Forums

Subscribe via email Subscribe via email
Subscribe via rss
Guest
or Ask a Question
Add a reply View Replies (6) →
Graham Sivilll
Graham Sivilll
Offline
Issue

CLAMD and CLAMScan killing my system

Resolved
0 votes
Hi,
About a week ago I posted about this issue and after re-booting the Server the issue seemed to have disappeared, but it has happened again yesterday and into today. The following is recorded in my Events:

Low memory; process clamd (40222) killed	2018-04-05 10:11:32

	Low memory; process clamscan (40214) killed	2018-04-05 10:11:10

	Low memory; process clamd (39955) killed	2018-04-05 10:10:57

	Low memory; process clamd (39919) killed	2018-04-05 10:10:28

	Low memory; process clamd (39913) killed	2018-04-05 09:42:11

	Low memory; process clamd (39905) killed	2018-04-05 09:41:53

	Low memory; process clamd (39648) killed	2018-04-05 09:41:34

	Low memory; process clamd (39626) killed	2018-04-05 09:41:08

	Low memory; process clamd (39601) killed	2018-04-05 09:39:01

	Low memory; process clamd (39301) killed	2018-04-05 09:14:58

	Low memory; process clamd (39295) killed	2018-04-05 09:14:39

	Low memory; process clamd (39284) killed	2018-04-05 09:14:21

	Low memory; process clamd (39276) killed	2018-04-05 09:13:49

	Low memory; process clamd (39269) killed	2018-04-05 09:13:31

	Low memory; process clamd (38990) killed	2018-04-05 09:13:15

	Low memory; process clamscan (38989) killed	2018-04-05 09:12:53

	Low memory; process clamd (38927) killed	2018-04-05 09:11:17

	Low memory; process clamd (38905) killed	2018-04-05 09:09:11

	Low memory; process clamd (38897) killed	2018-04-05 07:53:55

	Low memory; process clamd (38889) killed	2018-04-05 07:53:37

	Low memory; process clamd (38883) killed	2018-04-05 07:53:17

	Low memory; process clamd (38877) killed	2018-04-05 07:52:55

	Low memory; process clamd (38611) killed	2018-04-05 07:52:30

	Low memory; process clamd (38593) killed	2018-04-05 07:52:05

	Low memory; process clamd (38541) killed	2018-04-05 07:46:40

	Low memory; process clamd (38533) killed	2018-04-05 07:45:59

	Low memory; process clamd (38288) killed	2018-04-05 07:45:37

	Low memory; process clamd (38269) killed	2018-04-05 07:45:13

	Low memory; process clamd (38262) killed	2018-04-05 07:44:49

	Low memory; process clamd (38254) killed	2018-04-05 07:44:30

	Low memory; process clamd (38248) killed	2018-04-05 07:44:11

	Low memory; process clamd (37985) killed	2018-04-05 07:43:52

	Low memory; process clamd (37964) killed	2018-04-05 07:41:40

	Low memory; process clamd (37934) killed	2018-04-05 07:37:34

	Low memory; process clamd (37685) killed	2018-04-05 07:37:14

	Low memory; process clamd (37668) killed	2018-04-05 07:36:48

	Low memory; process clamd (37660) killed	2018-04-05 07:34:05

	Low memory; process clamd (37650) killed	2018-04-05 07:33:40

	Low memory; process clamd (37645) killed	2018-04-05 07:33:15

	Low memory; process clamd (37635) killed	2018-04-05 07:32:53

	Low memory; process clamd (37379) killed	2018-04-05 07:31:58

	Low memory; process clamd (37119) killed	2018-04-05 07:31:34

	Low memory; process clamd (37098) killed	2018-04-05 07:26:33

	Low memory; process clamd (37091) killed	2018-04-05 07:22:42

	Low memory; process clamd (37084) killed	2018-04-05 07:22:25

	Low memory; process clamd (37077) killed	2018-04-05 07:22:02

	Low memory; process clamd (37068) killed	2018-04-05 07:21:42

