
> -Micah
>
> From: Mark Allan
> Date: Tuesday, May 5, 2020 at 5:20 AM
> To: ClamAV users ML , Micah Snyder (micasnyd)
On 2 May 2020, at 9:32 am, Micah Snyder (micasnyd) via clamav-users
wrote:
>
> It doesn’t appear that there is a primary maintainer for homebrew’s clamav
> package, so I’ve placed a PR with the homebrew-core project to try to switch
> the brew clamav package from pcre to pcre2:
> https://githu
Hi there,
On Tue, 5 May 2020, Micah Snyder (micasnyd) via clamav-users wrote:
If you have a sample and signature that cause the issue, I’d love a
copy so I can investigate further.
If it will help I'd be happy to run it past my scanners too - I've
taken no action on the offending signature, b
, 2020 at 5:20 AM
To: ClamAV users ML , Micah Snyder (micasnyd)
Subject: Re: [clamav-users] Clamd crashes frequently - macOS Catalina
Hi Micah,
Al is correct, we're using 10.32. I see 10.34 is now available, so I'll compile
against that when I get a chance and see if it makes any differe
gt;>
>> Regards,
>> Micah
>>
>> From: clamav-users > <mailto:clamav-users-boun...@lists.clamav.net>>
>> Date: Saturday, May 2, 2020 at 5:50 PM
>> To: ClamAV users ML > <mailto:clamav-users@lists.clamav.net>>
>> Cc: Mark Allan mailto:
ds,
> Micah
>
> From: clamav-users <mailto:clamav-users-boun...@lists.clamav.net>>
> Date: Saturday, May 2, 2020 at 5:50 PM
> To: ClamAV users ML <mailto:clamav-users@lists.clamav.net>>
> Cc: Mark Allan mailto:markjal...@gmail.com>>
> Subject: Re: [clamav
Hi Mark,
Which pcre2 version are you using?
Regards,
Micah
From: clamav-users
Date: Saturday, May 2, 2020 at 5:50 PM
To: ClamAV users ML
Cc: Mark Allan
Subject: Re: [clamav-users] Clamd crashes frequently - macOS Catalina
Hi James,
Glad that seems to have helped.
Al and others are correct
Hi James,
Glad that seems to have helped.
Al and others are correct that the distro should be updated to use pcre2, but
I'm not convinced that's the root of the problem. We're seeing the issue with
that signature despite already using pcre2 in our build.
Mark
> On 2 May 2020, at 3:45 am, Al V
Although I complete support what Mark has recommended, I would caution that
there could easily be a future signature that will cause this same issue if the
root cause of not upgrading to pcre2 is not accomplished, and figuring out what
signature that is won’t be easy.
Sent from my iPad
-Al-
>
Nice
On Fri, May 1, 2020, 9:38 PM James Brown via clamav-users <
clamav-users@lists.clamav.net> wrote:
> On 1 May 2020, at 8:31 pm, Mark Allan via clamav-users <
> clamav-users@lists.clamav.net> wrote:
>
>
> Try excluding Email.Exploit.Efail-6641027-1 from the main ClamAV set.
>
>
> Thanks Mark. A
On 1 May 2020, at 8:31 pm, Mark Allan via clamav-users
wrote:
>
> Try excluding Email.Exploit.Efail-6641027-1 from the main ClamAV set.
Thanks Mark. After over 12 hours clamd is still up and running. Looks like that
sig was causing the problem.
James.
smime.p7s
Description: S/MIME cryptograp
1, 2020 at 3:55 PM
To: ClamAV users ML
Cc: Micah Snyder (micasnyd) , G.W. Haywood
, ClamAV Binary package maintainers
Subject: Re: [clamav-users] Clamd crashes frequently - macOS Catalina
Ged,
This may be an excellent observation. I also see that you’re using libpcre
instead of libpcre2
Re: [clamav-users] Clamd crashes frequently - macOS Catalina
Hi there,
On Fri, 1 May 2020, James Brown via clamav-users wrote:
> Getting lots of crashes of clamd. No indication of an issue in the clamd.log.
> ...
