Memory utilization on Content Analysis (CAS) increased after moving from Sophos to ClamAV

Products

• Content Analysis Software
• ISG Content Analysis

Issue/Introduction

CAS was previously configured to use Sophos AV

Sophos AV was disabled and Clam AV was enabled as Sophos is no longer offered as a subscription

After switching to ClamAV, the memory utilization has increased by around 8-10%

 

Environment

Content Analysis using Dual Antivirus

Cause

The increase in memory when using ClamAV is expected. ClamAV antivirus engine simply uses more memory than Sophos. 
It is also  possible that the amount of memory used could further increase after upgrading to CAS 3.2.2 or later, as support for running multiple ClamAV engines simultaneously in CAS will be added starting CAS version 3.2.2

Resolution

With CAS 3.2.1 and later, we now support a Sophos BYOL model, so the customer can purchase a license directly from Sophos if they are interested in continuing to use the Sophos antivirus engine rather than ClamAV.