ClamAV memory consumption

dcruz99801 · 06-19-2020, 08:01 PM

I prefer to have some sort of antivirus even with Linux, but when I installed ClamAV on a Raspberry Pi Zero it kept locking up. I discovered it can easily consume <all> available memory (only 512MB on the Zero) and this may be a problem if I make tiny VMs.

Does anyone know of a free/cheap antivirus for Linux that does not have so large a footprint?

scasey · 06-20-2020, 01:12 PM

Please post how and what you are doing/scanning with clamav?
Scanning emai? Periodic disk scans?
I don’t find it intrusive while scanning incoming email.

Welcome to LQ

dcruz99801 · 06-20-2020, 09:59 PM

New build, was just trying to set up the picam but it kept burning up CPU (100% a lot) and memory (801mb out of 840mb, actual physical is more like 280 out of 305). I finally caught -- it was freshclam trying to download first-round updates, but it never could finish.

I wouldn't mind having it if there is a way to get past the update issue, otherwise the original question stands: is there a suitable substitute?

ondoho · 06-21-2020, 03:30 AM

Quote:

Originally Posted by dcruz99801

I prefer to have some sort of antivirus even with Linux, but when I installed ClamAV on a Raspberry Pi Zero it kept locking up. I discovered it can easily consume <all> available memory (only 512MB on the Zero) and this may be a problem if I make tiny VMs.

Sorry to say but I think you already answered your question.
Virtualisation on a pi0 with 512MB RAM? Didn't know that alone was possible.
Add to that an antivirus - it's too much.
Is ClamAV running constantly, in Windows-like fashion? I don't think that's necessary or desired on GNU/Linux.

scasey · 06-21-2020, 04:03 PM

Quote:

Originally Posted by dcruz99801

New build, was just trying to set up the picam but it kept burning up CPU (100% a lot) and memory (801mb out of 840mb, actual physical is more like 280 out of 305). I finally caught -- it was freshclam trying to download first-round updates, but it never could finish.

I wouldn't mind having it if there is a way to get past the update issue, otherwise the original question stands: is there a suitable substitute?

freshclam is not "clamav"
Try shutting down everything (stopping all daemons) except freshclam to see if that frees enough memory to allow it to finish, but that's probably not going to be practical. On my production server, freshclam runs 8 times per day. I have no idea how much RAM it uses for each run.

Again, why do you think you need anti-virus checking on your pi? Are you receiving email there?

dcruz99801 · 06-27-2020, 03:00 PM

After running TaskMgr while installing/running ClamAV and finding it was using up all available memory with freshclam (initial update), I was going to run without AV...but...I plan to eventually set my unit up as a surveillance/webcam so AV might be necessary, and who knows if it might have email.

The fix was to increase the dphys-swapfile size parameter from 100MB to 1024MB; this is twice the onboard physical, and the <normal/recommended> amount. So far it seems happy. I'm not sure why the original swapfile is only 100MB, unless it was established when Pi's were still using 4GB or 8GB SD cards.