Hi there, On Wed, 11 May 2022, John Varghese via clamav-users wrote:
... Tue May 10 20:14:59 2022 -> Reading databases from /var/lib/clamav I need help understanding why the clamav service seems to hang after the container starts.
Using clamd with Docker is a bit new. I never tried it - I wouldn't even consider it until it's bedded down for a couple of years - but there do seem to be a few people using it. I guess others with more experience than I may be able to help if it's a genuine clamd/docker issue which doesn't appear elsewhere. There have been one or two of those recently if you trawl the list archives, I'm afraid I can't be precise because I more or less ignore things related to Docker. The search engines should make it easy to search for anything related to Docker in the archives. It should also be easy to search the issues in Github (unless you're using the same browser that I use, Palemoon, which apparently can't handle anything with 'git' in the domain name). But first, are you sure it's hanging? Is it perhaps just taking some time to read the signature files? I've seen some systems take several minutes to do that.
Are there any other logs that will help understand the issue?
There are system logs which might help, but I wonder if we can get more information about what's happening from clamd. You can increase the verbosity in the clamd log the clamd configuration file (see docs) and then you can see what's being loaded as it happens. What do you see if you run 'top' while you're starting clamd? I'd expect if you sort the output by memory consumed that you'd see a clamd process climb to the top of the list and stay there. While it's loading signatures you'll see whatever CPUs it's allowed to use being fully utilized until the signatures are loaded, then after some time (depending on the CPU cycles/s available to clamd) CPU usage will drop away more or less to zero until clamd is instructed to scan something. If the process just disappears of course you have a problem. How much RAM is available? You should budget at least 2GB for clamd. I'd say 3GB would be safer, and 4GB not unreasonable. You can reduce RAM used during the database reloads with a configuration option at the cost of not being able to scan anything during a reload. -- 73, Ged. _______________________________________________ clamav-users mailing list [email protected] https://lists.clamav.net/mailman/listinfo/clamav-users Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
