Ok. I see. That's good -- it is clearer. One question and this has been blocking my understanding as well -- when I scan a small pdf, I am getting this . . . INSTREAM: Size limit reached, (requested: 4294967295, max: 25946112)
The file is the clam doc. clamdoc (1).pdf<http://sts-demo.mit.edu/bitstream/handle/123456789/7/clamdoc%20%281%29.pdf?sequence=3> 262Kb The default chunk size is 2048. I am not sure why this would occur, or how to remedy it. Bumping this number in the clamd.conf to 50xxxxxxxxxx does not get rid of the error. I can scan jpgs and html files that are much much larger without this issue. version is 0.96.3 ..\Wendy Wendy Bossons Senior Software Engineer MIT Libraries Software Analysis and Development 77 Masachusetts Avenue Cambridge, MA 02139-4307 617-253-0770 wboss...@mit.edu<mailto:wboss...@mit.edu> On Nov 4, 2010, at 10:46 AM, Török Edwin wrote: On Thu, 4 Nov 2010 10:09:19 -0400 Wendy J Bossons <wboss...@mit.edu<mailto:wboss...@mit.edu>> wrote: What is the overhead of opening and closing socket connections to clamd? Depends on system load, if all your CPUs are busy it might take until the next time slice till clamd gets a chance to respond. I am trying to get some metric on that, but they are not making sense to me. I'd expect UNIX sockets to be faster than TCP. Try measuring 'time clamdscan --version'. That connect to clamd, queries version, and shows reply. What should be the amount of time in milliseconds that this takes, I would be worried if it takes a milisecond. This is on a clamav under heavy load: connect time:0.052 ms avg, 0.278 ms max reply time:0.018 ms avg, 0.056 ms max connect time:0.153 ms avg, 10.064 ms max reply time:0.019 ms avg, 0.068 ms max #!/usr/bin/perl use warnings; use strict; use IO::Socket::UNIX; use Time::HiRes qw(gettimeofday tv_interval); my ($conn_max, $conn_sum, $reply_max, $reply_sum); my $n = 100; my $socket = shift; $conn_max = 0, $conn_sum = 0, $reply_max = 0, $reply_sum = 0; for (my $i=0;$i<$n;$i++) { my $t0 = [gettimeofday]; my $s = IO::Socket::UNIX->new($socket) || die "can't connect to $socket"; my $t1 = [gettimeofday]; $s->print("PING"); $s->getline; my $t2 = [gettimeofday]; $s->close; my $conntime = tv_interval($t0, $t1); $conn_sum += $conntime; if ($conntime > $conn_max) { $conn_max = $conntime; } my $replytime = tv_interval($t1, $t2); $reply_sum += $replytime; if ($replytime > $reply_max) { $reply_max = $replytime; } } $reply_sum /= $n; $conn_sum /= $n; $conn_sum *= 1000; $reply_sum *= 1000; $conn_max *= 1000; $reply_max *= 1000; printf "connect time:%.3f ms avg, %.3f ms max\n", $conn_sum, $conn_max; printf "reply time:%.3f ms avg, %.3f ms max\n", $reply_sum, $reply_max; Best regards, --Edwin _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://www.clamav.net/support/ml