> --> STACK GUARD70a1c000-70a1d000 [4K] --
> On 1 May 2020, at 8:31 pm, Mark Allan via clamav-users
> wrote:
>
> Try excluding Email.Exploit.Efail-6641027-1 from the main ClamAV set. You can
> do that by adding the signature name to a file called anything_you_like.ign2
> and putting it in your database directory.
>
> We had an issue w
On 1 May 2020, at 7:20 pm, G.W. Haywood via clamav-users
wrote:
>
> it gave me the impression that the OS is "for entertainment only”
Some people think that, but it does have BSD Unix as its base.
> Do the clamd crashes happen at particular times, such as when clamd is
> reloading its databa
Try excluding Email.Exploit.Efail-6641027-1 from the main ClamAV set. You can
do that by adding the signature name to a file called anything_you_like.ign2
and putting it in your database directory.
We had an issue with something crashing clamd and we strongly suspect that
signature is to blame.
Hi there,
On Fri, 1 May 2020, James Brown via clamav-users wrote:
Getting lots of crashes of clamd. No indication of an issue in the clamd.log.
...
--> STACK GUARD70a1c000-70a1d000 [4K] ---/rwx
SM=NUL stack guard for thread 2
Stack 7
Mark Parker via clamav-users wrote:
Hi all,
I'm investigating clamav as a solution for a couple hundred linux
boxes. We need onaccess scanning but I'm running into an issue. For
clamd to do onaccess scanning it needs to be run as root to use the
inotify components, but since we export our
Hi there,
On Mon, 11 Nov 2019, Mark Parker via clamav-users wrote:
On 11/11/2019 12:05 PM, G.W. Haywood via clamav-users wrote:
On Mon, 11 Nov 2019, Mark Parker via clamav-users wrote:
... need onaccess scanning but .. clamd .. doesn't have permissions
to view a user's home directory contents
Well, I don't want to change permissions on 30 million files to make
this work. Seems like the wrong thing to do.
On 11/11/2019 12:05 PM, G.W. Haywood via clamav-users wrote:
Hi there,
On Mon, 11 Nov 2019, Mark Parker via clamav-users wrote:
... need onaccess scanning but .. clamd .. doesn't
Hi there,
On Mon, 11 Nov 2019, Mark Parker via clamav-users wrote:
... need onaccess scanning but .. clamd .. doesn't have permissions
to view a user's home directory contents. Am I missing something?
Group read?
--
73,
Ged.
___
clamav-users ma
Hi Ian,
Sorry about the delayed response. It looks like no one else got back to you.
I'll try to answer inline, best I can...
Micah
On 10/11/19, 11:46 AM, "clamav-users on behalf of Ian via clamav-users"
wrote:
> 1) Does OnAccessPrevention mean that it blocks access to files when they are
Hi!
Many thanks Reio! That did the trick!
It needed almost about a minut to get started (I know it's a slow backup
machine), but it runs now!
It complains though about
"Failed to get properties: Unit name clamd@.service is missing the
instance name.", see below.
Nothing to worry about
On 13.10.2019 12:55, Ralf Hartings wrote:
Hi,
I had to fire-up a CENTOS 7 backup server as the main CENTOS 7 server
crashed and I updated the backup server to the latest CENTOS version
7, incl Clamav 0.101.4.
The log says, the clam service is starting, but never gets to run
properly. Every
It was that simple! Thank you very much! :)
Reio
On 24/07/2019 15:31, Axb via clamav-users wrote:
try this:
in file clamd.service
to section:
[Service]
add
TimeoutSec=900
restart clamd service
h2h
On 7/24/19 1:49 PM, Reio Remma via clamav-users wrote:
Hello!
I rebooted my CentOS 7 mail s
try this:
in file clamd.service
to section:
[Service]
add
TimeoutSec=900
restart clamd service
h2h
On 7/24/19 1:49 PM, Reio Remma via clamav-users wrote:
Hello!
I rebooted my CentOS 7 mail server last night and all of a sudden clamd
is refusing to start - it burns CPU for a couple of minut
It isn’t strictly used for debugging, though that version with the “D” at the
end is the debug version of the visual C runtime. What version of ClamAV are
you running? I don’t know if older versions were debug builds, but our latest
versions should all be release builds. The newer versions of
On Mon 13/May/2019 16:55:57 +0200 Avinash Sonawane via clamav-users wrote:
> Now, for loading time, when I start firefox within 5-6 seconds it
> immediately fills up 250+ Mb memory so for 950+ Mb (clamd) loading time
> shouldn't be that of an issue.
