clamd takes 7% of ram

[P]

the clamd process takes more than 7% of system RAM as soon as it starts
Since my systeme has 16Go ram, it takes more than 1Go RAM !

$ sudo ps -ef | grep clamd
clamav 3409698 1 1 23:20 ? 00:00:10 /usr/sbin/clamd --foreground=true
pascal 3412125 3066262 0 23:36 pts/3 00:00:00 grep --color=auto clamd

$ sudo ps gvp 3409698 | grep clamd
3409698 ? Ssl 0:10 0 107 1317064 1164668 7.2 /usr/sbin/clamd --foreground=true

ProblemType: Bug
DistroRelease: Ubuntu 20.10
Package: clamav-daemon 0.102.4+dfsg-1build1
ProcVersionSignature: Ubuntu 5.4.0-52.57-generic 5.4.65
Uname: Linux 5.4.0-52-generic x86_64
ApportVersion: 2.20.11-0ubuntu50.3
Architecture: amd64
CasperMD5CheckResult: skip
CurrentDesktop: KDE
Date: Tue Dec 8 23:33:18 2020
InstallationDate: Installed on 2019-06-02 (555 days ago)
InstallationMedia: Kubuntu 19.04 "Disco Dingo" - Release amd64 (20190416)
RebootRequiredPkgs:
 linux-image-5.8.0-31-generic
 linux-image-5.8.0-32-generic
SourcePackage: clamav
UpgradeStatus: Upgraded to groovy on 2020-10-24 (45 days ago)
---
ProblemType: Bug
ApportVersion: 2.20.11-0ubuntu50.3
Architecture: amd64
CasperMD5CheckResult: skip
CurrentDesktop: KDE
DistroRelease: Ubuntu 20.10
InstallationDate: Installed on 2019-06-02 (555 days ago)
InstallationMedia: Kubuntu 19.04 "Disco Dingo" - Release amd64 (20190416)
Package: clamav-daemon 0.102.4+dfsg-1build1
PackageArchitecture: amd64
ProcCmdline: BOOT_IMAGE=/vmlinuz-5.4.0-52-generic root=/dev/mapper/kubuntu--vg-root ro quiet splash
ProcVersionSignature: Ubuntu 5.4.0-52.57-generic 5.4.65
RebootRequiredPkgs:
 linux-image-5.8.0-31-generic
 linux-image-5.8.0-32-generic
Tags: third-party-packages groovy
Uname: Linux 5.4.0-52-generic x86_64
UpgradeStatus: Upgraded to groovy on 2020-10-24 (45 days ago)
UserGroups: adm cdrom dialout dip kvm libvirt lpadmin plugdev pulse pulse-access sambashare sudo video
_MarkForUpload: True

[P (p92)]

any means to limit the ram consumption of clamd ?

[Sergio Durigan Junior (sergiodj)]

Hi, thanks for reporting the bug.

Before anything else, I would like to ask if there is any particular reason why you marked the bug as Invalid. Have you perhaps found the problem or a workaround? If that is the case, then could you update this bug and post what you've found? Maybe other users could benefit from it.

I'm not touching the bug status for now because I still don't know if the switch from New to Invalid was intentional.

I haven't investigated it further either, but a quick workaround to limit the memory a process consumes is to edit its systemd service file and use the MemoryLimit directive, for example.

Thanks!

[P (p92)]

Hello.
Well first I valgrinded clamd to see if any memory leak was detected. To my knowledge it seems not.
Then I googled on this behaviour and found lots of people complaining of ram footprint of clamd. In fact this behaviour seems linked to the necessity of loading all virus database in ram for performance purpose.

So there are no workaround except what you suggest.

I'll try to see if MemoryLimit is an accepted parameter for clamd.

[P (p92)]

I've started the unit with MemoryHigh=512M because MemoryLimit would kill the process

I see that systemd has accepted the parameter, but the process still takes 1.1G :
Memory: 1.1G (high: 512.0M)

as seen in the status report :

# systemctl status clamav-daemon.service
● clamav-daemon.service - Clam AntiVirus userspace daemon
     Loaded: loaded (/lib/systemd/system/clamav-daemon.service; enabled; vendor preset: enabled)
    Drop-In: /etc/systemd/system/clamav-daemon.service.d
             └─extend.conf
     Active: active (running) since Wed 2020-12-09 19:47:06 CET; 1min 9s ago
       Docs: man:clamd(8)
             man:clamd.conf(5)
             https://www.clamav.net/documents/
    Process: 3650667 ExecStartPre=/bin/mkdir -p /run/clamav (code=exited, status=0/SUCCESS)
    Process: 3650676 ExecStartPre=/bin/chown clamav /run/clamav (code=exited, status=0/SUCCESS)
   Main PID: 3650686 (clamd)
      Tasks: 2 (limit: 18754)
     Memory: 1.1G (high: 512.0M)
     CGroup: /system.slice/clamav-daemon.service
             └─3650686 /usr/sbin/clamd --foreground=true

