Some considerations: - the longest “delay” will occur when reloading signature databases. If reducing the delay is important, run multiple instances with smaller signatures in each. ESPECIALLY, if you’re going to writing your own story signatures or using databases that change often.
- scanning speed will be limited most by filesystem access speed. If you schedule scans, limit the slow file systems to off hours or only scan them occasionally. - on memory-constrained systems separating the signature sets is even more important so that you can limit the memory usage in addition to the reload speed. - where possible, have clamd running and use clamdscan instead of spawning clamscan processed for each scan. - depending on the workloads, it might be more efficient to run ClamAV running everywhere with a certain set of signatures and run a single system for specific targeted scans using larger signature sets (such as a mailserver or ftp server). - proftpd has pretty good integration with ClamAV as a plug-in for upload scanning. Maarten Sent from a tiny keyboard > On Mar 17, 2018, at 14:04, Len Sanschargrin <l...@tampabay.rr.com> wrote: > > OMG, Why are you guys trying to make this so difficult? > > Ok, Here's where I am. We are planning to implement ClamAV on all Solaris & > RHEL servers (medium sized with 1500 total servers - 4 core, 36gb mem). The > keyword being "PLANNING". We have not implemented it anywhere yet. So I'm > looking for GENERAL guidance about what kind of overhead has been observed on > a single server with ClamAV running. It's no more difficult than that. So if > you have some observations worth sharing, thanks. Otherwise we'll get our own > metrics when we install and test it in a month or so... The idea of a user > group is for users to share experiences. I'm not trying to get free support, > just user experience/observations and no I'm not addressing a performance > problem and yes I understand that we won't have the exact same configuration. > Think of it more as an expectation-setting & capacity-planning exercise.... > > Thanks very much, Len > > -----Original Message----- > From: Reindl Harald [mailto:h.rei...@thelounge.net] > Sent: Saturday, March 17, 2018 1:10 AM > To: ClamAV users ML; Len Sanschargrin > Subject: Re: [clamav-users] ClamAV performance overhead on RHEL & Solaris > > you don't give any useful informations to work with - so how tdo you imagine > useful responses - yes it needs ressource - how much? IT DEPENDS! > >> Am 17.03.2018 um 02:17 schrieb Len Sanschargrin: >> I'm not sure why you are trying to characterize performance overhead as >> "issues". Every process running on a server has some resource requirements. >> I am. Performance engineer and my focus is in getting the most out of every >> infrastructure server. Hence my question about overhead. In this case we are >> planning to implement on RHEL and Solaris servers. If you don't have any >> useful info, then please don't waste my time. >> Thanks very much, Len >> >> ---- Yuri <yvoi...@gmail.com> wrote: >>> If I complain about overhead/performance issue, I should: >>> >>> -Specify hardware/infrastructure details >>> >>> -Usage of system (some specific) >>> >>> - Root case (For example "I test 4 Gb-size ISO images and I has CPU >>> overhead") >>> >>> WIthout this it is only blah-blah-blah. >>> >>> For example: In my case, I have 2 socket (4 cores each) Xeon 2.4 GHz >>> CPU >>> + 16 Gb RAM hardware, using ClamAV under Solaris 10 for real-time web >>> traffic scanning. And in my configuration I have no >>> overhead/performance issues. >>> >>> >>> 17.03.2018 04:59, Yuri пишет: >>>> So, what? >>>> >>>> Real-life experience is useless without full >>>> infrastructure/configuration comparison. >>>> >>>> So, you not focused on real performance issues in this context, just >>>> bla-bla-bla. What overhead? On what tasks? On what infrastructure/hardware? >>>> >>>> What else I miss? >>>> >>>> >>>> 17.03.2018 02:48, Len Sanschargrin пишет: >>>>> The need is not about issues, or comparisons, it's about real-life >>>>> experiences with the product and the overhead observed. Of course we'll >>>>> do our own testing but the earlier we know, the better. We also know some >>>>> features will cost more in terms of overhead than others, so I'm looking >>>>> for real experiences around which features are more expensive, etc.. >>>>> >>>>> Thanks very much, Len >>>>> >>>>> >>>>> -----Original Message----- >>>>> From: clamav-users [mailto:clamav-users-boun...