[Clamav-users] problem with cpu and memory consume
Hello All, I have ClamAV+Spamassassin+Postfix in a Debian. The problem is that I have a lot of clamscan process and they consume to much cpu and memory of the machine (I have 900M in RAM and 2CPU of 2G). I want to tunning the clamAV in the file /etc/clamav/clamd.conf. I don’t have any reference of this issue. Could you help me please? This is what I have in my clamd.conf FixStaleSocket User clamav AllowSupplementaryGroups ScanMail ScanArchive ArchiveMaxRecursion 5 ArchiveMaxFiles 1000 ArchiveMaxFileSize 10M ArchiveMaxCompressionRatio 250 ReadTimeout 180 MaxThreads 12 MaxConnectionQueueLength 15 LogFile /var/log/clamav/clamav.log LogTime LogFileMaxSize 10M PidFile /var/run/clamav/clamd.pid DatabaseDirectory /var/lib/clamav SelfCheck 3600 ScanOLE2 ScanPE DetectBrokenExecutables ScanHTML ArchiveBlockMax Thank you Best Regards Eduardo -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.385 / Virus Database: 268.4.4/319 - Release Date: 19-04-2006 ___ http://lurker.clamav.net/list/clamav-users.html
Re: [Clamav-users] problem with cpu and memory consume
Eduardo Reitz wrote: Hello All, I have ClamAV+Spamassassin+Postfix in a Debian. The problem is that I have a lot of clamscan process and they consume to much cpu and memory of the machine (I have 900M in RAM and 2CPU of 2G). I want to tunning the clamAV in the file /etc/clamav/clamd.conf. I don’t have any reference of this issue. Could you help me please? I'm no expert, but the last thing in the world I'd use for scanning email is clamscan. Each time it's called it has to load all the pattern files then scan what ever file/directory you've told it to scan. If you get 20,000 messages/hour that's a lot of startup costs. Using clamdscan is more efficient because it uses a running instance of clamd and so already has loaded all the patterns. Even more efficient is to extract any suspicious attachment to a temp file area and call clamd directly via Unix socket or tcp/ip socket, and tell it where to find the file(s) to scan. I don't know if this is possible in Postfix or not as I gave up on it some weeks ago, but certainly in the Sendmail world this is trivial. dp ___ http://lurker.clamav.net/list/clamav-users.html
Re: [Clamav-users] problem with cpu and memory consume
Dennis Peterson escreveu: Eduardo Reitz wrote: Hello All, I have ClamAV+Spamassassin+Postfix in a Debian. The problem is that I have a lot of clamscan process and they consume to much cpu and memory of the machine (I have 900M in RAM and 2CPU of 2G). I'm no expert, but the last thing in the world I'd use for scanning email is clamscan. Each time it's called it has to load all the pattern files then scan what ever file/directory you've told it to scan. If you get 20,000 messages/hour that's a lot of startup costs. Using clamdscan is more efficient because it uses a running instance of clamd and so already has loaded all the patterns. Even more efficient is to extract any suspicious attachment to a temp file area and call clamd directly via Unix socket or tcp/ip socket, and tell it where to find the file(s) to scan. I don't know if this is possible in Postfix or not as I gave up on it some weeks ago, but certainly in the Sendmail world this is trivial. How are you calling clamav from postfix If you're seeing 'a lot of clamscan process', then i'll suppose you're NOT using amavisd. And then i will strongly recommend that you use it. You can call clamd as well as spamassassin from amavisd and can also set a LOT of other content filter rules on that. You can also set the max number of processes amavisd can run, so it wont kill your machine altough it can get its usage very high. It's up to you decide what's high usage and what's killing usage. http://www.ijs.si/software/amavisd/ -- Atenciosamente / Sincerily, Leonardo Rodrigues Solutti Tecnologia http://www.solutti.com.br Minha armadilha de SPAM, NÃO mandem email [EMAIL PROTECTED] My SPAMTRAP, do not email it ___ http://lurker.clamav.net/list/clamav-users.html