déc. 09 19:47:28 minipc clamd[3650686]: Wed Dec 9 19:47:28 2020 -> Portable Executable support enabled.
déc. 09 19:47:28 minipc clamd[3650686]: Wed Dec 9 19:47:28 2020 -> ELF support enabled.
déc. 09 19:47:28 minipc clamd[3650686]: Wed Dec 9 19:47:28 2020 -> Mail files support enabled.
déc. 09 19:47:28 minipc clamd[3650686]: Wed Dec 9 19:47:28 2020 -> OLE2 support enabled.
déc. 09 19:47:28 minipc clamd[3650686]: Wed Dec 9 19:47:28 2020 -> PDF support enabled.
déc. 09 19:47:28 minipc clamd[3650686]: Wed Dec 9 19:47:28 2020 -> SWF support enabled.
déc. 09 19:47:28 minipc clamd[3650686]: Wed Dec 9 19:47:28 2020 -> HTML support enabled.
déc. 09 19:47:28 minipc clamd[3650686]: Wed Dec 9 19:47:28 2020 -> XMLDOCS support enabled.
déc. 09 19:47:28 minipc clamd[3650686]: Wed Dec 9 19:47:28 2020 -> HWP3 support enabled.
déc. 09 19:47:28 minipc clamd[3650686]: Wed Dec 9 19:47:28 2020 -> Self checking every 3600 seconds.

[P (p92)]

With the following combinaison of parms, it seems to work better :)

root@minipc:/lib/systemd/system# cat clamav-daemon.service
[Unit]
Description=Clam AntiVirus userspace daemon
Documentation=man:clamd(8) man:clamd.conf(5) https://www.clamav.net/documents/
# Check for database existence
ConditionPathExistsGlob=/var/lib/clamav/main.{c[vl]d,inc}
ConditionPathExistsGlob=/var/lib/clamav/daily.{c[vl]d,inc}

[Service]
ExecStart=/usr/sbin/clamd --foreground=true
# Reload the database
ExecReload=/bin/kill -USR2 $MAINPID
StandardOutput=journal
TimeoutStartSec=420
MemoryHigh=256M
MemoryMax=512M

[Install]
WantedBy=multi-user.target
root@minipc:/lib/systemd/system#

root@minipc:/lib/systemd/system# systemctl status clamav-daemon.service
● clamav-daemon.service - Clam AntiVirus userspace daemon
     Loaded: loaded (/lib/systemd/system/clamav-daemon.service; enabled; vendor preset: enabled)
    Drop-In: /etc/systemd/system/clamav-daemon.service.d
             └─extend.conf
     Active: active (running) since Wed 2020-12-09 20:05:13 CET; 2min 16s ago
       Docs: man:clamd(8)
             man:clamd.conf(5)
             https://www.clamav.net/documents/
    Process: 3652938 ExecStartPre=/bin/mkdir -p /run/clamav (code=exited, status=0/SUCCESS)
    Process: 3652940 ExecStartPre=/bin/chown clamav /run/clamav (code=exited, status=0/SUCCESS)
   Main PID: 3652954 (clamd)
      Tasks: 2 (limit: 18754)
     Memory: 511.9M (high: 256.0M max: 512.0M)
     CGroup: /system.slice/clamav-daemon.service
             └─3652954 /usr/sbin/clamd --foreground=true

déc. 09 20:06:02 minipc clamd[3652954]: Wed Dec 9 20:06:02 2020 -> Portable Executable support enabled.
déc. 09 20:06:02 minipc clamd[3652954]: Wed Dec 9 20:06:02 2020 -> ELF support enabled.
déc. 09 20:06:02 minipc clamd[3652954]: Wed Dec 9 20:06:02 2020 -> Mail files support enabled.
déc. 09 20:06:02 minipc clamd[3652954]: Wed Dec 9 20:06:02 2020 -> OLE2 support enabled.
déc. 09 20:06:02 minipc clamd[3652954]: Wed Dec 9 20:06:02 2020 -> PDF support enabled.
déc. 09 20:06:02 minipc clamd[3652954]: Wed Dec 9 20:06:02 2020 -> SWF support enabled.
déc. 09 20:06:02 minipc clamd[3652954]: Wed Dec 9 20:06:02 2020 -> HTML support enabled.
déc. 09 20:06:02 minipc clamd[3652954]: Wed Dec 9 20:06:02 2020 -> XMLDOCS support enabled.
déc. 09 20:06:02 minipc clamd[3652954]: Wed Dec 9 20:06:02 2020 -> HWP3 support enabled.
déc. 09 20:06:02 minipc clamd[3652954]: Wed Dec 9 20:06:02 2020 -> Self checking every 3600 seconds.