@lists.clamav.net] >>>>> On Behalf Of Yuri >>>>> Sent: Friday, March 16, 2018 4:38 PM >>>>> To: clamav-users@lists.clamav.net >>>>> Subject: Re: [clamav-users] ClamAV performance overhead on RHEL & >>>>> Solaris >>>>> >>>>> What are you looking for? Performance complains? There is not. >>>>> >>>>> https://i.imgur.com/3Likl14.png >>>>> >>>>> ClamAV runs on this server and it's ok. >>>>> >>>>> Built from sources. >>>>> >>>>> 17.03.2018 02:34, Len Sanschargrin пишет: >>>>>> Any relative numbers you can share? >>>>>> >>>>>> Thanks very much, Len Sanschargrin >>>>>> >>>>>> >>>>>> -----Original Message----- >>>>>> From: clamav-users [mailto:clamav-users-boun...@lists.clamav.net] >>>>>> On Behalf Of SCOTT PACKARD >>>>>> Sent: Friday, March 16, 2018 3:47 PM >>>>>> To: ClamAV users ML >>>>>> Subject: Re: [clamav-users] ClamAV performance overhead on RHEL & >>>>>> Solaris >>>>>> >>>>>> It plays on RHEL and Solaris a lot better than Symantec. >>>>>> You should get your Solaris builds from www.unixpackages.com. >>>>>> >>>>>> Regards, Scott >>>>>> >>>>>>> -----Original Message----- >>>>>>> From: clamav-users [mailto:clamav-users-boun...@lists.clamav.net] >>>>>>> On Behalf Of Len Sanschargrin >>>>>>> Sent: Friday, March 16, 2018 10:45 AM >>>>>>> To: clamav-users@lists.clamav.net >>>>>>> Subject: [External] [clamav-users] ClamAV performance overhead on >>>>>>> RHEL & Solaris >>>>>>> >>>>>>> Hello, I have customer who is preparing to implement ClamAV on >>>>>>> RHEL and Solaris. As the Performance engineer, I'm looking for >>>>>>> any testing or stats on potential overhead can be associated with >>>>>>> running ClamAV. >>>>>>> Even just anecdotal observations can help us to set expectations >>>>>>> and of course any additional guidance is appreciated! >>>>>>> >>>>>>> >>>>>>> >>>>>>> Thanks very much, Len >>>>>>> >>>>>>> >>>>>>> >>>>>>> _______________________________________________ >>>>>>> clamav-users mailing list >>>>>>> clamav-users@lists.clamav.net >>>>>>> http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users >>>>>>> >>>>>>> >>>>>>> Help us build a comprehensive ClamAV guide: >>>>>>> https://github.com/vrtadmin/clamav-faq >>>>>>> >>>>>>> http://www.clamav.net/contact.html#ml >>>>>> _______________________________________________ >>>>>> clamav-users mailing list >>>>>> clamav-users@lists.clamav.net >>>>>> http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users >>>>>> >>>>>> >>>>>> Help us build a comprehensive ClamAV guide: >>>>>> https://github.com/vrtadmin/clamav-faq >>>>>> >>>>>> http://www.clamav.net/contact.html#ml >>>>>> >>>>>> _______________________________________________ >>>>>> clamav-users mailing list >>>>>> clamav-users@lists.clamav.net >>>>>> http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users >>>>>> >>>>>> >>>>>> Help us build a comprehensive ClamAV guide: >>>>>> https://github.com/vrtadmin/clamav-faq >>>>>> >>>>>> http://www.clamav.net/contact.html#ml >>>>> -- >>>>> "C++ seems like a language suitable for firing other people's legs." >>>>> >>>>> ***************************** >>>>> * C++20 : Bug to the future * >>>>> ***************************** >>>>> >>>>> >>>>> >>>>> _______________________________________________ >>>>> clamav-users mailing list >>>>> clamav-users@lists.clamav.net >>>>> http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users >>>>> >>>>> >>>>> Help us build a comprehensive ClamAV guide: >>>>> https://github.com/vrtadmin/clamav-faq >>>>> >>>>> http://www.clamav.net/contact.html#ml >>> >>> -- >>> "C++ seems like a language suitable for firing other people's legs." >>> >>> ***************************** >>> * C++20 : Bug to the future * >>> ***************************** > > _______________________________________________ > clamav-users mailing list > clamav-users@lists.clamav.net > http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users > > > Help us build a comprehensive ClamAV guide: > https://github.com/vrtadmin/clamav-faq > > http://www.clamav.net/contact.html#ml _______________________________________________ clamav-users mailing list clamav-users@lists.clamav.net http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
