Reducing memory usage: antivirus recommendations

I presume you need to handle incoming e-mail? If not (or if you can outsource this to Gmail or someone), then you have no reason to run AV at all. If you do, the best way to avoid content scanning consuming resources is not to do it.

If you are running Postfix, my personal generic recommendation is to set up configuration options (rejectnonfqdnhelohostname, rejectinvalidhelohostname, rejectnonfqdnsender, rejectunknownsenderdomain, rejectunauthpipelining, rejectnonfqdnrecipient, rejectunknownrecipientdomain, rejectunauthdestination, and rejectunlisted_recipient) first, then greylisting.

If that's not sufficient, next I would use a DNS block list (DNSBL), probably zen.spamhaus.org: make sure you read its terms of use first!

Employing content scanning like ClamAV/Amavis/SpamAssassin would be my last step. The fact that most spam is already dealt with by the other measures should reduce the load by itself.

See this thread for a bit more explanation of the above.

Do a quick google on ClamAV detection rates - and you'll be dropping that useless memory hog in a heartbeat.

Assuming you have anything at all AV-wise running at the client level, you won't be increasing your risk factor at all.

Thanks Vance and vonskippy.

After doing a little bit of research, it looks like clamav isn't that effective, or certainly doesn't give you value for memory!

I think amavis will go too as there's no point of having amavis if you don't have some form of AV.

Oh and to answer your questions, yes, the server is a mail server as well as a web server.

Will continue reading, but thanks again for your input. :)

Just a quick update: I've now removed it and have implemented stronger checks on postfix. I can now run it all on my 1GB Linode and swap file is rather small, so will stick to that for the time being.

Thanks again and happy new year :)

Could we limit the Clamav memory usage?

See man ulimit.

-- sw