Upgrade to clamav 0.90.2 makes scanning extremely slow
rich at mail.wvnet.edu
Fri Apr 27 16:12:50 IST 2007
Glenn Steen wrote:
> On 27/04/07, Richard Lynch <rich at mail.wvnet.edu> wrote:
>> Out of curiosity I decided to do a little testing of the performance of
>> the three ClamAV methods: clamscan, clamdscan, and clamavmodule. This
>> is not meant to be a full blown scientific test, merely a quick "rough
>> idea" measurement.
>> I have a directory with over 300 virus infected files in it. Running
>> the three methods shows...
>> clamscan: 11.68 seconds
>> clamdscan: 6.56 seconds
>> clamavmodule: 4.50 seconds
>> Results for clamscan and clamdscan we obtained using the "time"
>> command. Results for clamavmodule were obtained using the perl
>> Time::HiRes module. I had to use that to avoid adding in the time for
>> the initial database load.
>> This is pretty much what I expected. Clamavmodle is the quickest since
>> it doesn't have to load the database on every scan and it calls the
>> ClamAV libraries directly. Clamdscan is next since it doesn't have to
>> load the DB every time but it does have the overhead of the
>> communications with the clamd process. And clamscan is slowest (by a
> Don't forget the additional fork/exec bit either... Every cycle
>> significant margin) since it has to load the database on every batch.
>> So, performance wise, clamavmodule is the best. However, it does have
>> the problem with being kept up to date with ClamAV changes. Clamdscan
>> is a little slower but avoids the problem with development changes in
> Yes, byt basically you are showing that Jules is right that there is
> no real big performance reason to implement clamdscan in MS... Then
> again, if enough people want it, he'll likely add it just to keep 'em
> quiet:-):-). ... Once he's well enough, of course.
Yes, Jules is correct from a performance perspective. The issue then
becomes clamavmodule being kept up to date. The question is... "Is the
loss in performance worth the benefit of not being dependent on a third
party package???". I can't answer that. It depends!
From my perspective, clamscan is only worthwhile for low volume
setups. For high volume situations only clamdscan or clamavmodule can
keep up. My 2c.
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 296 bytes
Desc: not available
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20070427/45fe0fa8/rich.vcf
More information about the MailScanner