FYI – 1st scanner is
F-Prot. 2nd is ClamAV. I am using the “runclamscan”
wrapper found at http://www.smartbusiness.com/imail/declude/.
Today I haven’t had any left over
directories and vir*.log is clean of errors. It may have been the
particular load at that time and message size as someone mentioned yesterday.
John
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On
Behalf Of Matt
Sent: Tuesday, November 16, 2004
10:21 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.Virus]
ClamAV scan time
Terry,
Maybe if you could clarify. You are running ClamAV in daemon mode, am I
correct?
My point was that as of several months ago, the non-daemon installation was a
processor hog and took a lot of time compared to F-Prot, the best performing
scanner. Things might have changed since then. I also noted that
when run in daemon mode, ClamAV was virtually as fast as F-Prot, and used less
resources. I'm not running ClamAV because I had issues with the
stability/management of their daemon at that time. I suspect that things
have changed since then.
Regardless, I would not be surprised to see the per-process launched ClamAV
causing excessive load on a busy server. It wasn't clear if John was
running one way or another. Hitting a 60 second timeout suggests that his
server was being redlined for a prolonged period of time, and going to the
daemon mode might provide substantial relief. If his other scanner isn't
F-Prot, he should also think about switching because there is nothing as
efficient as F-Prot, and it hardly uses any resources.
Matt
Terry Fritts wrote:
ClamAV when not run in daemon mode is very slow in comparison to other
virus scanners. If your server is getting pushed to it's limits, the
first sign will likely be their vir directories piling up as a result of
ClamAV not finishing within the specified time configured in Declude Virus.
I played around with daemon mode several months back, but there was an
issue with the service not shutting down when you told it to, so I
abandoned it for the time being. Maybe some others have information
about how to do this properly now with newer builds.
My log records the scan times. I did check when I read this and
there are a few excessively long scan times.
I checked about 10,000 entries. There were 360 scans that took
longer than .5 sec. There were 206 that took 1 sec or longer.
Also, I record the total time, the time to check to see if the
service is running, and then the actual scan time. In my worst case
these numbers were recorded: 13.3490,11.947,1.402. But notice that
the middle number is the time to check to see if the service is
running. This indicates to me that the issue is not with ClamAV but
with the server load at the time of the scan. I know the server is
being hammered anyway.
I did check to see if there were any correlation between the file
size and the long elapsed times and I really could not find any.
But then again we are not handling huge numbers of messages either.
My programs are available for download at:
http://www.smartbusiness.com/imail/declude/
Terry Fritts
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
--
=====================================================
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=====================================================
