Re: Assistance with Optimizing ClamAV for Production Servers

Matus UHLAR - fantomas via clamav-users <[email protected]>
Newsgroups gmane.comp.security.virus.clamav.user
Message-ID <[email protected]>
On 24.12.24 14:11, Adalfarus Theodoric via clamav-users wrote:
>I hope this message finds you well. I’m new to using ClamAV and am
>currently in the process of implementing it on our production servers.
>During our testing phase, I encountered a couple of performance-related
>issues that I’d like to address with your guidance.
>
>   1.
>
>   *RAM Usage*: There’s a significant memory usage spike for approximately
>   5 minutes during certain operations, although I’m unsure of the root cause.

which operations? I would expect same delays in case clamscan or clamd are 
loading virus database, although on my system this taker slightly over one 
minute.

>   2.
>
>   *High CPU Usage During Scans*: I understand that ClamAV scans are
>   resource-intensive by design (this is the case even for enterprise AV), but
>   I’d like to explore ways to reduce their impact. Specifically, I’m
>   considering reducing scan times by excluding specific folders, though I’m
>   not entirely sure which folders are safe to whitelist with low risk for the
>   system.

what do you scan and when?

>My main goal is to prepare a config of ClamAV that prioritizes performance
>with low risks in undetecting threats. Could you please advise on the
>following?
>
>   - Are there existing best practices, configurations, or builds designed
>   specifically for optimizing ClamAV’s performance on production servers?
>   - Can you recommend approaches to safely whitelist folders or files
>   without undermining security?
>   - Are there any specific configuration parameters or tools within ClamAV
>   that can help mitigate RAM spikes and reduce CPU usage?
>
>Thank you for your time and support!

the best I can think of is:

1. use clamd which does not reload database everytime scan is done
2. avoid repeated scanning of the same content

-- 
Matus UHLAR - fantomas, [email protected] ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Emacs is a complicated operating system without good text editor.
_______________________________________________

Manage your clamav-users mailing list subscription / unsubscribe:
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/Cisco-Talos/clamav-documentation

https://docs.clamav.net/#mailing-lists-and-chat
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.