Hi to all,
I'm new to clamav, so i'm sorry if i'm asking something stupid.
I decided to try clamav on some mail servers with qmail and qmail-scanner.
Before i ever used the same config but with FSAV from F-secure.
Now with clamav i'm making some tests scanning one zip archive of 260K
that uncompressed is a tcpdump file of 2.5 Mb (i use clamd).
Sending it through qmail-scanner it taken 13.45 seconds to be checked.
Cheking the archive directly in zip format (without email conversion
overhead) on the server taken 6.66 seconds.
Thinking that the difference was due to the encoding of the file in the
email if i check the same zip file with FSAV ( on same server) it take
less than 2 seconds?
Now i don't know exactly the internals of clamav, i just started testing
it today and still searching some documentation on performances around,
but it seems to me a lot of time to do it and a big diference with FSAV.
What i noticed with strace and leaving tmp files open is that clamav is
opening a lot of directory in tmp dir (352 on one scan to be precise), i
don't know if it is correct.
Can you give me some help on this ?
Is it correct all this time and all that tmp files writing to the disk?
I'm using Suse Linux enterprise Server 10 on HP DL380 dual processor
xeon 3.00 Ghz 2GB ram, SCSI disks. Clamav version 0.90.2 .
Thanks,
Bye,
Marcello
_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://lurker.clamav.net/list/clamav-users.html
