sophos 3.67 and wrapper script

[Willem Kuiters]

On Mon, Mar 17, 2003 at 09:58:17PM +0100, Willem Kuiters wrote:
> > Their new engine is appallingly slow to start up, and the more people that
> > complain about it, the greater chance of them actually fixing it.
>
> Many thanks, that solved it. I installed the XRS version and your new
> scripts. I'll write a complaint about the performance problems of the
> 3.67 engine now.

Here is their reply:

Willem.

The reason for the slow down in performance is the increased detection
rates for certain files.. if you wish to turn this off then please look at
eth following document...

This message is about slow-downs in scan speeds that may be reported with
SAV v3.67 on Unix platforms.

Version 3.67 of Sophos Anti-Virus on non-Windows platform sees a big jump
in engine capabilities. In particular it contains plug-ins enabling
thorough scans of four common file types - pdf, rtf, elf (Linux/BSD
binaries) and .class (java 'executables').

The addition of these plug-ins means that the engine is doing more work to
provide better protection.

As a result of this some customers may report significant increases in the
time taken to scan their filesystems. Increases will vary according to the
number and proportion of the file types mentioned above. The extreme
example is scanning a set of files consisting solely of pdfs, rtfs, elf
binaries and java files. In this case the scan time increases by a factor
of just over 3 (60 minutes -> 195 minutes).

The important thing to remember is that the slowdown is due to the
increased level of protection that we need to provide given the continuing
growth in the number of different file types that can carry viruses.

It is possible to disable these four options when using sweep by adding the
following command-line arguments:

  -nopt=Pdf
  -nopt=Elf
  -nopt=Rtf
  -nopt=Java

Don't forget that use of any of these options may seriously impact our
ability to detect viruses in those types of file.

Part of the speed reduction appears to be due to the internationalisation
that was also introduced in v3.67. We are looking into that and other areas
of concern and hope to be able to offer some performance improvements
without compromising security in the coming months.

Stephen Higgins

Technical Support Engineer