I use more or less average ~1GB too:
PID USE
On Tue, 14 May 2019 14:53:27 +
Graeme Fowler wrote:
> If you're running a mail server that receives one email per
> day... maybe do that in a different way so you use your resources for
> something else!
I'm not running a mail server. I'm using clamAV at user end scanning
incoming email via
On 13/05/2019, 15:57, Avinash Sonawane wrote:
> Of course, at scanning time those signs/dbs need to be in memory. At
> scanning time not *all the time*. e.g. I am expecting an email at 6 PM.
> I don't mind clamd taking that much of a memory *at* 6 PM and then
> release it. I find it absolutely inco
On 13.05.19 16:40, Matus UHLAR - fantomas wrote:
but much longer time:
# time clamscan /tmp/hwinfo
/tmp/hwinfo: OK
--- SCAN SUMMARY ---
Known viruses: 9157095
Engine version: 0.100.3
Scanned directories: 0
Scanned files: 1
Infected files: 0
Data scanned: 0.57 MB
Data read: 0.29
Hi there,
On Mon, 13 May 2019, Avinash Sonawane wrote:
e.g. I am expecting an email at 6 PM. I don't mind clamd taking
that much of a memory *at* 6 PM and then release it. I find it
absolutely inconvenient to having to forgo ~1GB memory since the
morning. As I said, a poor bargain.
The barga
Avinash Sonawane via clamav-users wrote:
On Mon, 13 May 2019 16:21:15 +0200
Matus UHLAR - fantomas wrote:
loading takes time, much time.
How much time are we talking about here? I suppose by 'time' we mean
loading time (load binary and signatures) + processing time (comparing
signatures).
On Mon, 13 May 2019 16:21:15 +0200
Matus UHLAR - fantomas wrote:
> loading takes time, much time.
How much time are we talking about here? I suppose by 'time' we mean
loading time (load binary and signatures) + processing time (comparing
signatures).
Now, for loading time, when I start firefox
On Mon, 13 May 2019, Matus UHLAR - fantomas wrote:
> >> On Mon, 13 May 2019 19:30:12 +0530
> >> Avinash Sonawane wrote:
> >>
> >> > Single email account here. On average, I receive one email a day.
> >> > Devoting 1Gb memory all the time for that seems a poor bargain.
>
> >On Mon, 13 May 2019, A
On Mon, 13 May 2019 19:30:12 +0530
Avinash Sonawane wrote:
> Single email account here. On average, I receive one email a day.
> Devoting 1Gb memory all the time for that seems a poor bargain.
On Mon, 13 May 2019, Avinash Sonawane via clamav-users wrote:
Why can't clamd let databases/signatu
On Mon, 13 May 2019, Avinash Sonawane via clamav-users wrote:
> On Mon, 13 May 2019 19:30:12 +0530
> Avinash Sonawane wrote:
>
> > Single email account here. On average, I receive one email a day.
> > Devoting 1Gb memory all the time for that seems a poor bargain.
>
> Why can't clamd let datab
On Mon, 13 May 2019 19:30:12 +0530
Avinash Sonawane wrote:
Single email account here. On average, I receive one email a day.
Devoting 1Gb memory all the time for that seems a poor bargain.
On 13.05.19 19:46, Avinash Sonawane via clamav-users wrote:
Why can't clamd let databases/signatures sta
On Mon, 13 May 2019 19:30:12 +0530
Avinash Sonawane wrote:
> Single email account here. On average, I receive one email a day.
> Devoting 1Gb memory all the time for that seems a poor bargain.
Why can't clamd let databases/signatures stay in secondary memory
itself. Just load them when you actu
On Mon, 13 May 2019 15:46:42 +0200
Matus UHLAR - fantomas wrote:
redusing the number of signatures is the only way I know of.
