I have to agree on the memory requirements for clamd being high. I
wonder if it would make sense to store the data set of signatures in a
tiered hierarchy, with some of the less used data being on disk until
there's a hit? i don't know enough about the internals and scanning
algorithm used in clamd to speak meaningfully about it...
On 05/04/2017 10:36 AM, Henrik K wrote:
On Thu, May 04, 2017 at 02:57:51PM +0200, Reindl Harald wrote:
it's unacceptable having a clamd process which wastes nearly 1 GB of RAM
hanging around when he don't catch anything
For once I have to agree..
My stats:
ClamAV - 10 million sigs (includes most sanesecurity stuff)
Sophos - 13 million sigs
# /usr/bin/time -f '\t%E real, \t%M kBmem' /usr/local/clamav/bin/clamscan
/etc/hosts
<snip>
0:28.18 real, 1096492 kBmem
# /usr/bin/time -f '\t%E real, \t%M kBmem' /opt/sophos-av/bin/savscan /etc/hosts
<snip>
0:05.99 real, 231504 kBmem
Perhaps ClamAV devs should start innovating a little on how to handle all
the sigs, instead of keeping bloating a glorified in-memory hash-database.
;-D Jeez one could probably simply precompile a CDB database from all the
hashes and dramatically reduce memory usage, probably wouldn't even slow
down much..
_______________________________________________
clamav-users mailing list
clamav-users@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq
http://www.clamav.net/contact.html#ml
_______________________________________________
clamav-users mailing list
clamav-users@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq
http://www.clamav.net/contact.html#ml
