Re: [Clamav-users] clamdscan extremely fast

On Tue, 2007-06-26 at 08:43 -0700, Dennis Peterson wrote:
> guenther wrote:
> > On Sun, 2007-06-24 at 20:56 -0400, Paul Kosinski wrote:
> >> When I originally started using clamav, clamscan could handle my low
> >> (SOHO) volume of email quite well, but recently, it started taking
> >> over 20 secs to scan a short email,
> > [...]
> >> So I decided to try clamdscan, again.
> >
> >> What an incredible improvement! Instead of 20+ secs to scan, it scans
> >> normal emails in anywhere from .005 sec to .100 secs. I would guess
> >> the average speed up is on the order of 1000 to 1!
> >
> > This is a recurring topic.
> >
> > clamd/clamdscan does not *scan* faster than clamscan. It just does not
> > need to read in all the signatures yet again for each and any mail. This
> > starting up penalty is what you are observing.
> >
>
> This is an incomplete picture. If you are scanning mail as it comes in
> in real time then clamscan is nearly useless. Starting clamscan 100,000
> times an hour is far costlier in time to complete a scan per file and
> load on the system. Calling clamd from a milter that is already running
> comes nowhere near that impact.
>
> If you are scanning mail after the connection has closed then you can
> run clamscan and scan whole blocks of files quite efficiently and time
> is not so important anyway.

True. However, even when batch-processing, the startup penalty still exists. Not for every single mail, but per chunk...

> The point being, context is an important consideration when comparing
> the merits of clamscan and clamd.

Exactly. This context is procmail. Which calls filters per mail. So in this very context, the above is the complete picture, no? ;-)

  guenther

-- 
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}

_______________________________________________
Help us build a comprehensive ClamAV guide: visit 
http://wiki.clamav.nethttp://lurker.clamav.net/list/clamav-users.html