Hello Paul,
No, I believe it's cache! If I restart clamd and run scan, it would take
same amount of time as clamscan. But from next time onwards, it would take
considerably less. This is mainly because the server I am trying is almost
still. With busy server, the benefit would be proportional to number of files
changed\added.
That makes me ask question, what is "--disable-cache" option for
*clamscan* is which states "Disable caching and cache checks for hash sums
of scanned files."?
I came across following question in this list:
https://www.mail-archive.com/clamav-users@lists.clamav.net/msg49220.html
/quote
..Correct, but I'd thought its size would be limited only by the RAM you
have free...
/quote
Does that mean clamscan does not have cache at all or caching means something
else here or is it that when running clamscan do I to somehow _activate_ cache?
Thanks in advance,
-Neel.
From: Paul Silvestri <psilvest...@gmail.com>
Sent: Sat, 07 Dec 2024 08:55:13
To: neel roy <neelsm...@rediffmail.com>
Cc: Eddie via clamav-users <clamav-users@lists.clamav.net>
Subject: Re: [clamav-users] Difference between clamscan and clamdscan scanning
time
Ah my apologies, I misread the first part of your message.
It may be worth checking your clamd.conf and recreate those options via the CLI
commands when running clamscan.
On Dec 6, 2024, 10:21 PM -0500, neel roy <neelsm...@rediffmail.com>,
wrote:
Hello Paul,
Thanks for reply. Yes, I have read that. I am expecting that engine creation
and virus definition loading will take some time. Based on output I see, it
takes about 23 seconds to load virus definitions, to round of I considered 30
seconds. That leaves about 2 min 40 seconds. I do not see any messages even
with "-v" (verbose) option about engine creation. But assume it takes
another 40 seconds.That's still 2 minutes versus 9 seconds. Should there be
*that* big a difference?
Thanks in advance,
-Neel.
From: Paul Silvestri <psilvest...@gmail.com>
Sent: Sat, 07 Dec 2024 08:43:59
To: Eddie via clamav-users <clamav-users@lists.clamav.net>
Cc: neel roy <neelsm...@rediffmail.com>
Subject: Re: [clamav-users] Difference between clamscan and clamdscan scanning
time
Per the docs:
"clamscan is a command line tool which uses libclamav to scan files and/or
directories for viruses. Unlike clamdscan, clamscan does not require a running
clamd instance to function. Instead, clamscan will create a new engine and
load in the virus database each time it is run. It will then scan the
files and/or directories specified at the command line, create a scan report,
and exit."
https://docs.clamav.net/manual/Usage/Scanning.html#clamscan
On Dec 6, 2024, 10:08 PM -0500, neel roy via clamav-users
<clamav-users@lists.clamav.net>, wrote:
Hello,
I passed 10,000 files listed in the file to clamscan and clamdscan. I see very
big difference on 4 cpu bare metal machine. Why is it?
I am using clamav 1.0.7.
clamscan -f large_files.txt - 3 mins 5 seconds
clamdscan --fdpass -f large_files.txt - 9 seconds
Notes
- For clamdscan, I am *not* using -m option.
- For clamdscan, without "--fdpass" it would give "permission
denied" errors.
I understand that first 20-30 seconds or so I see clamscan is loading virus
definitions. Even without that, the difference is difference is very big. What
accounts for it?
Thanks in advance,
-Neel.
_______________________________________________
Manage your clamav-users mailing list subscription / unsubscribe:
https://lists.clamav.net/mailman/listinfo/clamav-users
Help us build a comprehensive ClamAV guide:
https://github.com/Cisco-Talos/clamav-documentation
https://docs.clamav.net/#mailing-lists-and-chat
_______________________________________________
Manage your clamav-users mailing list subscription / unsubscribe:
https://lists.clamav.net/mailman/listinfo/clamav-users
Help us build a comprehensive ClamAV guide:
https://github.com/Cisco-Talos/clamav-documentation
https://docs.clamav.net/#mailing-lists-and-chat
