Re: [Declude.Virus] ClamAV scan time

[Matt]

Terry, Maybe if you could clarify.  You are running ClamAV in daemon mode, am I correct? My point was that as of several months ago, the non-daemon installation was a processor hog and took a lot of time compared to F-Prot, the best performing scanner.  Things might have changed since then.  I also noted that when run in daemon mode, ClamAV was virtually as fast as F-Prot, and used less resources.  I'm not running ClamAV because I had issues with the stability/management of their daemon at that time.  I suspect that things have changed since then. Regardless, I would not be surprised to see the per-process launched ClamAV causing excessive load on a busy server.  It wasn't clear if John was running one way or another.  Hitting a 60 second timeout suggests that his server was being redlined for a prolonged period of time, and going to the daemon mode might provide substantial relief.  If his other scanner isn't F-Prot, he should also think about switching because there is nothing as efficient as F-Prot, and it hardly uses any resources. Matt Terry Fritts wrote: ClamAV when not run in daemon mode is very slow in comparison to other virus scanners. If your server is getting pushed to it's limits, the first sign will likely be their vir directories piling up as a result of ClamAV not finishing within the specified time configured in Declude Virus. I played around with daemon mode several months back, but there was an issue with the service not shutting down when you told it to, so I abandoned it for the time being. Maybe some others have information about how to do this properly now with newer builds. My log records the scan times. I did check when I read this and there are a few excessively long scan times. I checked about 10,000 entries. There were 360 scans that took longer than .5 sec. There were 206 that took 1 sec or longer. Also, I record the total time, the time to check to see if the service is running, and then the actual scan time. In my worst case these numbers were recorded: 13.3490,11.947,1.402. But notice that the middle number is the time to check to see if the service is running. This indicates to me that the issue is not with ClamAV but with the server load at the time of the scan. I know the server is being hammered anyway. I did check to see if there were any correlation between the file size and the long elapsed times and I really could not find any. But then again we are not handling huge numbers of messages either. My programs are available for download at: http://www.smartbusiness.com/imail/declude/ Terry Fritts --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com. -- ===================================================== MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =====================================================