guenther wrote: > On Sun, 2007-06-24 at 20:56 -0400, Paul Kosinski wrote: >> When I originally started using clamav, clamscan could handle my low >> (SOHO) volume of email quite well, but recently, it started taking >> over 20 secs to scan a short email, > [...] >> So I decided to try clamdscan, again. > >> What an incredible improvement! Instead of 20+ secs to scan, it scans >> normal emails in anywhere from .005 sec to .100 secs. I would guess >> the average speed up is on the order of 1000 to 1! > > This is a recurring topic. > > clamd/clamdscan does not *scan* faster than clamscan. It just does not > need to read in all the signatures yet again for each and any mail. This > starting up penalty is what you are observing. >
This is an incomplete picture. If you are scanning mail as it comes in in real time then clamscan is nearly useless. Starting clamscan 100,000 times an hour is far costlier in time to complete a scan per file and load on the system. Calling clamd from a milter that is already running comes nowhere near that impact. If you are scanning mail after the connection has closed then you can run clamscan and scan whole blocks of files quite efficiently and time is not so important anyway. The point being, context is an important consideration when comparing the merits of clamscan and clamd. dp _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://lurker.clamav.net/list/clamav-users.html
