Mailing List Archive

[clamav-users] Clamscan reboots the system
Hi,


I am running clamscan on imx6q sabresd board which has 1GB of RAM. A few months back, I got an OOM killer while running clamscan which killed the clamscan process. So, as a workaround, I introduced a swap of 2GB which worked and fixed the OOM killer issue.


But, now if I create a swap file of 2GB and run clamscan, the board reboots sometimes, and sometimes the scan is successful. RAM usage is quite high and at times only 5MB of it is left free while running clamscan and swap usage goes as high as 500MB.


The difference between the above two cases is the introduction of approximately 80,000 new virus signatures. I am quoting this comment here https://unix.stackexchange.com/a/278110, "The problem is the huge number of virus signatures. This leads to the algorithms' datastructures growing quite large. You can't send those datastructures to swap, as there are no parts of the algorithms' datastructures accessed less often than other parts."


My concern is the random rebooting of the board. Why running clamscan is rebooting the board? Why swap file is no more effective? I mean, Introducing a swap file could cause performance degradation, but a reboot shouldn't occur in any case!


So, here are my questions:


Is clamscan supposed to work by introducing swap in low-memory systems?

What might be causing the board to reboot in this case and how it can be fixed?


Any help would be appreciated!


Thanks,

Tariq?
Re: [clamav-users] Clamscan reboots the system [ In reply to ]
Hi there,

On Wed, 20 Oct 2021, Mehmood, Tariq wrote:

> I am running clamscan on imx6q sabresd board which has 1GB of RAM.

Even if you only use the 'official' databases, that's not enough RAM.
The minimum recommended is 2GB, see

https://docs.clamav.net/

> A few months back, I got an OOM killer while running clamscan which
> killed the clamscan process. So, as a workaround, I introduced a
> swap of 2GB which worked and fixed the OOM killer issue.

It's a sticking plaster, not a fix. A fix is to have enough RAM.

> But, now if I create a swap file of 2GB and run clamscan, the board
> reboots sometimes, and sometimes the scan is successful. RAM usage
> is quite high and at times only 5MB of it is left free while running
> clamscan and swap usage goes as high as 500MB.

Running with as little a 5MB free is asking for trouble. Get more RAM
for the device, or use another device (with more RAM) for the scanner,
or do something else which limits RAM use to well within what you have.

> My concern is the random rebooting of the board. Why running
> clamscan is rebooting the board?

Nothing in the ClamAV suite will deliberately reboot a system, but it
is very common to see things crash when memory is tight. Part of the
reason is that a lot of software is never tested for its behaviour
with very low memory availability. Perhaps something is crashing the
system when it runs out of memory, and the board is set up to reboot
after a crash?

> Why swap file is no more effective? I mean, Introducing a swap file
> could cause performance degradation, but a reboot shouldn't occur in
> any case!

In an ideal world a reboot shouldn't occur. But that world isn't ours.

> Is clamscan supposed to work by introducing swap in low-memory systems?

It certainly isn't recommended, and I doubt it's been well tested, but
the problem might not be with clamscan at all. It might be something
else entirely which is causing the problem - you just happen to notice
it when there's a low memory condition cause by running a scan.

> What might be causing the board to reboot in this case and how it
> can be fixed?

See above.

What is it that you want ClamAV to do for you, and why?

--

73,
Ged.

_______________________________________________

clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml
Re: [clamav-users] Clamscan reboots the system [ In reply to ]
> or do something else which limits RAM use to well within what you have.
Thanks for this pointer. Memory hogging by clamscan was causing the
unstable behavior. I have put a limit on the clamscan process for RAM
usage by using cgroup and I am able to run clamscan by creating a swap
file and limiting RAM. The only downfall of this approach is the time taken
by clamscan which is acceptable for now.
Thanks for your help
________________________________________
From: clamav-users <clamav-users-bounces@lists.clamav.net> on behalf of G.W. Haywood via clamav-users <clamav-users@lists.clamav.net>
Sent: Thursday, October 21, 2021 3:01 AM
To: ClamAV users ML
Cc: G.W. Haywood
Subject: Re: [clamav-users] Clamscan reboots the system

Hi there,

On Wed, 20 Oct 2021, Mehmood, Tariq wrote:

> I am running clamscan on imx6q sabresd board which has 1GB of RAM.

Even if you only use the 'official' databases, that's not enough RAM.
The minimum recommended is 2GB, see

https://docs.clamav.net/

> A few months back, I got an OOM killer while running clamscan which
> killed the clamscan process. So, as a workaround, I introduced a
> swap of 2GB which worked and fixed the OOM killer issue.

It's a sticking plaster, not a fix. A fix is to have enough RAM.

> But, now if I create a swap file of 2GB and run clamscan, the board
> reboots sometimes, and sometimes the scan is successful. RAM usage
> is quite high and at times only 5MB of it is left free while running
> clamscan and swap usage goes as high as 500MB.

Running with as little a 5MB free is asking for trouble. Get more RAM
for the device, or use another device (with more RAM) for the scanner,
or do something else which limits RAM use to well within what you have.

