Hi Everyone

I have been using Clamwin in conjunction with HMailserver.com for approx 16 months now and it has been performing exceptionally well.
It is set to scan all incoming mail on the server. Last month (March) the server handled approx 73,000 incoming emails.

I am currently on version 0.90.1 - HMailserver is 4.3.1.B253 (current also)

I recently noticed that the server was getting very slow and started to investigate.

What i found was the clamscan was sending the CPU useage to 100% and keeping it there.

There are obviously multiple instances of Clamscan running checking the incoming mail.
I assume this has always been the case, but it has never previously affected server performance.

If i remove Clamscan scanning, CPU useage fluxuates at around 1-20%.

I currently have no option other than to remove Clamwin until I can resolve this problem.

Any suggestion on what else to check or look at would be appreciated

TIA, John

clamwin currently doesn't take cpu, clamscan.exe instead burns a lot of cpu,
you can set low priority in clamwin preferences, but it will still uses all the cpu

Hi Sherpya

Sorry, was just typing away and had not realised I had tyed Clamwin in the wrong spots, obviously I did mean Clamscan.
I have corrected it in the original post, thanks.

The thing that surprises me is that it has never been an issue in the past, so has something changed?

hmm no changes on this side, the scanner is cpu intensive, it can be lowered only by setting priority, but it will take as much of cpu it can take
there are no way to lower cpu by itself except implementing a "self-lowerer" but it's useless since it can be run with different priority
if you use clamscan directly you can use start /wait /BELOWNORMAL clamscan.exe bla bla bla

You've noticed a difference in performance between versions?

How busy is your mail server? Launching any process multiple times per second is going to do ugly things to performance. That is ignoring the fact that "scanning" is also intensive. On the *nix side, this is addressed some what via "clamd," but that hasn't been ported to windows.

There may be some clamscan scanning options enabled by default which you don't need and could disable with extra command line parameters, or also setting a maximum size of messages that are passed to clamscan in your mail daemon, if that option is available.

Hi B0ne

Thanks for the reply ...

As mentioned in my first post, I have been using Clamscan for about 16 months and
it has only been in recent months that I have noticed any performance issues with the server.

Last month we delivered 73,000 messages (rejected at least twice that number as SPAM)

The number of messages has grown since day one, however, not that dramatically.

Will check further on the file size , but I don't think that is an option. I will also checkout the
command line options.

Unforunately, I still have Clamwin turned off at the moment, until I can resolve this or find
another solution to the problem.

Again, thanks for thaking the time to respond, it is appreciated.

I don't know if I can help, but have you recently upgraded ClamWin? If so (and even if not), are your configuration settings the way you want them?

Anyway, check this out--it might give you some ideas: http://search.techrepublic.com.com/search/antivirus+and+microsoft+windows+and+server+and+software.html.

Regards,

Thanks GuitarBob, will check it out

Hi, I write here juste because I met the same problems (while "reading" the incoming or standing emails in Microsoft Outlook, Clams scan takes 100% of the CPU) BUT I have no servers at all... and I had not such a problem before...

Honestly, even with the previous update of ClamWin (now I have the 0.90.1.1) the ClamScan process slowed down evreything but now it really paralyzes my pc for many seconds on each email....

Hi Everyone

Forstly thanks for the responses.

I found myself in a bind with this issue, I needed virus protection, however using this version of Clamwin slowed the server down to unacceptable levels so I had to turn off virus scanning.

As I stated earlier, this is a HMailserver installation running on a 2003 server box, twin xeons, stacks of everything - it checks ALL incoming mail only.

After much reading and a lot of luck I managed to overcome my problem by installing a windows version of ClamAV and clamd (yes it does exist)
CPU useage, even at peak times only runs between 40-50%

So my problem is solved, unfortunately, I am not running CLamwin anymore.

Again, thanks for the replies and help

Kind regards

John

JohnB,

I discovered this same problem with ClamWin version 0.90.1.1. I rolled back to 0.90.1 on my mail server and the problem went away. So there is some difference in 0.90.1.1 that is causing ClamScan to spike the CPU to 100% for 20+ seconds.

--Kenn

Thanks Ken

Will post this info on the mailserver forum as well.

Also noted from a recent post there - "An unistall of Clamwin and Re-install seems to have fixed the problem"

Clamav is still performing well for me though

Thanks for passing on that info. I'll give it a try and see what happens.

--Kenn

Tested and confirmed. Completely uninstalling ClamWin before installing 0.90.1.1 resolves the problem.

--Kenn

I uninstalled 90.1.1 restarted my server then reinstalled it. And it still stays at 100% whenever it scans an email...granted it's not holding at 100% for 20seconds or anything but if i have emails in que it will sit and scan at 100% until the que empties. Which can take an hour depending on how much email is coming through.
This is totally unnaceptable. And seems to be a bug that ClamWin needs to address asap.

ALSO: i tried version .90.1 and it did the same thing.