Clamd Daemon Scanning Patches

[Glenn Steen]

On 31/05/07, Rick Cooper <rcooper at dwford.com> wrote:
>
>
> > -----Original Message-----
> > From: mailscanner-bounces at lists.mailscanner.info
> > [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf
> > Of Glenn Steen
> > Sent: Wednesday, May 30, 2007 5:01 PM
> > To: MailScanner discussion
> > Subject: Re: Clamd Daemon Scanning Patches
> >
(snip)
> > > I am not using the threaded daemon model (MULTISCAN) but a
> > config parameter
> > > such as "Clamd Use Threads" could be added so clamd can
> > take advantage of
> > > threading on SMP hosts.
> >
> > Should work. How far away is Config Option Number 400, Jules?:-)
> >
>
> I don't know how helpful this option is as I don't have a SMP host to test
> on and I kept to the per file scanning model, although the tests I did
> didn't have an appreciable difference between scanning entire dir verses one
> file at a time since the connection to the daemon is open anyway.
>
Makes sense.
The question is whether a "normal" MailScanner batch will be large
enough for the threading to have any appreciable effect at all. I
don't have any SMP host available for that type of test either
though:-(.

>
> > Awesome stuff, can't wait to see it in a new beta (Yeah, I'm feeling
> > lazy today:-).
> > When you tested this Rick, did you notice how this affected startup
> > time of MS compared to clamavmodule? I boticed that using clamavmodule
> > adds a hefty time for reading in the signatures... (rather irritating
> > while debugging that p-record patch ... start debug, wait a couple of
> > minutes, see some errors whizz by, fiddle with code, redo...
> > sigh.:-)... Yeah, not that important, I know...:)
> >
>
> Didn't really time it but bear in mind MS doesn't load anything. It simply
> makes the socket (UNIX/TCP) connection and asks the daemon to scan something
> when required (no persistent connection). If you already use clamd then
> there is no impact on resources (no signatures loaded, etc). And it appears
> to be at least as fast as clamavmodule but I didn't do any high resolution
> timing or huge file, huge number of files. What ever overhead there is
> involved with clamavmodule is gone, including checking for changed files,
> loading DBs, etc. and the system overhead of clamdscan is also gone. Now of
> course you have to set some options in the clamd.conf that were set in
> MailScanner, such as flagging password protected files as viruses.

Exactly. Should be a pleasant experience to use:-)... i don't see any
huge problem (other than a slight risk of confusion on what to set
where:-) with having to set some options in the clamd.conf file.

> Rick

Cheers
-- 
-- Glenn
email: glenn < dot > steen < at > gmail < dot > com
work: glenn < dot > steen < at > ap1 < dot > se