<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
<br>
<br>
Rick Cooper wrote:
<blockquote cite="mid:02aa01c7a307$ad21a3b0$0301a8c0@SAHOMELT"
type="cite">
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">-----Original Message-----
From: <a class="moz-txt-link-abbreviated" href="mailto:mailscanner-bounces@lists.mailscanner.info">mailscanner-bounces@lists.mailscanner.info</a>
[<a class="moz-txt-link-freetext" href="mailto:mailscanner-bounces@lists.mailscanner.info">mailto:mailscanner-bounces@lists.mailscanner.info</a>] On Behalf
Of Glenn Steen
Sent: Wednesday, May 30, 2007 5:01 PM
To: MailScanner discussion
Subject: Re: Clamd Daemon Scanning Patches
</pre>
</blockquote>
<pre wrap=""><!---->[..]
</pre>
<blockquote type="cite">
<blockquote type="cite">
<pre wrap="">Last two items that should probably be asked of the group:
I am assuming that the clamd init scripts are creating lock
</pre>
</blockquote>
<pre wrap="">files, as most
</pre>
<blockquote type="cite">
<pre wrap="">do, (usually /var/lock/subsys/clamd) but if that is not the
</pre>
</blockquote>
<pre wrap="">case I should
</pre>
<blockquote type="cite">
<pre wrap="">remove the check, I am PINGing clamd anyway but if the lock
</pre>
</blockquote>
<pre wrap="">file isn't there
</pre>
<blockquote type="cite">
<pre wrap="">I can short circuit the whole connect process.
</pre>
</blockquote>
<pre wrap="">Perhaps do this as a config thing too? If "Clamd Lock File" is empty,
do the ping unconditionally, else check whatever it points to...?
</pre>
</blockquote>
<pre wrap=""><!---->
Yeah, in retrospect I think it should have gone that way and not made
assumptions. Right now if the lock file isn't there it's assumed that clamd
isn't running. Easy fix
</pre>
</blockquote>
Work out a new set of patches and send me them, and they'll go in the
first beta of the next version 4.61.<br>
<blockquote cite="mid:02aa01c7a307$ad21a3b0$0301a8c0@SAHOMELT"
type="cite">
<pre wrap="">
</pre>
<blockquote type="cite">
<blockquote type="cite">
<pre wrap="">I am not using the threaded daemon model (MULTISCAN) but a
</pre>
</blockquote>
<pre wrap="">config parameter
</pre>
<blockquote type="cite">
<pre wrap="">such as "Clamd Use Threads" could be added so clamd can
</pre>
</blockquote>
<pre wrap="">take advantage of
</pre>
<blockquote type="cite">
<pre wrap="">threading on SMP hosts.
</pre>
</blockquote>
<pre wrap="">Should work. How far away is Config Option Number 400, Jules?:-)
</pre>
</blockquote>
<pre wrap=""><!---->
I don't know how helpful this option is as I don't have a SMP host to test
on and I kept to the per file scanning model, although the tests I did
didn't have an appreciable difference between scanning entire dir verses one
file at a time since the connection to the daemon is open anyway.
</pre>
<blockquote type="cite">
<pre wrap="">Awesome stuff, can't wait to see it in a new beta (Yeah, I'm feeling
lazy today:-).
When you tested this Rick, did you notice how this affected startup
time of MS compared to clamavmodule? I boticed that using clamavmodule
adds a hefty time for reading in the signatures... (rather irritating
while debugging that p-record patch ... start debug, wait a couple of
minutes, see some errors whizz by, fiddle with code, redo...
sigh.:-)... Yeah, not that important, I know...:)
</pre>
</blockquote>
<pre wrap=""><!---->
Didn't really time it but bear in mind MS doesn't load anything. It simply
makes the socket (UNIX/TCP) connection and asks the daemon to scan something
when required (no persistent connection). If you already use clamd then
there is no impact on resources (no signatures loaded, etc). And it appears
to be at least as fast as clamavmodule but I didn't do any high resolution
timing or huge file, huge number of files. What ever overhead there is
involved with clamavmodule is gone, including checking for changed files,
loading DBs, etc. and the system overhead of clamdscan is also gone. Now of
course you have to set some options in the clamd.conf that were set in
MailScanner, such as flagging password protected files as viruses.
Rick
--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
</pre>
</blockquote>
<br>
<pre class="moz-signature" cols="72">Jules
--
Julian Field MEng CITP
<a class="moz-txt-link-abbreviated" href="http://www.MailScanner.info">www.MailScanner.info</a>
Buy the MailScanner book at <a class="moz-txt-link-abbreviated" href="http://www.MailScanner.info/store">www.MailScanner.info/store</a>
MailScanner customisation, or any advanced system administration help?
Contact me at <a class="moz-txt-link-abbreviated" href="mailto:Jules@Jules.FM">Jules@Jules.FM</a>
PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
For all your IT requirements visit <a class="moz-txt-link-abbreviated" href="http://www.transtec.co.uk">www.transtec.co.uk</a>
</pre>
</body>
<br />--
<br />This message has been scanned for viruses and
<br />dangerous content by
<a href="http://www.mailscanner.info/"><b>MailScanner</b></a>, and is
<br />believed to be clean.
<br />For all you IT requirements visit <a href="http://www.transtec.co.uk/">transtec Computers</a>.
</html>