Oh, absolutely Micah. My scan times were negligible as I was scanning a
single PHP that was 150 bytes or so (opening PHP tag, two lines of
comments, and a call to phpinfo), so those times I gave were entirely load
time.
I'm glad that you found the information helpful.
--Maarten
On Tue, Apr 9,
Maarten,
Your test results are pretty great. I really like your breakdown of the
signatures by category. I will caution that scan times will vary quite heavily
depending on what you’re scanning, based on Target type
(https://www.clamav.net/documents/clamav-file-types).
In addition, it’s
Clearly the latest daily.cvd is performing better, but the remaining
"Phishtank" sigs are *not* a majority of the slowness.
I unpacked the current (?) cvd (ClamAV-VDB:09 Apr 2019 03-53
-0400:25414:1548262:63:X:X:raynman:1554796413) and then ran a test scan
with each part to see what the load
Mark,
Yes, the plan is still to remove the rest of the Phishtank signatures. We
wanted to get things back to relative normal and resolve the immediate crisis.
We’ll remove the rest of them soon.
Best,
Micah
From: Mark Allan
Date: Tuesday, April 9, 2019 at 6:26 AM
To: "Micah Snyder
On 2019-04-09 12:02, Brent Clark via clamav-users wrote:
Cant those be adopted / managed by Sanesecurity?
For all you know, those are already in Sanesecurity.
They are... and have been for quite some time:
"The following databases are distributed by Sanesecurity, but produced
by Porcupine
Hello all,
i'm a newbie with ClamAv.
I've been using it for a few years with MailScanner using the 'wrapper'
method. but lately that has proven to be very slow. I think it may be due
to ClamAv engine startup time, everytime MailScanner calls on it. a run of
'Time MailScanner --lint' shows a 3
Cant those be adopted / managed by Sanesecurity?
For all you know, those are already in Sanesecurity.
Regards
Brent Clark
On 2019/04/09 12:25, Mark Allan via clamav-users wrote:
The scan times are definitely better than they were - in fact, they're
back to how they were before last week's
The scan times are definitely better than they were - in fact, they're back
to how they were before last week's inclusion of the Phishtank signatures.
They're still almost double what they used to be though, and as far as I
can see, there are still almost 4000 Phishtank signatures in the DB:
$
