Clamav

Nowadays database requires about 1GB of RAM.

/etc/clamav/clamd.conf

# Enable non-blocking (multi-threaded/concurrent) database reloads.
# This feature will temporarily load a second scanning engine while scanning
# continues using the first engine. Once loaded, the new engine takes over.
# The old engine is removed as soon as all scans using the old engine have
# completed.
# This feature requires more RAM, so this option is provided in case users are
# willing to block scans during reload in exchange for lower RAM requirements.
# Default: yes
ConcurrentDatabaseReload no
</conf>
 
==== limit systemd service ====
 
Limit RAM to 1GB. Rest will be swapped out.
 
<code bash>
systemctl edit clamav-daemon.service
</code>
 
<file conf  /etc/systemd/system/clamav-daemon.service.d/override.conf>
[Service]
MemoryLimit=1024M
Nice=19
Restart = on-failure

systemctl daemon-reload
systemctl restart clamav-daemon.service