[Resolved] clamd is using a lot of CPU

[Hélène]

Hi,

Here's my script "real time" clamav :

Code: Select all

FOLDER=/home
QUARANTINE=/tmp
LOG=$HOME/.clamav-tr.log

while :
do

inotifywait -q -m -r -e  create,modify,move,delete,open,close,access "$FOLDER" --format '%w%f|%e' | sed --unbuffered 's/|.*//g' |

while read FICHIER; do 
        clamdscan --quiet --no-summary -i -m "$FILE" --move=$QUARANTINE
        if [ "$?" == "1" ]; then
		echo "`date` - Malware found in the file '$FILE'. The file has been moved to $QUARANTINE." >> $LOG 
		echo -e "\033[31mMalware found!!!\033[00m" "The file '$FILE' has been moved to quarantine."
		if [ -f /usr/bin/notify-send ]; then
			notify-send -u critical "Real Time ClamAV" "Malware found!!! Le fichier '$FILE' moved to quarantine."
		fi
        fi
done
done

But now clamd is using a lot of CPU. Sometimes it goes up to 82%.
I know that my processor is very bad (AMD Dual-Core Processor E-350). But is anything can be done to reduce CPU and improve overall system performance?
Any idea?

Thanks in advance.

[steve_v]

Here's my script "real time" clamav

I'm resisting a powerful urge to point out the futility of trying to recreate a resource-sucking Windoze-ish virus scanner...

But now clamd is using a lot of CPU.

What did you expect? clamscan is a CPU hog, and you're running it on every single file access.

is anything can be done to reduce CPU and improve overall system performance?

Erm, don't run clamscan all the time? You have identified the cause of the excessive CPU usage already, have you not?

If you want a responsive system, just don't do this. Consider something more useful to protect your GNU/Linux machine, such as rkhunter and good security practices.
If you want to use clamav, scan periodically with cron. Preferably when you're not using the machine.
Here's the Debian security manual for further reading.

[GarryRicketson]

A few years ago I tried "clamd" and "clamav", and the high CPU usage seems to be
a normal effect it has. It was important to run the scans at a time when I was not going to
need to do anything else.
I was just experimenting with it, my conclusion was it is not of any real use, and so I removed it.

But is anything can be done to reduce CPU and improve overall system performance?

After it was removed, my overall system performance improved by about 90 %
After removing all the Gnome things, and installing a WM , the overall performance
was improved 100%, so I have never looked back.

Code: Select all

load averages:  1.54,  1.65,  1.51    garry.org 06:29:53
50 processes: 49 idle, 1 on processor  up  0:59
CPU0 states:  2.0% user,  0.1% nice,  0.5% system,  0.0% interrupt, 97.4% idle
CPU1 states:  2.7% user,  0.1% nice,  0.6% system,  0.0% interrupt, 96.6% idle
Memory: Real: 285M/668M act/tot Free: 2296M Cache: 265M Swap: 0K/3290M
 

[Hélène]

Hello,

OK.
So I disabled my script and it's going better.

Thank you very much.

Bye bye