> My concern is the random rebooting of the board. Why running
> clamscan is rebooting the board?

Nothing in the ClamAV suite will deliberately reboot a system, but it
is very common to see things crash when memory is tight. Part of the
reason is that a lot of software is never tested for its behaviour
with very low memory availability. Perhaps something is crashing the
system when it runs out of memory, and the board is set up to reboot
after a crash?

> Why swap file is no more effective? I mean, Introducing a swap file
> could cause performance degradation, but a reboot shouldn't occur in
> any case!

In an ideal world a reboot shouldn't occur. But that world isn't ours.

> Is clamscan supposed to work by introducing swap in low-memory systems?

It certainly isn't recommended, and I doubt it's been well tested, but
the problem might not be with clamscan at all. It might be something
else entirely which is causing the problem - you just happen to notice
it when there's a low memory condition cause by running a scan.

> What might be causing the board to reboot in this case and how it
> can be fixed?

See above.

What is it that you want ClamAV to do for you, and why?

--

73,
Ged.

_______________________________________________

clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

_______________________________________________

clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml
Re: [clamav-users] Clamscan reboots the system [ In reply to ]
>> or do something else which limits RAM use to well within what you have.

On 21.10.21 12:50, Mehmood, Tariq wrote:
>Thanks for this pointer. Memory hogging by clamscan was causing the
>unstable behavior. I have put a limit on the clamscan process for RAM
>usage by using cgroup and I am able to run clamscan by creating a swap
>file and limiting RAM. The only downfall of this approach is the time taken
>by clamscan which is acceptable for now.

Of course - there are so many virus signatures that they do not fit into
memory.
get computer with more memory, or maybe other antivirus sw (I really don't
know if any fits into memory).


>From: clamav-users <clamav-users-bounces@lists.clamav.net> on behalf of G.W. Haywood via clamav-users <clamav-users@lists.clamav.net>
>Sent: Thursday, October 21, 2021 3:01 AM
>To: ClamAV users ML
>Cc: G.W. Haywood
>Subject: Re: [clamav-users] Clamscan reboots the system
>
>Hi there,
>
>On Wed, 20 Oct 2021, Mehmood, Tariq wrote:
>
>> I am running clamscan on imx6q sabresd board which has 1GB of RAM.
>
>Even if you only use the 'official' databases, that's not enough RAM.
>The minimum recommended is 2GB, see
>
>https://docs.clamav.net/
>
>> A few months back, I got an OOM killer while running clamscan which
>> killed the clamscan process. So, as a workaround, I introduced a
>> swap of 2GB which worked and fixed the OOM killer issue.
>
>It's a sticking plaster, not a fix. A fix is to have enough RAM.
>
>> But, now if I create a swap file of 2GB and run clamscan, the board
>> reboots sometimes, and sometimes the scan is successful. RAM usage
>> is quite high and at times only 5MB of it is left free while running
>> clamscan and swap usage goes as high as 500MB.
>
>Running with as little a 5MB free is asking for trouble. Get more RAM
>for the device, or use another device (with more RAM) for the scanner,
>or do something else which limits RAM use to well within what you have.
>
>> My concern is the random rebooting of the board. Why running
>> clamscan is rebooting the board?
>
>Nothing in the ClamAV suite will deliberately reboot a system, but it
>is very common to see things crash when memory is tight. Part of the
>reason is that a lot of software is never tested for its behaviour
>with very low memory availability. Perhaps something is crashing the
>system when it runs out of memory, and the board is set up to reboot
>after a crash?
>
>> Why swap file is no more effective? I mean, Introducing a swap file
>> could cause performance degradation, but a reboot shouldn't occur in
>> any case!
>
>In an ideal world a reboot shouldn't occur. But that world isn't ours.
>
>> Is clamscan supposed to work by introducing swap in low-memory systems?
>
>It certainly isn't recommended, and I doubt it's been well tested, but
>the problem might not be with clamscan at all. It might be something
>else entirely which is causing the problem - you just happen to notice
>it when there's a low memory condition cause by running a scan.
>
>> What might be causing the board to reboot in this case and how it
>> can be fixed?
>
>See above.
>
>What is it that you want ClamAV to do for you, and why?
>
>--
>
>73,
>Ged.
>
>_______________________________________________
>
>clamav-users mailing list
>clamav-users@lists.clamav.net
>https://lists.clamav.net/mailman/listinfo/clamav-users
>
>
>Help us build a comprehensive ClamAV guide:
>https://github.com/vrtadmin/clamav-faq
>
>http://www.clamav.net/contact.html#ml
>
>_______________________________________________
>
>clamav-users mailing list
>clamav-users@lists.clamav.net
>https://lists.clamav.net/mailman/listinfo/clamav-users
>
>
>Help us build a comprehensive ClamAV guide:
>https://github.com/vrtadmin/clamav-faq
>
>http://www.clamav.net/contact.html#ml

--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Your mouse has moved. Windows NT will now restart for changes to take
to take effect. [OK]

_______________________________________________

clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml