Slow virus scanning

[Julian Field]

Search the directory given in your mailscanner.conf file as
Incoming Work Dir  = /var/spool/MailScanner/incoming
for any "core" files.

I intended to fix that in a previous version, but only noticed on Tuesday
that it had somehow become "$F" instead of the "$f" it was supposed to be,
which stopped the core file deletion code from working properly. Must have
been the keyboard fairies :-)

If you want to fix the code yourself, look in workarea.pl for the word
"core" and you will find a line starting "$F". Change that to "$f" and it
will do something rather more useful...

At 16:23 08/08/2002, you wrote:
>I'm noticing a major slowdown on one of my scanning systems due to slow
>passes through McAfee.  On my dual P3 1.2GHz machine with 1GB of RAM, I
>get the following:
>
>Aug  8 10:03:35 mspiggy1 mailscanner[20400]: Scanned 100 messages,
>2543512 bytes in 120 seconds
>Aug  8 10:06:18 mspiggy1 mailscanner[20400]: Scanned 100 messages,
>6419661 bytes in 155 seconds
>Aug  8 10:06:29 mspiggy1 mailscanner[20400]: Scanned 100 messages,
>1965103 bytes in 6 seconds
>Aug  8 10:06:42 mspiggy1 mailscanner[20400]: Scanned 100 messages,
>848385 bytes in 8 seconds
>Aug  8 10:06:54 mspiggy1 mailscanner[20400]: Scanned 100 messages,
>924177 bytes in 7 seconds
>Aug  8 10:07:06 mspiggy1 mailscanner[20400]: Scanned 100 messages,
>1052457 bytes in 9 seconds
>Aug  8 10:07:21 mspiggy1 mailscanner[20400]: Scanned 100 messages,
>2507492 bytes in 12 seconds
>Aug  8 10:10:26 mspiggy1 mailscanner[20400]: Scanned 100 messages,
>7166859 bytes in 180 seconds
>Aug  8 10:10:38 mspiggy1 mailscanner[20400]: Scanned 100 messages,
>3183740 bytes in 6 seconds
>Aug  8 10:13:18 mspiggy1 mailscanner[20400]: Scanned 100 messages,
>7290147 bytes in 159 seconds
>
>So a big chunk of the messages are taking inordinately long amounts of
>time to scan.  On my second box (dual P3 600MHz with 512MB RAM) all the
>scans are in the 1 to 10 second range.  The systems are both running
>mailscanner 2.31 with identical versions of McAfee and mailscanner.conf.
>Any ideas why my bigger box is moving mail so slow?  I'm ending up with
>1000+ messages waiting to be scanned and even isolating this box from
>the world, it takes 15 minutes or so to fully flush mqueue.in.  I'm
>about to test F-Prot, but thought I'd look for other ideas also.

--
Julian Field                Teaching Systems Manager
jkf at ecs.soton.ac.uk         Dept. of Electronics & Computer Science
Tel. 023 8059 2817          University of Southampton
                             Southampton SO17 1BJ