Re: [qmailtoaster] clamd memory hog at 104MB

[Jake Vickers]

Eric Pierce wrote:

I don't think it's unusual:

root     10144  0.0  0.0  2172  208 ?        S    Apr17   0:00 supervise clamd
qmaill   10150  0.0  0.0  2060  316 ?        S    Apr17   1:04 
/usr/bin/multilog t s4000000 n100 /var/log/qmail/clamd
clamav   18506  0.6  5.0 141436 105648 ?     S    Jun02 387:06 /usr/sbin/clamd
clamav   11367  0.0  0.0  5596 1608 ?        Ss   Jul08   0:00 
/usr/bin/freshclam -d -p /var/run/clamav/freshclam.pid
root     15618  0.0  0.0  4464  652 pts/2    S+   14:17   0:00 grep clam

Mine's sitting at ~140MB after 86 days.  My presumption is that after it starts 
scanning, it caches some things in memory (like the virus database it uses, 
etc).  I've watched this since I read your first email and the size (on my 
system) has remained mostly constant, during active use.

Any modern server should be able to spare 100-150MB of ram to accommodate virus 
scanning I would think.  I run apache, qmailtoaster, mysql, vsftpd, and a 
VMWare virtual machine on this box (with 2GB total RAM) and have had zero 
issues -- and I've had it in production for over half a year now.  Load on the 
box is split between spamd/clamd activity and httpd/mysql requests.

Clam's kind of always been like that. Here's one of my servers (notice the 0.88 version):

[EMAIL PROTECTED] ~]# rpm -qa | grep clamav
clamav-toaster-0.88.3-1.3.2
[EMAIL PROTECTED] ~]# ps aux | grep clam

root      1150  0.0  0.1   3768   684 pts/1    R+   15:58   0:00 grep clam


[EMAIL PROTECTED] ~]# uptime
16:00:56 up 163 days, 58 min,  2 users,  load average: 0.15, 0.10, 0.06

root 1396 0.0 0.0 1420 200 ? S Jan30 0:00 supervise clamd qmaill 1409 0.0 0.0 1564 264 ? S Jan30 0:06 /usr/bin/multilog t s1000000 n100 /var/log/qmail/clamd clamav 1410 0.0 5.7 63008 28956 ? S Jan30 72:29 /usr/sbin/clamd clamav 15287 0.0 0.1 2572 692 ? Ss Jul08 0:01 /usr/bin/freshclam -d -p /var/run/clamav/freshclam.pid I do notice the older versions did not use as much memory, but YMMV. As far as uptime: I think clam does like SA does, and loads all of the definitions into memory to scan the files - the newer version contain more signatures, so it loads more. This is a guess though, since I've never actually looked at clam to see how it actually runs.

smime.p7s
Description: S/MIME Cryptographic Signature