Sophos and PDFs again -- and speed

[Jason Balicki]

>That's more like it.
>Now we need to find out why his RH9 system takes 1.9 seconds while other
systems take 8 seconds.
>Has anyone quizzed Sophos on this?

I haven't yet, I'm not (yet) convinced that it's a problem
with Sophos.  I keep getting different results, with quite
a range.  Anywhere from 1 to 9 seconds to just print version
information:

(repeatedly doing time /opt/MailScanner/lib.......)

real    0m1.597s
user    0m1.470s
sys     0m0.120s

real    0m1.415s
user    0m1.370s
sys     0m0.040s

real    0m20.268s
user    0m20.230s    (! What?  I had to ctrl-c this run!)
sys     0m0.020s

real    0m9.893s
user    0m9.330s
sys     0m0.170s

real    0m7.161s
user    0m6.780s
sys     0m0.090s

Granted, this box is in production, and the difference
may simply be that it's in use.  However, this is a
speedy box and our site is relatively low-volume. It
also doesn't make sense because I'm not actually scanning,
I'm only printing version information.  I would expect
to see some variation in timing, but not THAT much.

For comparison, I did this same "test" on my old mail server,
which, thankfully, I haven't reused for another purpose yet
(It's RH 7.3, 1.7Ghz):

real    0m1.704s
user    0m1.660s
sys     0m0.010s

real    0m1.707s
user    0m1.620s
sys     0m0.070s

real    0m1.699s
user    0m1.650s
sys     0m0.050s

real    0m1.810s
user    0m1.710s
sys     0m0.070s

real    0m1.708s
user    0m1.630s
sys     0m0.050s

So, relatively consistent.  Of course, again, this box is NOT
in production, so it's not scanning mail.

I want to do some more experimentation to narrow down the culprit,
which theoretically should be quite easy, since my mail servers
run in a chroot env -- I should be able to copy the environment in
place and start making changes.  I plan on:  1) upgrading the
old 7.3 box from Sophos 3.79 to 3.80, 2) downgrading the RHEL
3.0 box from Sophos 3.80 to 3.79 (and possibly earlier) and
run some speed tests.  Does anyone else have any suggestions
on tests to run?  I'm going to unplug the network cable and
run those tests to see if it changes the run times, but I'm
also going to wait for a time of day where my users won't
complain.  Wait a minute, that time of day is imaginary,
I forgot... :)

One more thing: running ldd on the 3.79 and 3.80 sweep binaries
produces identical results, so the new version isn't expecting
any new libs or anything.  It only relies on its own libs and
libc.  If there's a problem, it may be either in the sweep
binary itself, or in libc (which I find unlikely, but stranger
things have happened.)

--J(K)