	Low memory; process clamd (37062) killed	2018-04-05 07:21:23

	Low memory; process clamd (37053) killed	2018-04-05 07:20:52

	Low memory; process clamd (36798) killed	2018-04-05 07:20:28

	Low memory; process clamd (36778) killed	2018-04-05 07:20:04

	Low memory; process clamd (36768) killed	2018-04-05 07:13:01

	Low memory; process clamd (36761) killed	2018-04-05 07:12:16

	Low memory; process clamd (36752) killed	2018-04-05 07:11:54

	Low memory; process clamd (36742) killed	2018-04-05 07:11:26

	Low memory; process clamd (36719) killed	2018-04-05 07:10:59

	Low memory; process clamd (36697) killed	2018-04-05 07:01:18

	Low memory; process clamd (36691) killed	2018-04-05 07:00:57

	Low memory; process clamd (36461) killed	2018-04-05 07:00:35

	Low memory; process clamd (36426) killed	2018-04-05 07:00:11

	Low memory; process clamd (36162) killed	2018-04-05 06:59:50

	Low memory; process clamd (36144) killed	2018-04-05 06:59:27

	Low memory; process clamd (36110) killed	2018-04-05 06:53:17

	Low memory; process clamd (36103) killed	2018-04-05 06:52:57

	Low memory; process clamd (36096) killed	2018-04-05 06:52:36

	Low memory; process clamd (36088) killed	2018-04-05 06:52:17

	Low memory; process clamd (36081) killed	2018-04-05 06:51:59

	Low memory; process clamd (36076) killed	2018-04-05 06:51:41

	Low memory; process clamd (36066) killed	2018-04-05 06:51:26

	Low memory; process clamd (35793) killed	2018-04-05 06:50:59

	Low memory; process clamd (35769) killed	2018-04-05 06:48:55

	Low memory; process clamd (35748) killed	2018-04-05 06:42:22

	Low memory; process clamd (35741) killed	2018-04-05 06:41:59

	Low memory; process clamd (35733) killed	2018-04-05 06:41:38

	Low memory; process clamd (35726) killed	2018-04-05 06:41:18

	Low memory; process clamd (35407) killed	2018-04-05 06:41:00

	User cyrus logged out via runuser-l	2018-04-05 06:40:41

	User cyrus logged in via runuser-l	2018-04-05 06:40:39

	Low memory; process clamd (35394) killed	2018-04-05 06:40:35

	Low memory; process clamd (35387) killed	2018-04-05 06:39:14

	Low memory; process clamd (35134) killed	2018-04-05 06:38:45

	Low memory; process clamd (35108) killed	2018-04-05 06:38:17

	Low memory; process clamd (35083) killed	2018-04-05 06:23:39

	Low memory; process clamd (34828) killed	2018-04-05 06:23:22

	Low memory; process clamd (34811) killed	2018-04-05 06:23:02

	Low memory; process clamd (34805) killed	2018-04-05 06:19:38

	Low memory; process clamd (34798) killed	2018-04-05 06:19:21

	Low memory; process clamd (34791) killed	2018-04-05 06:19:03

	Low memory; process clamd (34784) killed	2018-04-05 06:18:42

	Low memory; process clamd (34530) killed	2018-04-05 06:18:24

	Low memory; process clamd (34506) killed	2018-04-05 06:18:02

	Low memory; process clamd (34500) killed	2018-04-05 06:08:47

	Low memory; process clamd (34491) killed	2018-04-05 06:08:25

	Low memory; process clamd (34480) killed	2018-04-05 06:07:58

	Low memory; process clamd (34473) killed	2018-04-05 06:06:06

	Low memory; process clamd (34465) killed	2018-04-05 06:05:48

	Low memory; process clamd (34191) killed	2018-04-05 06:05:27


It does appear to occur when CLAM AV is scanning my system. I do have a largish flexshare folder that has loads of files in it including some ISO files and other fairly heavy duty files so I am wondering if the scaning process is hitting issues trying to scan these very large files and this is triggering the issue.

