I'm using clamonacc on my desktop computer and servers. I use a raspberry pi as clamd server. The clamd process only uses ~25% of all 4 cores so with htop I see it's using like ~100% and 400% is the maximum a process could use because the raspberry pi has 4 cores. RAM isn't full and there isn't much i/o wait (according to htop)

I'm currently testing clamonacc on one server but the clamonacc queue fills up until it's limit (too many opened files) I only have these problems if I use a dedicated clamd server - with the socket it doesn't fill up the queue often.

There's always only one clamd thread (two if I look with clamdtop because clamdtop needs another one) on the raspberry pi.

I think that the tcp connection makes all slower. The traffic goes through a switch from my server with clamonacc to my raspberry pi clamd server - but that shouldn't be a problem. htop says that there's ~7MB/s (3000/8000 packets)

The raspberry pi isn't the problem because I used another device and it still didn't work

How can I fix this?

Both systems have ubuntu installed. Clamav version: 0.103.3

btw, clamdscan doesn't seem to have problems but it's slower through tcp

edit: I got it.. The problem's like you would run clamav under root but you don't exclude root so it's scanning in a loop. I use clamonaccess mount-path / to scan my system. The problem is that even if I exclude both, clamav and root, it will still scan in a loop. If I change to a local socket it wont scan in a loop but if I use a dedicated clamd server it does

Is this a bug by clamav?

  • Did you try to queue at least four simultaneous scans? Nov 24 '21 at 19:08
  • Yes I did that. I tried with 1,5 and 12
    – france1
    Nov 25 '21 at 12:03
  • Should I make a bug report??
    – france1
    Nov 27 '21 at 6:36
  • I figured it out! Clamav isn't working with --fdpass (clamonacc) because it's running single threaded even if threads are higher! I made a bugreport on gihub @NikitaKipriyanov
    – france1
    Dec 1 '21 at 18:16
  • I think you better add an self-answer with the link to the bugreport and accept it. Dec 2 '21 at 8:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.