Best way to run ClamAV???

[Rick Cooper]

> -----Original Message-----
> From: mailscanner-bounces at lists.mailscanner.info 
> [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf 
> Of Matt Kettler
> Sent: Monday, June 04, 2007 5:45 PM
> To: MailScanner discussion
> Subject: Re: Best way to run ClamAV???
> 
[..]
> clamd: less expensive than clamscan CPU-wise, but needs clamd 
> running and is
> relatively new code. This causes MailScanner to connect to 
> clamd's socket and
> use that for scanning. Since clamd is already resident, 
> there's no need to
> re-read signatures. Since it's using clamd, which comes with 
> clamav, there's no
> real version-compatibility problems like with the module, at 
> least in theory.

The only way that a clamd update would hose up the MailScanner clamd
function would be if the developers changed the clamd protocol which hasn't
happened in a long, long (can't remember when) time. They did add the thread
support recently but didn't change anything so had MailScanner supported
clamd daemon then you would have never noticed. The actual libclamav
internals have changed a few times and that requires clamavmodule to be
updated or it breaks.

Also note that using the clamd daemon reduces MailScanner's memory footprint
a fair amount. This is one of the main reasons I decided to look into
supporting clamd daemon. Check below for my test system... Really want to
see something interesting note the section that includs removing the perl
SpamAssassin code and using the spamd daemon instead

With ClamAVModule

31799 exim      15   0 17612  17M 13860 S     0.0  1.7   0:00 MailScanner
31800 exim      15   0 83612  81M 15324 S     0.0  8.1   0:37 MailScanner
31803 exim      25   0 19636  19M 15636 S     0.0  1.9   0:00 MailScanner
31807 exim      15   0 83612  81M 13796 S     0.0  8.1   0:37 MailScanner
31820 exim      15   0 83608  81M 13796 S     0.0  8.1   0:38 MailScanner

             total       used       free     shared    buffers     cached
Mem:           999        923         76          0         34        152
-/+ buffers/cache:        736        263


Without ClamAVModule

32310 exim      15   0 17612  17M 13848 S     0.0  1.7   0:00 MailScanner
32311 exim      15   0 54792  53M 15008 S     0.0  5.3   0:05 MailScanner
32315 exim      24   0 19636  19M 15656 S     0.0  1.9   0:00 MailScanner
32321 exim      15   0 54792  53M 13448 S     0.0  5.3   0:05 MailScanner
32328 exim      15   0 54792  53M 13448 S     0.0  5.3   0:05 MailScanner

             total       used       free     shared    buffers     cached
Mem:           999        841        158          0         35        152
-/+ buffers/cache:        653        346




Without ClamAVModule and Without Perl SpamAssassin

32547 exim      15   0 18908  18M 16284 S     0.0  1.8   0:00 MailScanner
32552 exim      25   0 19636  19M 16204 S     0.0  1.9   0:00 MailScanner
32612 exim      15   0 18908  18M 14184 S     0.0  1.8   0:00 MailScanner
32626 exim      15   0 18908  18M 14184 S     0.0  1.8   0:00 MailScanner

             total       used       free     shared    buffers     cached
Mem:           999        733        266          0         36        152
-/+ buffers/cache:        545        454



--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.