My server is an HP Proliant Gen8 it has a Celeron CPU and 4GB RAM.
I also noticed in that there is a scan option under Server >> File >> Antimalware File Scanner and that is currently showing

State: Idle
Status: Last scanner run: Unknown
Progress: blank

I edited that and it had 02:00 as the scheduled start time but everything else was not ticked or filled in?
Could this be why I am getting issues?

I have now ticked everything and filled in my email address to be sent alerts on Viruses found and Errors.

In the previous post that I have now closed (https://www.clearos.com/clearfoundation/social/community/getting-hundreds-of-low-memory-process-clamd-nnnnn-killed) Tony Ellis identified a bug report from 2016 on the Debian bug reports site which seemed to be logging the errors like this above and it was claimed that this bug was now fixed but I do seem to be getting very similar issues. Can anyone help identify if this is a current bug in CLAMAV or CLAMD or the way I have my system set up?

I will post my issue on the CLAMD forums.

Siv
notifications ClamAV
In Gateway Antivirus
Thursday, April 05 2018, 09:51 AM
Subscribe via email
Share this post:
Responses (6)

  • Accepted Answer

    Graham Sivilll
    Graham Sivilll
    Offline
    Thursday, April 05 2018, 11:39 AM - #Permalink
    Resolved
    0 votes
    Nick,

    I will save it with the -

    $clam_scan_options = '--exclude="\.(iso)$"';


    version and I will see if that stops this out of memory problem.

    Siv
    The reply is currently minimized Show

  • Accepted Answer

    Nick Howitt
    Nick Howitt
    Offline
    Thursday, April 05 2018, 10:42 AM - #Permalink
    Resolved
    0 votes
    I'm not brilliant at RegEx's but I think both would work.

    My one concern is that I did not think the daily scan would take place if you have not configured it once, but I may be wrong. I have only very recently installed it myself, which is why I saw the documentation needed updating.
    The reply is currently minimized Show

  • Accepted Answer

    Graham Sivilll
    Graham Sivilll
    Offline
    Thursday, April 05 2018, 10:36 AM - #Permalink
    Resolved
    0 votes
    Nick,
    Or should it be:

    $clam_scan_options = '--exclude="\.iso$"';


    Siv
    The reply is currently minimized Show

  • Accepted Answer

    Graham Sivilll
    Graham Sivilll
    Offline
    Thursday, April 05 2018, 10:34 AM - #Permalink
    Resolved
    -1 votes
    Nick,

    I have used your example and have excluded ISO files (I think) so in my /usr/sbin/file_scan file I now have just below the // Defaults section:

    $clam_scan_options = '--exclude="\.(iso)$"';


    Do I have that right?

    Siv
    The reply is currently minimized Show

  • Accepted Answer

    Graham Sivilll
    Graham Sivilll
    Offline
    Thursday, April 05 2018, 10:23 AM - #Permalink
    Resolved
    0 votes
    Nick,
    This is what's in /etc/clearos/file_scan.conf

    quarantine=1
    notify_on_virus=1
    notify_on_error=1
    notify-email=myemail@mydomain

    Mind you, as mentioned in my initial post this may have been different before, as I only just realised there was an entry in "Server" >> "File" >> "Antimalware File Scanner" as I had assumed that the only place where I had CLAM configured was in the Gateway antivirus section of the Dashboard?

    Siv
    The reply is currently minimized Show

  • Accepted Answer

    Nick Howitt
    Nick Howitt
    Offline
    Thursday, April 05 2018, 10:14 AM - #Permalink
    Resolved
    0 votes
    I also posted to you other post and updated the help documentation. ClamAV is not the fastest scanner in the world and I have resorted to excluding certain file types with:
    $clam_scan_options = '--exclude="\.(jpg|jpeg|png)$" --exclude-dir="\/(foscam|shared\/Photos\/)"';
    in my /usr/sbin/file_scan, so excluding photos and the files produced by my various cameras which go in a couple of folders.

    I wonder if it is running out of memory when trying to unpack the iso files before scanning them. It should not as there is a default limit of about 100MB, above which it should not attempt to unpack the archive. What is the contents of your /etc/clearos/file_scan.conf?
    The reply is currently minimized Show
Your Reply