On 13.05.19 19:30, Avinash Sonawane via clamav-users wrote:
Actually, I was thinking if I could tweak some clamd conf without
removing AV databases/signatures thereby
On Mon, 13 May 2019 15:46:42 +0200
Matus UHLAR - fantomas wrote:
> On 13.05.19 18:53, Avinash Sonawane via clamav-users wrote:
> redusing the number of signatures is the only way I know of.
Actually, I was thinking if I could tweak some clamd conf without
removing AV databases/signatures there
On 13.05.19 18:53, Avinash Sonawane via clamav-users wrote:
I'm using ClamAV 0.100.3/25448 on Debian Stretch. It's a default
install without any tweaks (as far as I remember).
As seen from the below top o/p, without any active scan clamd is using
~1Gb memory. That's unacceptable. May I know how
s unnecessarily in this case.
JME
De : Micah Snyder (micasnyd)
Envoyé : lundi 8 avril 2019 18:26
À : ClamAV users ML
Cc : jmed...@amv-sa.fr
Objet : Re: [clamav-users] Clamd no stop scan
G’day,
Based on your clamdtop screenshot, it looks like your signature database is up
to da
G’day,
Based on your clamdtop screenshot, it looks like your signature database is up
to date with today’s update. Friday’s daily update included a large number of
signatures that slowed everything down, but they were dropped on Saturday so I
don’t _think_ that should be the reason why you’re
Hi Chad,
Some file types cannot be handled in memory, although it will keep things in
memory as much as possible.
As noted in the clamd sample config:
# Optional path to the global temporary directory.
# Default: system specific (usually /tmp or /var/tmp).
#TemporaryDirectory /var/tmp
The defa
Somebody with better technical knowledge than I will need to get you a complete
answer, but my observations tell me that if the file requires decompressed or
other type of pre-processing, then temporary files are written to disk, but
scans are normally conducted in memory.
Sent from my iPad
-A
lukn,
Sorry about all the trouble. I wish I knew more about what was happening. I
hope it's not a legitimate bug slipping by. Let us know if you end up finding
anything else.
Regards,
Micah
On Nov 20, 2018, at 2:40 AM, lukn mailto:lukn...@gmail.com>>
wrote:
Hi Micah and Henrik
I'm slowl
Hi Micah and Henrik
I'm slowly getting to the conclusion that the old hosts are reaching EOL
which would explain the misbehaviour (just got a few unexplicable SSH
connection losses...).
grep -v '^$' clamd.conf | grep -v '^#'
LogSyslog yes
LogFacility LOG_MAIL
LogVerbose yes
TCPSocket 3310
TCPAddr
On Fri, Nov 16, 2018 at 03:52:44PM +0100, lukn wrote:
>
> However, in VMs on one host machine, clamd is idling, on the other it's
> running at 200-350% CPU (4 vcores) according to top - even when there is
> nothing to be scanned.
Usually one would investigate something this by running "strace -f
That is... bizarre. What does your clamd configuration look like?
Specifically, do you have `ScanOnAccess` enabled and set to watch specific
mount or directory paths?
Micah Snyder
ClamAV Development
Talos
Cisco Systems, Inc.
On Nov 16, 2018, at 9:52 AM, lukn mailto:lukn...@gmail.com>>
wrote:
Am 05.12.2017 um 19:52 schrieb Reindl Harald:
Am 05.12.2017 um 19:34 schrieb Colony.three:
Am 05.12.2017 um 08:13 schrieb Colony.three:
As Red Hat hasn't solved the problem of unix:sockets, I had to make
my own systemd files. But there's a little problem.
clamd.socket
[Unit]
Description=S
Am 05.12.2017 um 19:34 schrieb Colony.three:
Am 05.12.2017 um 08:13 schrieb Colony.three:
As Red Hat hasn't solved the problem of unix:sockets, I had to make my own
systemd files. But there's a little problem.
clamd.socket
[Unit]
Description=Socket for Clam AntiVirus userspace daemon
Docum
> Am 05.12.2017 um 08:13 schrieb Colony.three:
>
>> As Red Hat hasn't solved the problem of unix:sockets, I had to make my own
>> systemd files. But there's a little problem.
