How much CPU resource takes ClamAV ?

Question

I deal with an interesting issue on a newly set up xServe G5 2.0 GHz, 1 GB RAM:
When enabling virus filtering, the CPU performance goes down, or should I better say "up" to a usage rate between typically 70 % and 90+%.
Running command "top" at terminal reveals that it is the ClamAV process taking all that resources.
I cannot imagine that this is normal behavior. So maybe someone has advice how I can keep enable virus checking but not dealing with performance issues (there is currently just one single testing website and low web traffic only).
My first idea was that unless SpamAssassin filters mails more accurate (it is currently learning - we run it now effectively since about one day), all incoming mail gets checked against viruses.
But in my mind even this should not take over 80% of the CPU. On our old server we had around 500 incoming mails per day, where 90 % were considered spam.

Answer 1

(1) "mails intended for one our domains we host"
(2) "mails that going to one of our domains, but to
an non-existing inbox"
(3) "mail abusers trying to use the SMTP as a open
relay"
I sometimes feel that the virus checks are done for
each mail type, also for (2) and (3).
You are correct. On a default installation all mail will be checked.
This can be optimized, but requires command line interaction.
For example:
(2) can be avoided by using postfix style virtual aliases and following my tutorial about rejecting mail for unknow users before the content filter (http://osx.topicdesk.com/downloads/)
(3) can be optimized by adding better smtpdclientrestrictions and smtpdrecipientrestrictions (see: http://www.postfix.org/postconf.5.html)
So for example my mail queue is full of entries that
have recipients never on my server (domains/e-mail
addresses).
If these are in your queue and you are not an open relay then your server or a client have been compromised from the inside. Either by a script or code injection or whatever... Could even have happened before you "locked down" your server. If you delete your queue and it happens again, you have an "internal" problem.
However since my "open-smtp-relay" tests I performed
on various websites found on the Web lead me that my
server isn't an open SMTP relay. You may try it for
yourself - sent mails via starenterprise.com or its
IP 194.77.100.91 - it hopefully should decline
Yes, your server is not an open relay. Which still doesn't mean that a script or compromised client from inside your network can't send rogue mail.
What are your experiences ? How does ClamAV perform
ClamAV performs very well. On a high volume system I'd use clamd, otherwise clamscan is fine.
To give you an idea. One of my clients runs a mail server on a PowerMac G4 500MHz DP with 1GB of RAM. Not particularly fancy software. Today it processed 18'000 emails, rejected 7000 spam mails, rejected 1000 virus mails, and about 1000 unknown recipients. Once a week they send a newsletter to their subscribers, where the server averages about 3000 messages/minute. Still, the CPU is bored stiff.
As a general word of advice and no offense meant: You seem to be tackling too many things at once. Try and solve your issues step by step. Next think about your priorities and do one change after the other.
HTH,
Alex