Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
new clamscan very slow
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index Networking & Security
View previous topic :: View next topic  
Author Message
jagdpanther
Guru
Guru


Joined: 22 Nov 2003
Posts: 470

PostPosted: Sat Apr 14, 2007 1:03 pm    Post subject: new clamscan very slow Reply with quote

I just upgraded clamav from 0.90 to 0.90.2 (~amd64).
Each e-mail message that is scanned (I am using clamscan not calmdscan.) takes many times longer (15 seconds) than clamscan did when I was using clamav-0.90.

Any idea why the new clamscan is so slow?
Back to top
View user's profile Send private message
ryanmr
n00b
n00b


Joined: 01 Jul 2005
Posts: 2

PostPosted: Tue Apr 17, 2007 12:30 pm    Post subject: Same problem Reply with quote

I've been experiencing the same problem (also amd64). Upgrading to newest clamav punted my mailserver's load up to 100% and kept it there until I backed it up to version 0.90. Anyone know why or if there's a fix?
Back to top
View user's profile Send private message
jagdpanther
Guru
Guru


Joined: 22 Nov 2003
Posts: 470

PostPosted: Tue Apr 17, 2007 6:32 pm    Post subject: Use clamdscan not clamscan Reply with quote

Because I only received a small amount of e-mail, I was using clamscan. I switched to using clamd and clamdscan and now scanning is back up to speed. I have no idea why clamscan is still so slow with the new release.

fyi: by default starting clamd (/etc/init.d/clamd) will also start a 'freshclam -d' running.
Back to top
View user's profile Send private message
rapsure
Apprentice
Apprentice


Joined: 29 Apr 2004
Posts: 166
Location: Logan, UT USA

PostPosted: Wed Apr 18, 2007 5:49 am    Post subject: Reply with quote

me too. If a bug hasn't been filed it should be done. I switched to using clamdscan instead.
_________________
:) Hindi ko naintindihan, pakiulit. Sometimes my code works.
Back to top
View user's profile Send private message
networkorg
n00b
n00b


Joined: 02 Feb 2006
Posts: 74
Location: Buenos Aires

PostPosted: Thu Apr 19, 2007 5:09 pm    Post subject: Reply with quote

Hello,

I use clamd but it is really slow after the update. Also there is a problem with the internal delivery now with 0.90.2 because our postfix queue shows the errors :

Code:

connect to 127.0.0.1[127.0.0.1]: server dropped connection without sending the initial SMTP greeting
or
connect to 127.0.0.1 [127.0.0.1]: read timeout


It is stupid because after "flushing the queue" it works again for a time but if there are around 30+ mails in the queue the problem will be the same. So we must flush the queue each hour or after each chinese-spam-fu**er the queue that the mails will be delivered to our customers because the clam will stop working for a time.

Maybe someone has a idea

bye alex
Back to top
View user's profile Send private message
mossmann
n00b
n00b


Joined: 23 Apr 2002
Posts: 13

PostPosted: Thu Apr 19, 2007 10:47 pm    Post subject: this worked for me Reply with quote

I had the same problem. Downgrading to 0.90.1-r1 didn't help. What did help was to unmerge, remove /var/lib/clamav, and emerge. This worked both with 0.90.1-r1 and with 0.90.2. A good test is:

Code:
$ /usr/bin/clamscan - </dev/null
stdin: OK

----------- SCAN SUMMARY -----------
Known viruses: 110918
Engine version: 0.90.2
Scanned directories: 0
Scanned files: 1
Infected files: 0
Data scanned: 0.00 MB
Time: 5.350 sec (0 m 5 s)

real    0m5.359s
user    0m5.008s
sys     0m0.168s


This was taking more that 20 seconds prior to re-emerging. I still don't know what the cause is, but I suspect it has something to do with reading the virus database.
Back to top
View user's profile Send private message
networkorg
n00b
n00b


Joined: 02 Feb 2006
Posts: 74
Location: Buenos Aires

PostPosted: Fri Apr 20, 2007 12:27 am    Post subject: Reply with quote

Hello,

thx for the test info. So I've read a little bit and have seen that my amavisd will use /usr/bin/clamscan (but I use clamd - so I think it should be a misconfiguration in amavisd) to scan the email and this will be need with the command arround 30 to 60 seconds :cry:

Code:

# /usr/bin/clamscan - </dev/null
stdin: OK
----------- SCAN SUMMARY -----------
Known viruses: 215418
Engine version: 0.90.2
Scanned directories: 0
Scanned files: 1
Infected files: 0
Data scanned: 0.00 MB
Time: 34.445 sec (0 m 34 s)


But I found out that there will be also a /usr/bin/clamdscan which will need like nothing for the same on the same machine but don't have that summary as the /usr/bin/clamscan

Code:

# /usr/bin/clamdscan - </dev/null
stream: OK
----------- SCAN SUMMARY -----------
Infected files: 0
Time: 0.002 sec (0 m 0 s)


I know that clamdscan is a Daemon job. But why would it be so fast ?? Can anybody tell me or know what is the real difference of clamscan and clamdscan or maybe will clamdscan don't check so deep in detail ??

Surely the version 0.90-r1 don't had this problem but I don't want to move to clamdscan if it don't check in same way as clamscan. Surely a Daemon will be faster in loading the module if needed but .... I don't know ...

bye alex
Back to top
View user's profile Send private message
networkorg
n00b
n00b


Joined: 02 Feb 2006
Posts: 74
Location: Buenos Aires

PostPosted: Fri Apr 20, 2007 12:49 am    Post subject: Reply with quote

Hello,

here is the original BUG https://bugs.gentoo.org/show_bug.cgi?id=174375 for the security update to 0.90.2 where I've posted the question about the time for scanning.

bye alex
Back to top
View user's profile Send private message
jagdpanther
Guru
Guru


Joined: 22 Nov 2003
Posts: 470

PostPosted: Fri Apr 20, 2007 5:20 pm    Post subject: Reply with quote

re-installing clamav after deleting /var/lib/clamav worked for me also. clamscan is back back up-to-speed.

Thanks
Back to top
View user's profile Send private message
Urgo
n00b
n00b


Joined: 03 Apr 2003
Posts: 14

PostPosted: Wed May 02, 2007 4:47 am    Post subject: Reply with quote

I just wanted to chime in and say that mossmann's fix of unmerging, removing (or moving) /var/lib/clamav, and then remerging did the trick for me too.

Thanks mossmann and jagdpanther.
Back to top
View user's profile Send private message
halfgaar
l33t
l33t


Joined: 22 Feb 2004
Posts: 781
Location: Netherlands

PostPosted: Wed May 02, 2007 9:09 am    Post subject: Reply with quote

It didn't help me, so I just use clamdscan now... Perhaps it was faster after removing the data files, but not fast enough. With clamdscan, it takes 0 seconds to scan 0 bytes of data, as it should :) With clamscan, "clamscan - < /dev/null" takes 7.6 seconds, on my Athlon X2 3800+.
_________________
Linux backups the right way.
Get surround sound working.
Back to top
View user's profile Send private message
networkorg
n00b
n00b


Joined: 02 Feb 2006
Posts: 74
Location: Buenos Aires

PostPosted: Wed May 02, 2007 1:21 pm    Post subject: Reply with quote

I also use clamdscan now instead of clamscan with my new amavisd-new. Clamd is primary and for security clamscan as secondary 8)

bye alex
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Networking & Security All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum