sophos 3.66 to 3.67, load jumps?

Jeff A. Earickson jaearick at COLBY.EDU
Tue Mar 11 19:35:07 GMT 2003


Julian,

   Here is what I got on my busy E220R, solaris 8.  I reinstalled
3.66 into a seperate directory, downloaded the current ide defs,
set the SAV_IDE and LD_LIBRARY_PATH variables accordingly, etc,
before running this test.

3.66:  timex ./sweep -TNEF /dev/null
----
real        3.63
user        1.60
sys         0.10

3.67: timex ./sweep -TNEF /dev/null
----
real        7.32
user        3.59
sys         0.10

3.67: timex ./sweep -TNEF -nopt=Pdf -nopt=Elf -nopt=Rtf -nopt=Java /dev/null
----
real       10.08
user        3.99
sys         0.18

I'm glad that our PC person still had the 3.66 CD, so I could
get 3.66 back.  This performance degradation is unacceptable
and I'll tell Sophos that in my email to them.  I'm rolling
back to 3.66 for the time being.

-----------------------------------
Jeff A. Earickson, Ph.D
Senior UNIX Sysadmin and Email Guru
Information Technology Services
Colby College, 4214 Mayflower Hill,
Waterville ME, 04901-8842
phone: 207-872-3659 (fax = 3076)
-----------------------------------

On Tue, 11 Mar 2003, Julian Field wrote:

> Date: Tue, 11 Mar 2003 18:56:09 +0000
> From: Julian Field <mailscanner at ECS.SOTON.AC.UK>
> Reply-To: MailScanner mailing list <MAILSCANNER at JISCMAIL.AC.UK>
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: Re: sophos 3.66 to 3.67, load jumps?
>
> At 18:34 11/03/2003, you wrote:
> >Can someone do a quick test with
> >         time sweep -TNEF /dev/null
> >with 3.66 and 3.67.
>
> 3.66:
> real    0m0.620s
> user    0m0.610s
> sys     0m0.020s
>
> 3.67:
> real    0m1.578s
> user    0m1.550s
> sys     0m0.030s
>
> So startup is 2.5 times slower with 3.67 than 3.66.
>
> >Then, with 3.67, try turning off their "new options":
> >         time sweep -TNEF -nopt=Pdf -nopt=Elf -nopt=Rtf
> >-nopt=Java /dev/null
>
> real    0m2.075s
> user    0m2.040s
> sys     0m0.030s
>
> 3.3 times slower than 3.66, with the options that are supposed to speed it up!
>
> Can people get onto Sophos with these startup timing figures? They are
> appalling.
>
> >At 18:13 11/03/2003, you wrote:
> >>I just spoke with Sophos about this issue and I am attaching their response.
> >>One interesting note about my conversation with the tech support person is
> >>that
> >>he did not want me to call my issue a "problem with Sophos". He repeatedly
> >>said
> >>that the performance jump is due to providing "BETTER" protection. I will let
> >>you read their repsponse.
> >>
> >>----- Forwarded message from mark.danus at sophos.com -----
> >>     Date: Tue, 11 Mar 2003 12:54:44 -0500
> >>  Subject: Unix performance issues
> >>       To: marco at muw.edu
> >>
> >>Version 3.67 of SAV on non-windows platform sees a big jump in engine
> >>capabilities. In particular it contains plug-ins enabling thorough scans of
> >>four common file types - pdf, rtf, elf (Linux/BSD binaries) and .class
> >>(java 'executables').
> >>
> >>Addition of these plug-ins means that the engine is doing more work to
> >>provide better protection.
> >>
> >>As a result of this some customers may report significant increases in the
> >>time taken to scan their file systems. Increases will very according to the
> >>number and proportion of the file types mentioned above. The extreme
> >>example is scanning a set of files consisting solely of pdfs, rtfs, elf
> >>binaries and java files. In this case the scan time increases by a factor
> >>of just over 3 (60 minutes -> minutes).
> >>
> >>If you receive calls from customers complaining of scans taking longer to
> >>complete or SAVI applications having to work harder than usual, it is more
> >>than likely down to these issues.
> >>
> >>The important thing to remember is that the slowdown is due to the
> >>increased level of protection that we need to provide given the continuing
> >>growth in the number of different file types that can carry viruses.
> >>
> >>It is possible to disable these for options when using sweep by adding the
> >>following command-line arguments:
> >>
> >>-nopt=Pdf
> >>-nopt=Elf
> >>-nopt=Rtf
> >>-nopt=Java
> >>
> >>don't forget that use of any of these options may seriously impact our
> >>ability to detect viruses in those types of file.
> >>
> >>Regards,
> >>
> >>MGD
> >>
> >>
> >>----- End forwarded message -----
> >>
> >>
> >>____________________________________________________________
> >>     _/     _/  _/    _/  _/     _/ | Marco Obaid
> >>    _/_/ _/_/  _/    _/  _/     _/  | Network Administrator
> >>   _/  _/ _/  _/    _/  _/  _/ _/   | McDevitt Hall
> >>  _/     _/  _/    _/  _/_/ _/_/    | W-Box 1621
> >>_/     _/   _/_/_/   _/     _/     | Columbus MS 39701
> >>____________________________________________________________
> >>M I S S I S S I P P I  U N I V E R S I T Y  F O R  W O M E N
> >>
> >>_________________________________________________________________
> >>This mail is sent through MUW Webmail: http://www.MUW.Edu/webmail
> >>For the latest MUW Events, visit  http://www.MUW.Edu/calendar
> >
> >--
> >Julian Field
> >www.MailScanner.info
> >Professional Support Services at www.MailScanner.biz
> >MailScanner thanks transtec Computers for their support
>
> --
> Julian Field
> www.MailScanner.info
> Professional Support Services at www.MailScanner.biz
> MailScanner thanks transtec Computers for their support
>



More information about the MailScanner mailing list