High ClamScan ...

[Julian Field]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



Steve Campbell wrote:
>
>
> Julian Field wrote:
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>>
>> Use the clamavmodule or clamd scanners instead.
>> You can install the clamavmodule as part of my ClamAV+SA 
>> easy-to-install package available from www.mailscanner.info.
>> Or else get the clamd RPM from dag.wieers.com, start it up and tell 
>> MailScanner to use the clamd scanner.
>>   
>
> I figured I'd give the clamavmodule a try, and see how it faired. I 
> have always used Julians ClamAV+SA easy-to-install package and up til 
> now, the clamscan stuff.. It is not clear to me, now, though, how to 
> tell if I am really using the Perl module or not.
>
> Are there any hints?
The log entries will have changed. Chuck it a copy of eicar (see 
www.eicar.org) and you'll see different log entries. Also the speed 
should give it away.

>
> Thanks,
>
> Steve
>> Rob Poe wrote:
>>  
>>> >From Top
>>>
>>> 30174 clam      25   0 26352  25M  1100 R    25.9  1.0   0:07   0 
>>> clamscan
>>> 30142 clam      25   0 27044  26M  1100 R    25.5  1.0   0:19   0 
>>> clamscan
>>> 30387 clam      25   0 13936  13M  1096 R    21.1  0.5   0:01   0 
>>> clamscan
>>> 30128 clam      25   0 27488  26M  1100 R    19.9  1.0   0:30   0 
>>> clamscan
>>>
>>> load average: 6.86, 4.74, 3.31
>>>
>>> Centos 3.x, Dual Xeon 2.8 /w 2.5 gigs of ram/HP Proliand DL380G3 /w 
>>> hardware RAID 1 (SCSI 10k drives)
>>>
>>> What gives?
>>>
>>> Is there a better way to do this?  Seems that clamscan is tooo 
>>> freaking slow any more..
>>>
>>> Another box: 16842 clam      25   0 18260  13m 1204 R   99  0.6   
>>> 0:29.65 
>>> clamscan                                                               
>>> 17024 clam      25   0 12100 6696 1204 R   92  0.3   0:06.72 
>>> clamscan                                                               
>>> 16884 clam      25   0 19416  12m 1204 R   72  0.6   0:23.79 
>>> clamscan                                                               
>>> 17050 clam      25   0  6808 2276 1044 R   54  0.1   0:01.95 
>>> clamscan  load average: 5.01, 3.86, 3.43
>>> Centos 4.x, dual 2.8 xeon, 2g ram, dual SATA on a 3Ware controller
>>>
>>> These aren't slow boxes ..  but Clam is killing them..
>>>
>>>
>>>
>>>
>>>
>>>       
>>
>> Jules
>>
>> - -- Julian Field MEng CITP
>> www.MailScanner.info
>> Buy the MailScanner book at www.MailScanner.info/store
>>
>> MailScanner customisation, or any advanced system administration help?
>> Contact me at Jules at Jules.FM
>>
>> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>> For all your IT requirements visit www.transtec.co.uk
>>
>>
>>
>> -----BEGIN PGP SIGNATURE-----
>> Version: PGP Desktop 9.6.1 (Build 1012)
>> Charset: ISO-8859-1
>>
>> wj8DBQFGbakxEfZZRxQVtlQRAsquAJ9FEm1oxMON1iLouPQW/W7DAK2QqwCg+tNp
>> rUuq2j3hIDh9YxjUsOlmhf8=
>> =Dh3L
>> -----END PGP SIGNATURE-----
>>
>>   
>

Jules

- -- 
Julian Field MEng CITP
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

MailScanner customisation, or any advanced system administration help?
Contact me at Jules at Jules.FM

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
For all your IT requirements visit www.transtec.co.uk



-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.6.1 (Build 1012)
Charset: ISO-8859-1

wj8DBQFGba/+EfZZRxQVtlQRAhZFAKD/LQFC1kju0KZXQtEyzLvdgLgmgwCg6Q54
5slWXXzEvXCpvZlFhWbg2wE=
=gejR
-----END PGP SIGNATURE-----

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
For all your IT requirements visit www.transtec.co.uk