On Wed, 9 Feb 2022, Matus UHLAR - fantomas wrote:
I have clamav 0.103.5 installed on debian 11 and I'm getting too often
errors when reloading database.
looking back this problem started appearing on:
Mon May 10 11:51:15 2021 -> Database correctly reloaded (12721518 signatures)
Mon May 10 12:48:11 2021 -> ERROR: reload_th: Database load failed: Malformed
database
this machine has 4G of RAM and some swap, clamd currently eats ~1.5 GB ...
I wonder if this problem may be caused by i386 architecture with 3GB limit ...
Does clamd reload signature database in the same process?
On 13.02.22 11:14, Matus UHLAR - fantomas wrote:
I have rebooted into 64-bit kernel, without changing any installed software.
looks like database updates work flawlessly since:
[...]
So the 3GB barrier applies to clamav (no wonder) when reloading signatures.
- unlike other SW, no new clamd instance after reload.
On 13.02.22 13:16, Matus UHLAR - fantomas wrote:
I just encountered the DB reload, watched it closely:
Sun Feb 13 12:46:13 2022 -> Reading databases from /var/lib/clamav
Sun Feb 13 12:46:50 2022 -> Database correctly reloaded (12732534 signatures)
Sun Feb 13 12:46:50 2022 -> Activating the newly loaded database...
meanwhile clamd usage doubled and crossed 3.350G
after 2-3 minutes it dropped back to 1.7G.
I'd invite clamd logging message about database successfully activated.
I'm enabling zswap again, hopefully this time it won't kill system
performance.
notes after some time:
after moving to 64-bit OS with 4G available for 32-bit clamav swap issue
became a bit better, swap usage was higher, but the system was not killed by
continuously swapping when trying to reload the database (and failing).
I have removed the biggest database "securiteinfoold.hdb" that took about
300MB on disk (IIRC, the size was close to main and daily)
- number of signatures lowered from 12733384 to 9148084
- RAM usage lowered from 1705796 virt/ 1.5G res to 1364984 virt / 1.2g res
(TOP output)
I currently have 0.5G of swap used.
I will keep it running like this for some time and then fetch
securiteinfoold.hdb and then see how many of mails it catches.
--
Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
My mind is like a steel trap - rusty and illegal in 37 states.
_______________________________________________
clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users
Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq
http://www.clamav.net/contact.html#ml
