How to decrease clam's scan frequncy

[ajax20]

Hi

I have installed clamav for custombuild 1 through this tutorial. I know that clam is used to scan emails but one thing I noticed is that it hourly scans things. And I have noticed that each hour it reads about 300 mb amounting to about 3.5 gb. I don't have any ideas what it is that clam reads or scans, but I would like to, at least, reduce clam's scan frequency, so that I can decrease the disk IO and waste of server resources including the CPU load.

By the way, I have not made any clamscan_hourly crons, so it is not related to that.

Regards

 

[Richard G]

You have the check the /etc/freshclam.conf file.
Edit the file and find this:

# Number of database checks per day.
# Default: 12 (every two hours)
#Checks 12

Remove the comment (#) before "Checks" and change 12 to the value you like.
Don't forget to restart freshclam afterwards.

 

[ajax20]

You have the check the /etc/freshclam.conf file.
Edit the file and find this:

# Number of database checks per day.
# Default: 12 (every two hours)
#Checks 12

Remove the comment (#) before "Checks" and change 12 to the value you like.
Don't forget to restart freshclam afterwards.

Hi Richard. Thanks for responding.
But the process I'm referring to is not freshclam. As I mentioned it's clam itself.

Any ideas how I need to adjust that?

Regards

 

[Richard G]

Hello ajax20.

I would suggest to try my solution.
Freshclam is not scanning itself but sends the command to clamav to start scanning.
So if you make the adjustments like I said, you will see that clamav will only do scans the amount of times you specified in freshclam.conf.

 

[ajax20]

Alright. Thanks. I'll try that.

 

[nobaloney]

Freshclam is not scanning itself but sends the command to clamav to start scanning.

Are you sure, Richard? My understanding was that FreshClam merely updates databases with new AntiVirus signatures, but has nothing to do with scanning.

The man file may bear me out; it reads:

freshclam is a virus database update tool for ClamAV.

Am I missing something? Or have I been wrong all these years?

Jeff

 

[Richard G]

My explanation was indeed wrong Jeff, sorry.

But if you install clamav like the tutorial ajax20 used, there will be no automatic scanning installed. You need a cronjob for that.
However.... the 2 hourly updates of freshclam can give a peak load on the servers. They disturbed my serves so badly that I set the update proces to twice a day and the problems were gone.
So my explanation is wrong, but I really believe the solution is correct.

It would be nice if ajax20 could confirm this, or let us know the solution did not work.
If it did not work, he must have made a cronjob manually to have clamav do an automatic scan, but he said he didn't. Is clamscan scanning hundreds MB's of mail hourly? I doubt it.

 

[nobaloney]

Is clamscan scanning hundreds MB's of mail hourly? I doubt it.

Now you've got me confused again, Richard.

Email should only be scanned by ClamAV (clamd) as it comes in; it shouldn't need to ever be scanned again.

I admit I didn't read the tutorial. I just use the default ClamAV installation for DirectAdmin, and I use maldet to check my servers for malware elsewhere.

Jeff

 

[Richard G]

I'm sorry to confuse you Jeff.. My comment about scanning hundred's of mail hourly, was the question I asked myself upon the statement of Ajax20 (the TS):

nd I have noticed that each hour it reads about 300 mb amounting to about 3.5 gb.

Clamav does not have a scan cronjob by default, it just scans mails as it comes in like you say.

Does that clarify things for you?

 

[nobaloney]

Yes, Richard; that was always my understanding and I'm glad to have it verified by you.

Jeff

 

[ajax20]

Hello everyone

Sorry for this late reply. I was really busy and could not examine freshclam scans. Now, I made changes in

/etc/freshclam.conf

which resulted in

# Number of database checks per day.
# Default: 12 (every two hours)
Checks 24

So I expected the scans to happen every 4 hours. Instead I still have the hourly freshclam scans. The following is an example:

USER        DISK READ      DISK WRITE      SWAPIN        IO>           COMMAND                                                                                                             
clamav      141.00 M        4.00 K        0.00 %          0.37 %      freshclam -d

And in each scan I have about 200mb of disk read and some disk write as well. The disk write ranges from a few kilobytes to about 200mb. I also have the clamd process which has about 300mb of disk read in each hourly scan.

Does any one know how I can reduce the number of freshclam scans as the above strategy does not help.

Regards

 

[Richard G]

So I expected the scans to happen every 4 hours. Instead I still have the hourly freshclam scans. The following is an example:

Wrong expectation. If you set Checks to 24, the checks will be done every hour, because it's "checks per day" so 24 checks per day is 1 check every hour. So you increased the checks instead of decreased them.
If you want the checks to be done every 4 hours, you will need to set it like this:

Checks 6

which will generate 6 checks per day (= every 4 hours).

Unfortunately I don't know why the clamd scans are reading every hour. Or could it be you have a malware scanner (Maldetect) every hour?
Because clamd does not scan by default.

 

[ajax20]

Wrong expectation. If you set Checks to 24, the checks will be done every hour, because it's "checks per day" so 24 checks per day is 1 check every hour. So you increased the checks instead of decreased them.
If you want the checks to be done every 4 hours, you will need to set it like this:

Checks 6

which will generate 6 checks per day (= every 4 hours).

Unfortunately I don't know why the clamd scans are reading every hour. Or could it be you have a malware scanner (Maldetect) every hour?
Because clamd does not scan by default.

Hello Richard

Thank you very much for replying. I had taken the whole thing wrongly. I changed it now to 6.
Thanks again.

Regards