sophos 3.67 and wrapper script

[Julian Field]

The basis of the complaint is not that it is much slower to scan files, but
it spends 3 times longer starting up before scanning the first file!

Just get them to do a
         time sweep /dev/null
and they will soon see the difference between 3.66 and 3.67.

The extra "disabling" switches reduce the time to scan each time, but make
the startup time even slower
:-(


At 12:55 18/03/2003, you wrote:
>On Mon, Mar 17, 2003 at 09:58:17PM +0100, Willem Kuiters wrote:
> > > Their new engine is appallingly slow to start up, and the more people
> that
> > > complain about it, the greater chance of them actually fixing it.
> >
> > Many thanks, that solved it. I installed the XRS version and your new
> > scripts. I'll write a complaint about the performance problems of the
> > 3.67 engine now.
>
>Here is their reply:
>
>Willem.
>
>The reason for the slow down in performance is the increased detection
>rates for certain files.. if you wish to turn this off then please look at
>eth following document...
>
>This message is about slow-downs in scan speeds that may be reported with
>SAV v3.67 on Unix platforms.
>
>Version 3.67 of Sophos Anti-Virus on non-Windows platform sees a big jump
>in engine capabilities. In particular it contains plug-ins enabling
>thorough scans of four common file types - pdf, rtf, elf (Linux/BSD
>binaries) and .class (java 'executables').
>
>The addition of these plug-ins means that the engine is doing more work to
>provide better protection.
>
>As a result of this some customers may report significant increases in the
>time taken to scan their filesystems. Increases will vary according to the
>number and proportion of the file types mentioned above. The extreme
>example is scanning a set of files consisting solely of pdfs, rtfs, elf
>binaries and java files. In this case the scan time increases by a factor
>of just over 3 (60 minutes -> 195 minutes).
>
>The important thing to remember is that the slowdown is due to the
>increased level of protection that we need to provide given the continuing
>growth in the number of different file types that can carry viruses.
>
>It is possible to disable these four options when using sweep by adding the
>following command-line arguments:
>
>   -nopt=Pdf
>   -nopt=Elf
>   -nopt=Rtf
>   -nopt=Java
>
>Don't forget that use of any of these options may seriously impact our
>ability to detect viruses in those types of file.
>
>Part of the speed reduction appears to be due to the internationalisation
>that was also introduced in v3.67. We are looking into that and other areas
>of concern and hope to be able to offer some performance improvements
>without compromising security in the coming months.
>
>Stephen Higgins
>
>Technical Support Engineer

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support