Re: [clamav-users] clamd cache (was Re: clamscan --disable-cache)

2020-10-07 Thread G.W. Haywood via clamav-users
Hi there, On Wed, 7 Oct 2020, Dave Sill via clamav-users wrote: "G.W. Haywood via clamav-users" wrote: Perhaps try enabling libclamav debug logging. I poked around a bit and didn't see an obvious way to do that ... You just need a line Debug yes in clamd.conf. There might be a "Debug

Re: [clamav-users] clamd cache (was Re: clamscan --disable-cache)

2020-10-07 Thread Dave Sill via clamav-users
"G.W. Haywood via clamav-users" wrote: > > Perhaps try enabling libclamav debug logging. I poked around a bit and didn't see an obvious way to do that, like a configure option or a .h file. Couldn't really tell where it would be logging. > During your scans I suspect that ClamAV may be reaching

Re: [clamav-users] clamd cache (was Re: clamscan --disable-cache)

2020-10-03 Thread G.W. Haywood via clamav-users
Hello again, On Sat, 3 Oct 2020, G.W. Haywood via clamav-users wrote: Stay tuned. Perhaps try enabling libclamav debug logging. During your scans I suspect that ClamAV may be reaching some limit(s) which is causing caching to be disabled. The limits are mostly tunable (in some cases perhaps

Re: [clamav-users] clamd cache (was Re: clamscan --disable-cache)

2020-10-03 Thread G.W. Haywood via clamav-users
Hi there, On Fri, 2 Oct 2020, G.W. Haywood wrote: Trying a bigger directory, this is going to take a while... Doesn't look like telling us anything this side of Christmas so I've killed the process. Time to think a bit harder. Stay tuned. -- 73, Ged. _

Re: [clamav-users] clamd cache (was Re: clamscan --disable-cache)

2020-10-02 Thread Dave Sill via clamav-users
Dave Sill via clamav-users wrote: > > Both of my test systems are RHEL 7, so off to try another platform. On Fedora 32: # find ~dave/Mail -type f|wc -l 26671 # clamdscan --fdpass ~dave/Mail Time: 932.395 sec (15 m 32 s) # clamdscan --fdpass ~dave/Mail Time: 489.627 sec (8 m 9 s) So

Re: [clamav-users] clamd cache (was Re: clamscan --disable-cache)

2020-10-02 Thread Dave Sill via clamav-users
On the desktop system: $ find Mail -type f|wc -l 123719 # clamdscan --fdpass ~de5/Mail Time: 2137.531 sec (35 m 37 s) # clamdscan --fdpass ~de5/Mail Time: 2138.778 sec (35 m 38 s) So, still not seeing a benefit from the cache. Both of my test systems are RHEL 7, so off to try another platform.

Re: [clamav-users] clamd cache (was Re: clamscan --disable-cache)

2020-10-02 Thread Dave Sill via clamav-users
"G.W. Haywood via clamav-users" wrote: > > Only 4GB on my clamd server. > > $ du -sh images/ > 16G images/ > $ find ./images -type f | wc -l > 11586 > $ clamdscan images/ > ... > Time: 12547.333 sec (209 m 7 s) > ... > $ clamdscan images/ > ... > Time: 1477.782 sec (24 m 37 s) That's a nic

Re: [clamav-users] clamd cache (was Re: clamscan --disable-cache)

2020-10-02 Thread G.W. Haywood via clamav-users
Hi there, On Thu, 1 Oct 2020, Dave Sill via clamav-users wrote: "G.W. Haywood via clamav-users" wrote: It might be too soon to draw that conclusion. It's possible that the daemon reloaded its database during your test, and I'd expect that to cause any cached results to be discarded for obvio

Re: [clamav-users] clamd cache (was Re: clamscan --disable-cache)

2020-10-01 Thread Micah Snyder (micasnyd) via clamav-users
ill Subject: Re: [clamav-users] clamd cache (was Re: clamscan --disable-cache) "G.W. Haywood via clamav-users" wrote: > Hi there, > > On Thu, 1 Oct 2020, Dave Sill via clamav-users wrote: > > >It looks like my point was lost in the noise ... > > Sorry, I g

Re: [clamav-users] clamd cache (was Re: clamscan --disable-cache)

2020-10-01 Thread Dave Sill via clamav-users
"G.W. Haywood via clamav-users" wrote: > Hi there, > > On Thu, 1 Oct 2020, Dave Sill via clamav-users wrote: > > >It looks like my point was lost in the noise ... > > Sorry, I guess it was late and I was in a hurry to get to bed. :( No worries. Thanks for your help. > >... on a much smaller

Re: [clamav-users] clamd cache (was Re: clamscan --disable-cache)

2020-10-01 Thread G.W. Haywood via clamav-users
Hi there, On Thu, 1 Oct 2020, Dave Sill via clamav-users wrote: It looks like my point was lost in the noise ... Sorry, I guess it was late and I was in a hurry to get to bed. :( The cache only saved a little over a minute on a 24 minute scan. I tried something similar here on a directory

Re: [clamav-users] clamd cache (was Re: clamscan --disable-cache)

2020-10-01 Thread Dave Sill via clamav-users
It looks like my point was lost in the noise so I'll try to distill it. I ran clamdscan twice on my /home (69k files) and got: # clamdscan --fdpass /home ... Time: 1428.433 sec (23 m 48 s) # clamdscan --fdpass /home ... Time: 1355.057 sec (22 m 35 s) # The cache only saved a little over a minut

Re: [clamav-users] clamd cache (was Re: clamscan --disable-cache)

2020-09-30 Thread G.W. Haywood via clamav-users
Hi there, On Wed, 30 Sep 2020, Dave Sill via clamav-users wrote: Unfortunately, it looks like the cache is too small to help. I ran clamdscan twice on my /home (69k files) and got: # clamdscan --fdpass /home /home/de5/eicar.tar.gz: Eicar-Signature FOUND WARNING: /home/de5/.cisco/hostscan/.lib

[clamav-users] clamd cache (was Re: clamscan --disable-cache)

2020-09-30 Thread Dave Sill via clamav-users
Dave Sill via clamav-users wrote: > > > >Skipping multiple copies of the same file won't really help because > > >the duplication is across systems, and because every file will be > > >rescanned every time clamscan is run. > > > > That's not true of clamdscan. > > Hmm...that's promising. I'll g