hmm. while i am seeing a gigantic difference in 'real' scanning of incoming messages, here's what i get from scanning my existing quarantine dir between the two:
with 880 files in the quarantine,
When scanning a large number of files all at once, most time is spent actually scanning the files.
When scanning just a few small files, most time is spent loading the database and getting ready to scan. Clamd pre-loads the database and is ready to scan whatever file or directory name is passed to it by clamdscan.
Typical MTA usage is scan just a few files per command; ie. a single mail message, usually unpacked into its various mime parts.
So clamdscan wins big when used with an MTA.
For a fair comparison test of your quarantine, you would need to do something like:
time sh -c 'for name in *
do
clamscan $name
done'
Once with clamscan, again with clamdscan. No bets on who wins this race, but try it and see what you get. Prediction: with clamdscan, total time will be about the same as you measured before; with clamscan, it will take ~10x longer than the previous test. Tell us what really happens.
As for the differences in number of viruses detected in your quarantine scan, probably something to do with the options used with clamscan and settings in clamav.conf. The slight time difference you saw was likely due to files to scan cached in ram, and maybe other processes running.
--
Noel Jones
------------------------------------------------------- This SF.net email is sponsored by: Perforce Software. Perforce is the Fast Software Configuration Management System offering advanced branching capabilities and atomic changes on 50+ platforms. Free Eval! http://www.perforce.com/perforce/loadprog.html _______________________________________________ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
