[ SOLVED ] Freshclam AV suddenly using 50-80% CPU

[maciaccio]

I realized that I may not have installed the GUI for ClamAV, which is why it was not in the Whisker menu. I thought I had selected the GUI, but maybe the install didn't get that far because of the missing config file error msg.

I also realized that programs that run only from Terminal / command line show up with the gears icon if you search for it on Menu, but nothing will happen if you try to run it from there.

I also remembered that I put the 2nd hard drive - with my Data, NTFS, and 2nd Swap partition - back in the laptop last thing the night before...I had temporarily put it in a 2nd identical laptop I bought for parts/repair, just so it could boot to Linux Live to run some diagnostics. When booting back up with the drive in place, ClamAV may have been running a scan on it...but not on 2nd reboot, which may be why it seemed to be fixed. Just a guess.

Anyway, I've got Sophos now...not feeling like changing it again after the lengthy install process...using about 25% of RAM, but hey, what do you expect from a live anti-virus program on a 10-year old laptop with 2Gb RAM?

I'm protected and have my Samba shares all set up. Kodi can now see my media server folders and streams movies much better than the Plex Web Player. I'm good!

Thanks!

[bitsnpcs]

Hello maciaccio,

Jerry is working on a very nice ClamAv interface, you can follow updates and progress on this here -
https://www.linuxliteos.com/forums/on-topic/simple-to-use-anti-virus-frontend-for-linux/

[tomt]

Sorry. Glad you got it all sorted. Sometimes it`s the obvious we overlook. The only app using high resources on mine is Pulse Audio Control. Cheers.

[tomt]

Sorry. Glad you got it all sorted. Sometimes it`s the obvious we overlook. The only app using high resources on mine is Pulse Audio Control. Cheers.

[tomt]

Sorry. Glad you got it sorted. Sometimes it`s the obvious we overlook. The app using high resources on mine is Pulse Audio Control. Cheers.

[newtusmaximus]

For me, Sophos seems to be using more memory - circa 50% total.  However it is continually running in the background - screening  etc. so that is not surprising.    Needs care setting up  and did report for me one false positive  in the LL software  (Lite-info) see  forum writeup elsewhere

https://www.linuxliteos.com/forums/security-bug-fixes/sophos-reported-infection-false-positive/msg30913/#msg30913

[tomt]

Sorry. That`s the only suggestion I can offer. Perhaps someone with more knowledge can help.

[maciaccio]

@tomt,  You say Sophos is easy on resources...

My system seems to be using a lot more RAM now - was around 350Mb at start and is now up to 1Gb+/ or 50% with about 46 threads in Htop.

In Htop I see tree view, but not in Task Man

[maciaccio]

This is what I did to completely remove clamav:

Code: [Select]

sudo apt-get purge clamav
sudo apt-get purge clamav-base
sudo apt-get purge clamav-freshcl
sudo apt autoremove
sudo rm -r /var/lib/clamav
Autoremove got rid of two unused lib entries.
The last line removed a lingering folder

[maciaccio]

Okay, will do.

FWIW: A reboot seems to have fixed it, maybe it was just a fluke - "Freshclam -d --foreground=true" process now using 0% CPU in Task Man and temps are back to normal range. But at 0%, is it even doing anything, I wonder?

I have read all about not needing AV in Linux - but I am about to set up Samba shares between 10Gb NTFS data partition on laptop and Windows box, so better safe than sorry with what has been going on in the world of Win viruses lately.

This is a single-core Turion mobile CPU, and it is the bottleneck for the system. So anything to take a load off the CPU will help the whole system run smoother.

Should I run "sudo apt-get purge xxx" of all clamav files?

Here are the entries when I run "dpkg --list"


 

[tomt]

If you decide you want to use sophos after install do an update.
Sudo /opt/sophos-av/bin/savupdate

After update you can run a scan. Simply copy and paste this in your terminal.

sudo savscan -archive -suspicious -pua -remove /

Cheers

[tomt]

Do yourself a favor and use the free sophos. It does not slow my computer down at all and actually prevents unlike Clam maleware. Here is a step by step guide to install

[maciaccio]

I tried to install Freshclam AV last week. At the end of the process, I got an error regarding a config file not found, and it did not seem to finish the install.

Looking for Freshclam AV from the Whisker Menu or App Finder, it does not show, but if I type it into the search box in Whisker Menu, I see a 'gears' icon with 'Run Freshclam' text - but nothing happens when I click on it.

Suddenly today, my CPU is maxed at or near 100% and my CPU is running dangerously hot, around 90-deg C, with laptop placed 12-inches from a window AC. This laptop hits fatal temp at 94-deg C.

Checking 'show all processes' in Task Man shows Freshclam using between 50-80% CPU, but the graph shows solid 100% total CPU usage since startup.

Here is the install log from Freshclam last week - note that this just started today, after two weeks of no CPU issues in LL, and at least one week after Freshclam install attempt.


 



 


Here is the Freshclam Install Log:

mac@HP-dv8000:~$ sudo freshclam
ClamAV update process started at Fri Jun  2 00:53:20 2017
nonblock_connect: connect timing out (30 secs)
Can't connect to port 80 of host db.local.clamav.net (IP: 168.143.19.95)
Trying host db.local.clamav.net (208.72.56.53)...
nonblock_connect: connect timing out (30 secs)
Can't connect to port 80 of host db.local.clamav.net (IP: 208.72.56.53)
Trying host db.local.clamav.net (69.12.162.28)...
Downloading main.cvd [100%]
main.cvd updated (version: 57, sigs: 4218790, f-level: 60, builder: amishhammer)
Downloading daily.cvd [100%]
daily.cvd updated (version: 23439, sigs: 2081810, f-level: 63, builder: neo)
Downloading bytecode.cvd [100%]
bytecode.cvd updated (version: 301, sigs: 58, f-level: 63, builder: anvilleg)
Database updated (6300658 signatures) from db.local.clamav.net (IP: 69.12.162.28)
ERROR: NotifyClamd: Can't find or parse configuration file /etc/clamav/clamd.conf

Thanks in advance...