Hi, We are using Clamav 0.88.1 under amavis on Linux to scan incoming mail. However we often receive mails containing a number of attachments, and I have found out that clamav appears to hold the entire email in memory whilst decoding and scanning the individual attachments. Thus, for instance, if a customer sends us a 200Mb file containing four 35Mb word documents, clam's memory requirements will suddenly swell from 14 Mb up to 300 Mb whilst it is scanning.
I've verified this by watching /proc/`pidof clamscan`/status, which gives independent figures for VmSize, VmRSS, VmData, VmStk, VmExe and Vmlib. Whilst scanning the 200 Mb email mentioned above, VmData fluctuated around 280Mb and ended up at 310 Mb. I also noticed that almost all this memory remained resident (VmRSS), it was not swapped. We do of course normally use clamd but I did the testing with clamav as it was easier to keep track of the process. The effect on RAM is the same. Can you help us reduce the memory needed for large mails, because having to allow so much extra memory for these large mails is very wasteful - and if we don't then the machine may go down when a couple of Clam threads have used all the memory. I can provide a demonstration mail if needed but I won't send it to the list :) I understand clamscan doesn't use clamd.conf, but if needed I can forward that or any other information requested. Thank you, Nick Leverton _______________________________________________ http://lurker.clamav.net/list/clamav-users.html
