> On Thu, 2010-04-22 at 02:05 +0100, Martin Hepworth wrote: > > > > > > On 22 April 2010 00:44, Chris <cpoll...@embarqmail.com> wrote: > > I've posted two files below, one is the time output > for a spam > > and one > > for ham. Seems like over the past few weeks SA scan > times have > > become > > slower and slower. For instance stats from last night below. > > Anyone with > > any ideas on how to speed things up? > > > > Email: 62 Autolearn: 0 AvgScore: -16.94 > AvgScanTime: > > 21.25 sec > > Spam: 17 Autolearn: 0 AvgScore: 35.71 > AvgScanTime: > > 23.12 sec > > Ham: 45 Autolearn: 0 AvgScore: -36.82 > AvgScanTime: > > 20.54 sec > > > > For instance my scan times about two weeks ago were: > > > > Email: 58 Autolearn: 0 AvgScore: -12.38 > AvgScanTime: > > 11.36 sec > > Spam: 16 Autolearn: 0 AvgScore: 85.06 > > AvgScanTime: 8.52 sec > > Ham: 42 Autolearn: 0 AvgScore: -49.50 > AvgScanTime: > > 12.45 sec > > > > Spam > > http://pastebin.com/fhd3XwHp > > > > Ham > > http://pastebin.com/jbSD894i > > > > Any advice would be appreciated. > > > > Chris > > > > -- > > KeyID 0xE372A7DA98E6705C > > > > > > What version of SA and what rules (extra or otherwise) are you > > running? > > 3.3.0 > Standard rulesets plus: > > http://pastebin.com/UK68S0L4 > > > > > Anything else on the box in question slower? > > Clam was running really slow and sucking a bunch of memory > however, the problem there was found to be that I had a > mail.cvd and main.cld db, I removed the .cld file and it > seemed to speed up somewhat. > > > > you run a local caching nameserver on the SA box? > > Yes, named is running > > > You run sa-update frequently? > > Yes, every four hours > > > > Does a debug show any obvious place where it's slow? > > > dbg: async: timing: 3.375 . dns:A:3.169.13.200.ix.dnsbl.manitu.net. > > See http://pastebin.com/7upp4BCp > > > > > > > -- > KeyID 0xE372A7DA98E6705C > >
Our scan time use to be much longer and it was because of clamav. I realized that I was scanning with clamscan and not clamdscan. The clamdscan uses the daemon that's already loaded, so it's not loading the virus database everytime. I'm not entirely sure whether that will help, but I know it helped us. Kaleb
