ClamAV eating up all available disk space

Question

Today I found that my Redhat server has run out of hard disk space. The culprit seems to be a program called Clamav that fills /tmp directory with thousands of subfolders with names like clamav-004adb870cd79534. All these folders contain this:

    drwx------   2 root root 4.0K Apr 21 07:56 .
    drwxrwxrwt  68 root root  64K Apr 21 08:03 ..
    -rw-------   1 root root  18K Apr 21 07:56 COPYING
    -rw-------   1 root root 4.6M Apr 21 07:56 main.db
    -rw-------   1 root root  14K Apr 21 07:56 main.fp
    -rw-------   1 root root 1.5M Apr 21 07:56 main.hdb
    -rw-------   1 root root  901 Apr 21 07:56 main.info
    -rw-------   1 root root  33M Apr 21 07:56 main.mdb
    -rw-------   1 root root  16M Apr 21 07:56 main.ndb
    -rw-------   1 root root  217 Apr 21 07:56 main.zmd

When I deleted them they got back and filled my hard drive in about an hour again.

How do I go about this? Can I safely stop Clamav? It seems to me that Clamav is trying to upgrade unsuccessfully.

UPDATE: I was able to sort this out after reading this topic: http://forums.theplanet.com/index.php?showtopic=92267

I opened /etc/MailScanner/MailScanner.conf and commented out the following line:

Virus Scanners = clamavmodule

Then restarted MailScanner:

/sbin/service MailScanner restart

Solution 1

You can limit disk usage of the temporary files when running clamscan, by using the --max-space flag like this

clamscan --max-space=50m --tempdir=/tmp/ --infected --recursive /home/

Solution 2

You may want to check on the version of your ClamAV. Recently they stopped providing updated db files to version 0.94, so when your freshclam (the part that updates the definitions db) goes to download the update, instead of the expected result, if receives the error message, which may not play well with your freshclam and it tries to re-download the updates over and over again.