sophos 3.66 to 3.67, load jumps?
Jeff A. Earickson
jaearick at COLBY.EDU
Tue Mar 11 19:35:07 GMT 2003
Julian,
Here is what I got on my busy E220R, solaris 8. I reinstalled
3.66 into a seperate directory, downloaded the current ide defs,
set the SAV_IDE and LD_LIBRARY_PATH variables accordingly, etc,
before running this test.
3.66: timex ./sweep -TNEF /dev/null
----
real 3.63
user 1.60
sys 0.10
3.67: timex ./sweep -TNEF /dev/null
----
real 7.32
user 3.59
sys 0.10
3.67: timex ./sweep -TNEF -nopt=Pdf -nopt=Elf -nopt=Rtf -nopt=Java /dev/null
----
real 10.08
user 3.99
sys 0.18
I'm glad that our PC person still had the 3.66 CD, so I could
get 3.66 back. This performance degradation is unacceptable
and I'll tell Sophos that in my email to them. I'm rolling
back to 3.66 for the time being.
-----------------------------------
Jeff A. Earickson, Ph.D
Senior UNIX Sysadmin and Email Guru
Information Technology Services
Colby College, 4214 Mayflower Hill,
Waterville ME, 04901-8842
phone: 207-872-3659 (fax = 3076)
-----------------------------------
On Tue, 11 Mar 2003, Julian Field wrote:
> Date: Tue, 11 Mar 2003 18:56:09 +0000
> From: Julian Field <mailscanner at ECS.SOTON.AC.UK>
> Reply-To: MailScanner mailing list <MAILSCANNER at JISCMAIL.AC.UK>
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: Re: sophos 3.66 to 3.67, load jumps?
>
> At 18:34 11/03/2003, you wrote:
> >Can someone do a quick test with
> > time sweep -TNEF /dev/null
> >with 3.66 and 3.67.
>
> 3.66:
> real 0m0.620s
> user 0m0.610s
> sys 0m0.020s
>
> 3.67:
> real 0m1.578s
> user 0m1.550s
> sys 0m0.030s
>
> So startup is 2.5 times slower with 3.67 than 3.66.
>
> >Then, with 3.67, try turning off their "new options":
> > time sweep -TNEF -nopt=Pdf -nopt=Elf -nopt=Rtf
> >-nopt=Java /dev/null
>
> real 0m2.075s
> user 0m2.040s
> sys 0m0.030s
>
> 3.3 times slower than 3.66, with the options that are supposed to speed it up!
>
> Can people get onto Sophos with these startup timing figures? They are
> appalling.
>
> >At 18:13 11/03/2003, you wrote:
> >>I just spoke with Sophos about this issue and I am attaching their response.
> >>One interesting note about my conversation with the tech support person is
> >>that
> >>he did not want me to call my issue a "problem with Sophos". He repeatedly
> >>said
> >>that the performance jump is due to providing "BETTER" protection. I will let
> >>you read their repsponse.
> >>
> >>----- Forwarded message from mark.danus at sophos.com -----
> >> Date: Tue, 11 Mar 2003 12:54:44 -0500
> >> Subject: Unix performance issues
> >> To: marco at muw.edu
> >>
> >>Version 3.67 of SAV on non-windows platform sees a big jump in engine
> >>capabilities. In particular it contains plug-ins enabling thorough scans of
> >>four common file types - pdf, rtf, elf (Linux/BSD binaries) and .class
> >>(java 'executables').
> >>
> >>Addition of these plug-ins means that the engine is doing more work to
> >>provide better protection.
> >>
> >>As a result of this some customers may report significant increases in the
> >>time taken to scan their file systems. Increases will very according to the
> >>number and proportion of the file types mentioned above. The extreme
> >>example is scanning a set of files consisting solely of pdfs, rtfs, elf
> >>binaries and java files. In this case the scan time increases by a factor
> >>of just over 3 (60 minutes -> minutes).
> >>
> >>If you receive calls from customers complaining of scans taking longer to
> >>complete or SAVI applications having to work harder than usual, it is more
> >>than likely down to these issues.
> >>
> >>The important thing to remember is that the slowdown is due to the
> >>increased level of protection that we need to provide given the continuing
> >>growth in the number of different file types that can carry viruses.
> >>
> >>It is possible to disable these for options when using sweep by adding the
> >>following command-line arguments:
> >>
> >>-nopt=Pdf
> >>-nopt=Elf
> >>-nopt=Rtf
> >>-nopt=Java
> >>
> >>don't forget that use of any of these options may seriously impact our
> >>ability to detect viruses in those types of file.
> >>
> >>Regards,
> >>
> >>MGD
> >>
> >>
> >>----- End forwarded message -----
> >>
> >>
> >>____________________________________________________________
> >> _/ _/ _/ _/ _/ _/ | Marco Obaid
> >> _/_/ _/_/ _/ _/ _/ _/ | Network Administrator
> >> _/ _/ _/ _/ _/ _/ _/ _/ | McDevitt Hall
> >> _/ _/ _/ _/ _/_/ _/_/ | W-Box 1621
> >>_/ _/ _/_/_/ _/ _/ | Columbus MS 39701
> >>____________________________________________________________
> >>M I S S I S S I P P I U N I V E R S I T Y F O R W O M E N
> >>
> >>_________________________________________________________________
> >>This mail is sent through MUW Webmail: http://www.MUW.Edu/webmail
> >>For the latest MUW Events, visit http://www.MUW.Edu/calendar
> >
> >--
> >Julian Field
> >www.MailScanner.info
> >Professional Support Services at www.MailScanner.biz
> >MailScanner thanks transtec Computers for their support
>
> --
> Julian Field
> www.MailScanner.info
> Professional Support Services at www.MailScanner.biz
> MailScanner thanks transtec Computers for their support
>
More information about the MailScanner
mailing list