Upgrade to clamav 0.90.2 makes scanning extremely slow

[Julian Field]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



Paul Hutchings wrote:
> Newbie talking so feel free to shoot me down in flames :-)
>
> My understanding (from clamscan --debug) is that each time you run clamscan it appears it has to read the virus patterns, unpack them (to /tmp), scan the files, remove the files.
>   
Correct.
> This is the "probably talking out my bum" bit, but that sounds less efficient than clamd where (I assume) the daemon loads the definitions once and each child process doesn't have to do this?
>   
The "clamavmodule" method is more efficient as it just communicates 
directly with the clam function library and doesn't involve any external 
processes at all. The definitions are loaded up once and kept in memory 
by the function library. This is also more reliable as there is no 
external daemon (clamd) which might crash, or leak memory or other 
resources.

The signature files are monitored and if any of them change at all then 
the library is immediately told to re-load the new definitions so it is 
always using up to date signatures.

If you use my latest ClamAV+SA package from www.mailscanner.info, that 
will install everything needed to use the "clamavmodule" method and will 
even do the configuration for you.

I hope that explains it to you :-)

Jules.

> Cheers,
> Paul
>
> Paul Hutchings
> Network Administrator, MIRA Ltd.
> Tel: 44 (0)24 7635 5378
> Fax: 44 (0)24 7635 8378
> mailto:paul.hutchings at mira.co.uk
>
> -----Original Message-----
> From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Scott Silva
> Sent: 24 April 2007 17:09
> To: mailscanner at lists.mailscanner.info
> Subject: Re: Upgrade to clamav 0.90.2 makes scanning extremely slow
>
> Julian Field spake the following on 4/24/2007 8:52 AM:
>   
>> Kapetanakis Giannis wrote:
>>     
>>> On Mon, 23 Apr 2007, Martin wrote:
>>>       
>>>> Arto wrote:
>>>>
>>>>         
>>>>> We had this too. Uninstalling clamav* and installing it again helped.
>>>>>
>>>>> -arto
>>>>>
>>>>>           
>>>> Thanks for all replies. Read about this issue on the clamav-list and 
>>>> hopefully it will be fixed in the next version.
>>>>         
>>> I have similar problems with clamav myself.
>>>       
>>> What I did that improved a little bit
>>> was deleting the virus database in /var/lib/clamav/*
>>> and running freshclam again.
>>>       
>>> Still is very slow. If you try clamscan -debug you will
>>> find out why it is so damn slow....
>>>       
>>> Clamd works fast on the other hand.
>>> Maybe it should be included officialy (clamdscan)
>>> in MailScanner's the next version.
>>>       
>> Why? I already support the "clamavmodule" which is faster than clamd anyway.
>>
>> Jules
>>
>>     
> Are there any tips on commandline diagnostics for the clamavmodule?
> I have a system that has been choking with the module for 2 weeks, and the
> mailscanner.conf fix isn't working with it.
> I am running clamav now, but the load is much higher.
>
> I am going to try the tip of clearing the definitions and re-running freshclam
> to see if that helps.
>   

Jules

- -- 
Julian Field MEng CITP
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

MailScanner customisation, or any advanced system administration help?
Contact me at Jules at Jules.FM

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
For all your IT requirements visit www.transtec.co.uk



-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.6.0 (Build 214)
Charset: UTF-8

wj8DBQFGLyUjEfZZRxQVtlQRAgHmAKDicios1jDH3ARV1ICK/aFwvNhxGQCeLwST
aSDBRADTfsx8XmrCUPCKfIw=
=sWwm
-----END PGP SIGNATURE-----

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
For all your IT requirements visit www.transtec.co.uk