clamavmodule or clamd ?

[Gareth]

On Tue, 2009-03-31 at 14:43, Rick Cooper wrote:
>  
> > -----Original Message-----
> > From: mailscanner-bounces at lists.mailscanner.info 
> > [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf 
> > Of Denis Beauchemin
> > Sent: Tuesday, March 31, 2009 9:29 AM
> > To: MailScanner discussion
> > Subject: Re: clamavmodule or clamd ?
> > 
> > Eddie Hallahan a écrit :
> > > Hi all,
> > >
> > > We currently run a chunk of servers and am having real 
> > grief with the
> > > perl clamav module.  Our servers currently use clamavmodule in their
> > > scanning.  What would be the issues if we switched to clamd 
> > - i.e. would
> > > this slow things down/speed them up, not make a difference?
> > >
> > > Regards
> > >
> > >   
> > 
> > Eddie,
> > 
> > We switched to clamd a while ago and noticed that MS uses 
> > much less RAM: 
> > each child had its own copy of Clam loaded into RAM with 
> > clamavmodule; 
> > now with clamd, only one instance is running.  It definitely 
> > is not slower!
> > 
> > Be aware, though, that with the external phishing signatures, 
> > clamd has 
> > a tendency to crash some times each day so make sure to 
> > monitor it and 
> > restart it as soon as it dies.  I've heard people are using monit to 
> > this task (http://mmonit.com/monit/).
> > 
> > Denis
> > 
> 
> I have not experienced crashing do to 3d party signatures, ever.
> If you are using a proper D/L script it should be checking the
> Files before moving them into use. I did have a problem with
> The official signatures a while back however.

The problem wasn't due to the download script but was some strange
timing issue shortly after an update was performed. The exact fault
wasn't found since running it within a diagnostic enviroment was enough
to stop the crash from happening.

The change to the memory management in 0.95 appears to have stopped it
crashing for the people who were previously having issues (myself
included) so I would suggest if you do switch to clamd you make sure you
are running 0.95.