Memory Spike / Slowly decrease over time about docker-clamav HOT 3 CLOSED

Huhu @nadar ,

thank you for your question.

First of all I recommend the usage of the official clam-av images provided here -> https://github.com/Cisco-Talos/clamav . I'm participating here and they provide a real good set of clamav-docker-images.

If I analyze your data, I see that clamav needs more RAM at the start of the scan, because:

• clamav needs to check all stuff in the virus signatures database, so the memory is full of all that stuff - always and ever
• after the check of primer stuff, the amount of comparable stuff in the RAM decreases
• if there are new files to check against virus database - the load of RAM raises again, as clamav needs to load all virus definitions again

Do you get it?

At each new circle clamav needs to load all comparable data to RAM to be able to fast identify potential security reasons. They all need to be loaded upfront. After clamav has checked all data for 'example-risk' thread, it will remove that thread from RAM. it is not longer necessary for comparison - so RAM usage decreases.

from docker-clamav.

Short sum up:

clamav analyses all data for the moment with all singatures on each item provided to clamav.

RAM loads every possible threat we know.
clamav test every unit for all threats.
If all items are checked for one special threat, this threat disappears from the RAM - it has been checked.
Ram occupation decreases.

from docker-clamav.

better late then never: thank you for explaining, i guess i understood. I also wanted to switch to the clamav/clamav docker image but it seems they do not provided the option to set all variables via env, like your dockerimage does (which is amazing! because i don't have to build a custom image). Or did i miss something?

i currently have something like this:

- image: mkodockx/docker-clamav:alpine
    name: clamav
    port: 3310
    env:
      - name: "CLAMD_CONF_MaxFileSize"
        value: "256M"
      - name: "CLAMD_CONF_MaxScanSize"
        value: "256M"
      - name: "CLAMD_CONF_StreamMaxLength"
        value: "256M"
      - name: "CLAMD_CONF_ConcurrentDatabaseReload"
        value: "no"

So they thing you did with "CLAMD_CONF_ is amazing, or do you have quick hint how to achieve this task? I was looking at this guide (https://docs.clamav.net/manual/Installing/Docker.html) but could not find anything

from docker-clamav.