On Mon, Sep 09, 2019 at 13:46 PM, Markus Kolb wrote: > Sergey wrote: > >> Since some time there has been a noticeable increase a launch time. >> Startup with all databases takes about 220 seconds now. Startup >> without daily.cld takes 12 seconds. What's happened with daily.cld? > > Hey, > > sorry for breaking the thread, I've just subscribed and have found your post > in the archive: > https://lists.clamav.net/pipermail/clamav-users/2019-September/008496.html > <https://lists.clamav.net/pipermail/clamav-users/2019-September/008496.html> > > So far I've found out, that the most time (about 90%) is lost in "daily.ldb". > > What I can say is, that there is no specific signature which slows it down. > It is the algorithm... it looks like the time needed to load a new signature > depends on the number of sub-signatures (logic) and the number of signatures > already loaded in memory. > I think the Big-O-notation (https://en.wikipedia.org/wiki/Big_O_notation > <https://en.wikipedia.org/wiki/Big_O_notation>) for this algorithm wouldn't > look good. > > So during loading the lines (virus signatures) of ldb-file it becomes slower > and slower. > Very slow is if there are many sub-signatures for a virus signature. There > are more of this kind in the last 3rd or 4th of the ldb-file. > > Maybe these signatures got added in the last months. My logfiles tell me that > the startup time of clamd was ok until February/March 2019. > > greets > Markus
The only thing I can add to this discussion is that in the past there have been a lot of false positives involving .ldb signatures, apparently caused by too few sub-signatures being used to positively identify a file as being malware. So that would appear to be the tradeoff here...load time vs. FPs. -Al- -- ClamXAV User
smime.p7s
Description: S/MIME cryptographic signature
_______________________________________________ clamav-users mailing list clamav-users@lists.clamav.net https://lists.clamav.net/mailman/listinfo/clamav-users Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
