Török Edwin wrote:
> On 2009-03-04 21:53, Jose-Marcio Martins da Cruz wrote:
>>
>
> Was your clamd heavily loaded at that time?
No. This is a test server. Absolutely no load. It seemed to me that it
was the message which triggered the database update.
top load is something like this :
load averages: 0.11, 0.11, 0.11 21:52:31
73 processes: 72 sleeping, 1 on cpu
CPU states: 99.9% idle, 0.0% user, 0.1% kernel, 0.0% iowait, 0.0% swap
Memory: 8184M real, 6289M free, 542M swap in use, 13G swap free
> How long does this take:
> $ time clamscan /dev/null
>
> It takes 0.68 seconds here (Intel Core 2 Quad Q9550 @2.83 Ghz).
# /usr/bin/time /opt/clamav/bin/clamscan -d /opt/clamav/db /dev/null
ERROR: Not supported file type (/dev/null)
----------- SCAN SUMMARY -----------
Known viruses: 514191
Engine version: 0.95rc1
Scanned directories: 0
Scanned files: 0
Infected files: 0
Data scanned: 0.00 MB
Time: 14.949 sec (0 m 14 s)
real 14.9
user 14.4
sys 0.5
111 - [r...@paris-1] /var/log #
>
> It also depends if you've got a .cvd or .cld file, .cld files are
> uncompressed, hence they load faster.
.cld
# ls //opt/clamav/db/
daily.cld daily.inc main.cld main.inc mirrors.dat
122 - [r...@paris-1] /opt/clamav #
> Here's how long it takes to load .cvd: 1.2s
>
> On a Solaris10/sparc box (UltraSPARC-IIi 440Mhz) it takes 18s.
Hmmm, a T2000 is "slightly" better than your sparc box (a 10 years old
Ultra 5 or Ultra 10 ?). But it doesn't seems too faster.
A T2000 with 8 cores looks like this :
# psrinfo -v
Status of virtual processor 0 as of: 03/04/2009 21:44:58
on-line since 01/30/2009 12:56:40.
The sparcv9 processor operates at 1000 MHz,
and has a sparcv9 floating point processor.
...
Status of virtual processor 31 as of: 03/04/2009 21:44:58
on-line since 01/30/2009 12:56:42.
The sparcv9 processor operates at 1000 MHz,
and has a sparcv9 floating point processor.
>>
>
> 0.94.2 didn't accept new connections during a DB reload (they went into
> the TCP connection backlog),
> 0.95rc1 accepts new connections during the DB reload, but doesn't
> process the commands only after the DB has reloaded.
> However with 0.95rc1 clients shouldn't time out (since the connection
> was accepted), unless the client itself has a builtin timeout
> mechanism (clamdscan doesn't, it relies on TCP timeouts).
Yes, the client has a timeout of 10 seconds for the connection and 10
seconds for the scan answer.
--
---------------------------------------------------------------
Jose Marcio MARTINS DA CRUZ http://j-chkmail.ensmp.fr
Ecole des Mines de Paris
60, bd Saint Michel 75272 - PARIS CEDEX 06
mailto:[email protected]
_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://www.clamav.net/support/ml
