Mailing List Archive

Critical Bug Report - Docker Image Crashing
Good morning, I am using the standard Docker image for a client. This
morning's anti-virus update is crashing Docker during update. I
re-downloaded the image, and re-ran the process. I assume this is
affecting many users - final lines of output are below -

|Downloading database patch # 26577...|

|Time:    0.1s, ETA:    0.0s [========================>]   15.21KiB/15.21KiB|

|Testing database: '/var/lib/clamav/tmp.36a55ab0c3/clamav-91abc2838c6f6baf854e8435b4a18fd5.tmp-daily.cld' ...|

|copying response body from Docker: unexpected EOF|

|
|

Please advise?

Kind regards,

Sam Smith
_______________________________________________

clamav-devel mailing list
clamav-devel@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-devel

Please submit your patches to our Github: https://github.com/Cisco-Talos/clamav-devel/pulls

Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml
Re: Critical Bug Report - Docker Image Crashing [ In reply to ]
Hi Sam,

I suspect your container doesn't have enough RAM. The process your log describes is where Freshclam tests a new database by loading it into memory. If ClamD is already running with loaded signatures, that may use upwards of 2.5 to 3GB total.

You can also change the freshclam.conf settings to disable database load-testing. When ClamD reloads with updated databases, the default behavior is for it to load in the new one and then unload the old one so scans can continue during the loading process. You can also change this to disable concurrent database reloads in the clamd.conf file so it doesn't use twice as much RAM as normal during the reload. However it will have a gap where all scans are blocked during the reload.

My recommendation is to allocate 4GB of RAM or more for your container.

Regards,
Micah


Micah Snyder
ClamAV Development
Talos
Cisco Systems, Inc.
________________________________
From: clamav-devel <clamav-devel-bounces@lists.clamav.net> on behalf of Sam Smith <sam_smith@psclgb.com>
Sent: Sunday, June 19, 2022 11:53 PM
To: clamav-devel@lists.clamav.net <clamav-devel@lists.clamav.net>
Subject: [Clamav-devel] Critical Bug Report - Docker Image Crashing

Good morning, I am using the standard Docker image for a client. This
morning's anti-virus update is crashing Docker during update. I
re-downloaded the image, and re-ran the process. I assume this is
affecting many users - final lines of output are below -

|Downloading database patch # 26577...|

|Time: 0.1s, ETA: 0.0s [========================>] 15.21KiB/15.21KiB|

|Testing database: '/var/lib/clamav/tmp.36a55ab0c3/clamav-91abc2838c6f6baf854e8435b4a18fd5.tmp-daily.cld' ...|

|copying response body from Docker: unexpected EOF|

|
|

Please advise?

Kind regards,

Sam Smith
_______________________________________________

clamav-devel mailing list
clamav-devel@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-devel

Please submit your patches to our Github: https://github.com/Cisco-Talos/clamav-devel/pulls

Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml
_______________________________________________

clamav-devel mailing list
clamav-devel@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-devel

Please submit your patches to our Github: https://github.com/Cisco-Talos/clamav-devel/pulls

Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml
Re: Critical Bug Report - Docker Image Crashing [ In reply to ]
Many thanks for this. I amended to give the container 4GB and that worked.

Kind regards,

Sam Smith

On 20/06/2022 19:53, Micah Snyder (micasnyd) wrote:
> Hi Sam,
>
> I suspect your container doesn't have enough RAM. The process your log describes is where Freshclam tests a new database by loading it into memory. If ClamD is already running with loaded signatures, that may use upwards of 2.5 to 3GB total.
>
> You can also change the freshclam.conf settings to disable database load-testing. When ClamD reloads with updated databases, the default behavior is for it to load in the new one and then unload the old one so scans can continue during the loading process. You can also change this to disable concurrent database reloads in the clamd.conf file so it doesn't use twice as much RAM as normal during the reload. However it will have a gap where all scans are blocked during the reload.
>
> My recommendation is to allocate 4GB of RAM or more for your container.
>
> Regards,
> Micah
>
>
> Micah Snyder
> ClamAV Development
> Talos
> Cisco Systems, Inc.
> ________________________________
> From: clamav-devel <clamav-devel-bounces@lists.clamav.net> on behalf of Sam Smith <sam_smith@psclgb.com>
> Sent: Sunday, June 19, 2022 11:53 PM
> To: clamav-devel@lists.clamav.net <clamav-devel@lists.clamav.net>
> Subject: [Clamav-devel] Critical Bug Report - Docker Image Crashing
>
> Good morning, I am using the standard Docker image for a client. This
> morning's anti-virus update is crashing Docker during update. I
> re-downloaded the image, and re-ran the process. I assume this is
> affecting many users - final lines of output are below -
>
> |Downloading database patch # 26577...|
>
> |Time: 0.1s, ETA: 0.0s [========================>] 15.21KiB/15.21KiB|
>
> |Testing database: '/var/lib/clamav/tmp.36a55ab0c3/clamav-91abc2838c6f6baf854e8435b4a18fd5.tmp-daily.cld' ...|
>
> |copying response body from Docker: unexpected EOF|
>
> |
> |
>
> Please advise?
>
> Kind regards,
>
> Sam Smith
> _______________________________________________
>
> clamav-devel mailing list
> clamav-devel@lists.clamav.net
> https://lists.clamav.net/mailman/listinfo/clamav-devel
>
> Please submit your patches to our Github: https://github.com/Cisco-Talos/clamav-devel/pulls
>
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
>
> http://www.clamav.net/contact.html#ml
> _______________________________________________
>
> clamav-devel mailing list
> clamav-devel@lists.clamav.net
> https://lists.clamav.net/mailman/listinfo/clamav-devel
>
> Please submit your patches to our Github: https://github.com/Cisco-Talos/clamav-devel/pulls
>
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
>
> http://www.clamav.net/contact.html#ml
_______________________________________________

clamav-devel mailing list
clamav-devel@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-devel

Please submit your patches to our Github: https://github.com/Cisco-Talos/clamav-devel/pulls

Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml