-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 22/06/2012 17:56, Reynolds, David C. wrote: > This is a resend from about 2 weeks ago for which there was no > reply. Any help is appreciated....
Sorry for the late response. > > ................................................................... > > I am incorporating ClamAv virus scanning into software that > transfers files between two domains of different security levels. > I have built the latest software from source, version 0.97.4, and > have it running successfully for a slightly different application. > I am using clamdscan to process whole directories to enable use of > the multithreading capability. The host system is an older SGI > Origin 3000 with about 200 processors running Trusted IRIX with a > shared file system. > > What are some recommended configuration settings for clamd.conf > for optimal use of multithreading? Realistically, how many threads > can I expect to be able to make use of? Unfortunately I don't have access to any boxes at the moment that I can do this type of performance testing on. There is some locking in the engine related to cache lookups, but without testing I could not put a number on the affect this has on performance. > > In preliminary testing it takes about 30 seconds to scan 1500 > typical transfer files. If I split these into two directories of > about 750 files each the wall time for the individual scans are > about 13 and 17 seconds for each (the difference is the volume of > bytes in the two directories). However, when I run the two scans > concurrently the wall time for each is about 37 seconds. This > would seem to suggest that the clamd daemon is essentially > timesharing between the two requests. True? > This will depend on your operating systems thread scheduler, and on the affect of cache lookup requests being serialized. > I then created two separate clamd.conf files using separate Unix > sockets and log files so I can start two separate clamd daemons. > Running two concurrent clamdscan (each pointing to a different > clamd.conf file) still does not produce improved (nor acceptable) > walltime scan times. I would guess that I'm hitting some common > resource bottleneck. > If you are dealing with compressed or archive files then tmp files will be being created for each item being scanned. You could be hitting a local disk bottleneck on the speed of your tmp filesystem. Once way to speed this up would be to configure clamd to use a ramdisk for its tmp file storage. Tom -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQEcBAEBAgAGBQJP6IFEAAoJEEJSM9yB4iIWxcsH/i36Ejl07fgrTCYxxF6m64td K6hLTZyOvj5suyYDA9FifdsSuIrZQlNr3pae0Qz/USfNcotCCsYe9y5kFOg9zpxh 2VltxLBUOMZASAolJ018sYr/yUqA/HhFRpS4ApioPmVV4n/dCjdCh3alCvup4V54 v90IL1FlJIg1W/rL7NZLlR6sSAPkv6ISfwtfoduN87bswg8wVqoUkVNQg2PO1+fE korIXazMWHR+dCZLC//BgxzpAwNAwR32LSynNzyARRS+CqCvAIgGtWmkWtG7xfzj uTyIfpkkMYremGj7FHO1dek8xC9LjFsSBvVzig1R1sryflhnVmSHlhpArWRNydY= =Xj7v -----END PGP SIGNATURE----- _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://www.clamav.net/support/ml
