High ClamScan ...

[Scott Silva]

Rob Poe spake the following on 6/11/2007 12:39 PM:
>>From Top
> 
> 30174 clam      25   0 26352  25M  1100 R    25.9  1.0   0:07   0 clamscan
> 30142 clam      25   0 27044  26M  1100 R    25.5  1.0   0:19   0 clamscan
> 30387 clam      25   0 13936  13M  1096 R    21.1  0.5   0:01   0 clamscan
> 30128 clam      25   0 27488  26M  1100 R    19.9  1.0   0:30   0 clamscan
> 
> load average: 6.86, 4.74, 3.31
> 
> Centos 3.x, Dual Xeon 2.8 /w 2.5 gigs of ram/HP Proliand DL380G3 /w hardware RAID 1 (SCSI 10k drives)
> 
> What gives?
> 
> Is there a better way to do this?  Seems that clamscan is tooo freaking slow any more..
> 
> Another box: 
> 16842 clam      25   0 18260  13m 1204 R   99  0.6   0:29.65 clamscan                                                               
> 17024 clam      25   0 12100 6696 1204 R   92  0.3   0:06.72 clamscan                                                               
> 16884 clam      25   0 19416  12m 1204 R   72  0.6   0:23.79 clamscan                                                               
> 17050 clam      25   0  6808 2276 1044 R   54  0.1   0:01.95 clamscan  
> load average: 5.01, 3.86, 3.43
> Centos 4.x, dual 2.8 xeon, 2g ram, dual SATA on a 3Ware controller
> 
> These aren't slow boxes ..  but Clam is killing them..
> 
Clamscan is the slowest and most ram-intensive scanning method. It has to load
the signatures every batch, and as the signatures get larger, it will only be
worse.

-- 

MailScanner is like deodorant...
You hope everybody uses it, and
you notice quickly if they don't!!!!