"Leveille, Gerald via clamav-users" wrote:
> Categorization: Unclassified
> Hi,
>
> I would like to know what would be the best way to do a virus scan of changed
> or new files only. I want to run a daily scan of changed and new files during
> weekdays and run a full scan on weekends.
>
> I
"G.W. Haywood via clamav-users" wrote:
>
> Perhaps try enabling libclamav debug logging.
I poked around a bit and didn't see an obvious way to do that, like a
configure option or a .h file. Couldn't really tell where it would be
logging.
> During your scans I suspect that ClamAV may be
Dave Sill via clamav-users wrote:
>
> Both of my test systems are RHEL 7, so off to try another platform.
On Fedora 32:
# find ~dave/Mail -type f|wc -l
26671
# clamdscan --fdpass ~dave/Mail
Time: 932.395 sec (15 m 32 s)
# clamdscan --fdpass ~dave/Mail
Time: 489.627 sec (8
On the desktop system:
$ find Mail -type f|wc -l
123719
# clamdscan --fdpass ~de5/Mail
Time: 2137.531 sec (35 m 37 s)
# clamdscan --fdpass ~de5/Mail
Time: 2138.778 sec (35 m 38 s)
So, still not seeing a benefit from the cache.
Both of my test systems are RHEL 7, so off to try another
"G.W. Haywood via clamav-users" wrote:
>
> Only 4GB on my clamd server.
>
> $ du -sh images/
> 16G images/
> $ find ./images -type f | wc -l
> 11586
> $ clamdscan images/
> ...
> Time: 12547.333 sec (209 m 7 s)
> ...
> $ clamdscan images/
> ...
> Time: 1477.782 sec (24 m 37 s)
That's a
"G.W. Haywood via clamav-users" wrote:
> Hi there,
>
> On Thu, 1 Oct 2020, Dave Sill via clamav-users wrote:
>
> >It looks like my point was lost in the noise ...
>
> Sorry, I guess it was late and I was in a hurry to get to bed. :(
No worries. Thanks for you
It looks like my point was lost in the noise so I'll try to distill it.
I ran clamdscan twice on my /home (69k files) and got:
# clamdscan --fdpass /home
...
Time: 1428.433 sec (23 m 48 s)
# clamdscan --fdpass /home
...
Time: 1355.057 sec (22 m 35 s)
#
The cache only saved a little over a
Dave Sill via clamav-users wrote:
>
> > >Skipping multiple copies of the same file won't really help because
> > >the duplication is across systems, and because every file will be
> > >rescanned every time clamscan is run.
> >
> > That's not true of cl
"G.W. Haywood via clamav-users" wrote:
>
> There are ways around that, even if you don't want to run clamdscan
> (and clamd) as root - which I'd entirely understand.
Is --fdpass one of them? And --stream? Any others?
> >We've got about 3000 Linux systems that we'd like to periodically scan,
>
Andrew C Aitchison via clamav-users wrote:
>
> No. clamD scans data passed to it by clamdscan, usually over a socket or
> pipe.
Ah... I missed INSTREAM in the clamd man page. Locally, though, surely
SCAN/CONTSCAN/etc, are nuch more efficient. And remotely, sending the
entire contents of the
"G.W. Haywood via clamav-users" wrote:
>
> In the second scan, how did clamscan manage to do what it claims to
> have done in the time that it did it?
OK, you could have just said that the cache is internal to each invocation
of clamscan, but that helps.
> For further enlightenment, on one of
The clamscan man page says:
--disable-cache
Disable caching and cache checks for hash sums of scanned files.
I've looked high and low via google, strace, looking at source code, conducting
tests,
and I see no sign of caching done by clamscan. Is this on the to-do list?
We'd
12 matches
Mail list logo
