sophos 3.66 to 3.67, load jumps?

Julian Field mailscanner at ecs.soton.ac.uk
Tue Mar 11 18:56:09 GMT 2003


At 18:34 11/03/2003, you wrote:
>Can someone do a quick test with
>         time sweep -TNEF /dev/null
>with 3.66 and 3.67.

3.66:
real    0m0.620s
user    0m0.610s
sys     0m0.020s

3.67:
real    0m1.578s
user    0m1.550s
sys     0m0.030s

So startup is 2.5 times slower with 3.67 than 3.66.

>Then, with 3.67, try turning off their "new options":
>         time sweep -TNEF -nopt=Pdf -nopt=Elf -nopt=Rtf
>-nopt=Java /dev/null

real    0m2.075s
user    0m2.040s
sys     0m0.030s

3.3 times slower than 3.66, with the options that are supposed to speed it up!

Can people get onto Sophos with these startup timing figures? They are
appalling.

>At 18:13 11/03/2003, you wrote:
>>I just spoke with Sophos about this issue and I am attaching their response.
>>One interesting note about my conversation with the tech support person is
>>that
>>he did not want me to call my issue a "problem with Sophos". He repeatedly
>>said
>>that the performance jump is due to providing "BETTER" protection. I will let
>>you read their repsponse.
>>
>>----- Forwarded message from mark.danus at sophos.com -----
>>     Date: Tue, 11 Mar 2003 12:54:44 -0500
>>  Subject: Unix performance issues
>>       To: marco at muw.edu
>>
>>Version 3.67 of SAV on non-windows platform sees a big jump in engine
>>capabilities. In particular it contains plug-ins enabling thorough scans of
>>four common file types - pdf, rtf, elf (Linux/BSD binaries) and .class
>>(java 'executables').
>>
>>Addition of these plug-ins means that the engine is doing more work to
>>provide better protection.
>>
>>As a result of this some customers may report significant increases in the
>>time taken to scan their file systems. Increases will very according to the
>>number and proportion of the file types mentioned above. The extreme
>>example is scanning a set of files consisting solely of pdfs, rtfs, elf
>>binaries and java files. In this case the scan time increases by a factor
>>of just over 3 (60 minutes -> minutes).
>>
>>If you receive calls from customers complaining of scans taking longer to
>>complete or SAVI applications having to work harder than usual, it is more
>>than likely down to these issues.
>>
>>The important thing to remember is that the slowdown is due to the
>>increased level of protection that we need to provide given the continuing
>>growth in the number of different file types that can carry viruses.
>>
>>It is possible to disable these for options when using sweep by adding the
>>following command-line arguments:
>>
>>-nopt=Pdf
>>-nopt=Elf
>>-nopt=Rtf
>>-nopt=Java
>>
>>don't forget that use of any of these options may seriously impact our
>>ability to detect viruses in those types of file.
>>
>>Regards,
>>
>>MGD
>>
>>
>>----- End forwarded message -----
>>
>>
>>____________________________________________________________
>>     _/     _/  _/    _/  _/     _/ | Marco Obaid
>>    _/_/ _/_/  _/    _/  _/     _/  | Network Administrator
>>   _/  _/ _/  _/    _/  _/  _/ _/   | McDevitt Hall
>>  _/     _/  _/    _/  _/_/ _/_/    | W-Box 1621
>>_/     _/   _/_/_/   _/     _/     | Columbus MS 39701
>>____________________________________________________________
>>M I S S I S S I P P I  U N I V E R S I T Y  F O R  W O M E N
>>
>>_________________________________________________________________
>>This mail is sent through MUW Webmail: http://www.MUW.Edu/webmail
>>For the latest MUW Events, visit  http://www.MUW.Edu/calendar
>
>--
>Julian Field
>www.MailScanner.info
>Professional Support Services at www.MailScanner.biz
>MailScanner thanks transtec Computers for their support

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support



More information about the MailScanner mailing list