>>
>> clamd.socket
>>
>> [Unit]
>> Description=Socket for Clam AntiVirus userspace daemon
>> Documentation=man:clamd(8) man
Am 05.12.2017 um 08:13 schrieb Colony.three:
As Red Hat hasn't solved the problem of unix:sockets, I had to make my own
systemd files. But there's a little problem.
clamd.socket
==
[Unit]
Description=Socket for Clam AntiVirus userspace
Am 02.02.2017 um 15:04 schrieb Benny Pedersen:
Reindl Harald skrev den 2017-02-02 14:36:
that maybe would fine if clamav would have the best hitrate, but by
far it don't
tell this maillist here where there is on that is better on memory usage
and still gpl'ed, that would be much more truly
Reindl Harald skrev den 2017-02-02 14:36:
that maybe would fine if clamav would have the best hitrate, but by far
it don't
tell this maillist here where there is on that is better on memory usage
and still gpl'ed, that would be much more truly to read about then just
that clamav is bad, with
Am 02.02.2017 um 14:31 schrieb Groach:
the much better question is *why* is clamav that much memory wasting >
especially 385 MB for the official rules which barely hit anything and >
are removed here entirely from production machines for some weeks after
hit nothing over the last 3 months -
the much better question is *why* is clamav that much memory wasting
especially 385 MB for the official rules which barely hit anything and
are removed here entirely from production machines for some weeks after
hit nothing over the last 3 months - any catches was done by
sanesecurity alone
t
Hello,
> Javascript.ndb from Securiteinfo was causing major memory and scanning
> issues for some people.
Free version of javascript.ndb has 39861 lines
Pro version of javascript.ndb has 45511 lines.
This should be OK for 6Gb of RAM. Even 4Gb I think.
AFAIK, the problem occurs when javascript.n
On 21 December 2016 11:07:42 Al Varnell wrote:
Are you using any UNOFFICIAL signatures? Some of them have been causing
memory issues recently for others.
Al, while some 3rd party sigs are using memory, you also got to remember the
Huge amount of sig only hashes the official sigs are addi
How do I safety remove the UNOFFICIAL signatures?
Thanks
Rich
-Original Message-
From: clamav-users [mailto:clamav-users-boun...@lists.clamav.net] On Behalf
Of Al Varnell
Sent: 21 December 2016 11:07
To: ClamAV users ML
Subject: Re: [clamav-users] clamd restart
Are you using any UNOFFI
07
To: ClamAV users ML
Subject: Re: [clamav-users] clamd restart
Are you using any UNOFFICIAL signatures? Some of them have been causing
memory issues recently for others.
-Al-
On Wed, Dec 21, 2016 at 02:09 AM, Richard Walker - Seven Internet Ltd wrote:
>
> Hi
>
> I am having to rest
Are you using any UNOFFICIAL signatures? Some of them have been causing memory
issues recently for others.
-Al-
On Wed, Dec 21, 2016 at 02:09 AM, Richard Walker - Seven Internet Ltd wrote:
>
> Hi
>
> I am having to restart clamd twice a day now. I can't find anything in the
> mail/clamd logs o
Thanks for closing the event here. It doesn't happen enough.
dp
On 12/14/16 2:54 PM, Steven Morgan wrote:
Thanks, there was a little coding error. Following the connect() failure on
the local socket, the code was not checking if the TCPAddr option is
enabled.
Steve
On Wed, Dec 14, 2016 at 3:1
Thanks, there was a little coding error. Following the connect() failure on
the local socket, the code was not checking if the TCPAddr option is
enabled.
Steve
On Wed, Dec 14, 2016 at 3:12 AM, Christoph Pleger
wrote:
> Hello Steve,
>
> > Looking at the code, it appears that the error message oc
Hello Steve,
> Looking at the code, it appears that the error message occurs when the
> clamd/clamdscan parameter "LocalSocket" is disabled, or it is enabled and
> the socket connect() call fails, and also the TCPAddr parameter is
> specified.
Thank you for that hint. It brought me to the finding
Hello Christoph,
Looking at the code, it appears that the error message occurs when the
clamd/clamdscan parameter "LocalSocket" is disabled, or it is enabled and
the socket connect() call fails, and also the TCPAddr parameter is
specified.
Can you inspect and/or send the output of the 'clamconf'
1 - 100 of 1297 matches
Mail list logo
