Hi there,
On Wed, 30 Sep 2020, Dave Sill via clamav-users wrote:
The clamscan man page says:
--disable-cache
Disable caching and cache checks for hash sums of scanned files.
I've looked high and low via google, strace, looking at source code, conducting
tests,
and I see no sign of caching done by clamscan. Is this on the to-do list?
Perhaps the output below will help. In it, I've added only a couple
of blank lines for clarity. No other changes at all. Look carefully.
8<----------------------------------------------------------------------
$ ls -l clamav-0.103.0-rc2.tar.gz clamav-0.103.0-rc2-copy.tar.gz
-rw-r--r-- 1 ged ged 13356212 Sep 30 13:14 clamav-0.103.0-rc2-copy.tar.gz
-rw-r--r-- 1 ged ged 13356212 Sep 3 10:14 clamav-0.103.0-rc2.tar.gz
$ clamscan clamav-0.103.0-rc2.tar.gz
/home/ged/clamav-0.103.0-rc2.tar.gz: OK
----------- SCAN SUMMARY -----------
Known viruses: 11312903
Engine version: 0.103.0-rc2
Scanned directories: 0
Scanned files: 1
Infected files: 0
Data scanned: 13.56 MB
Data read: 12.73 MB (ratio 1.06:1)
Time: 88.628 sec (1 m 28 s)
Start Date: 2020:09:30 13:17:25
End Date: 2020:09:30 13:18:54
$ clamscan clamav-0.103.0-rc2.tar.gz clamav-0.103.0-rc2-copy.tar.gz
/home/ged/clamav-0.103.0-rc2.tar.gz: OK
/home/ged/clamav-0.103.0-rc2-copy.tar.gz: OK
----------- SCAN SUMMARY -----------
Known viruses: 11312903
Engine version: 0.103.0-rc2
Scanned directories: 0
Scanned files: 2
Infected files: 0
Data scanned: 13.56 MB
Data read: 25.47 MB (ratio 0.53:1)
Time: 88.867 sec (1 m 28 s)
Start Date: 2020:09:30 13:19:43
End Date: 2020:09:30 13:21:12
8<----------------------------------------------------------------------
In the second scan, how did clamscan manage to do what it claims to
have done in the time that it did it?
We'd like to regularly scan systems but the overhead of scanning the same files
repeatedly is a bit much. A per-system cache would be good. Even better would
be a
centralized, local to our network, service that clamscan could check & update.
For further enlightenment, on one of your systems try doing something
similar to what I did above but using 'clamdscan'. Consider using a
central clamd server for all your scanning needs.
I suppose that would be pretty easy to add on top.
Anyone done anything like that?
I doubt anyone is doing that. I'm sure it isn't necessary, as it's
already taken care of by both clamscan and clamd. Perhaps if you can
be a bit more forthcoming about your use case(s) we may be able to
help reduce scan times. One of the best ways of doing that is not to
scan so much junk so often.
--
73,
Ged.
_______________________________________________
clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users
Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq
http://www.clamav.net/contact.html#ml
