Topic: [7.1] clamscan taking a very long time

[dtech]

Hi All;

I have a strange problem to work out; since updating a 7.0 SME to 7.1, clamscan (set for a weekly scan) is now taking well over 24 hours to complete a virus scan on the same amount of data that used to take about 8 hours. In fact, I haven't been able to let clamscan complete a scan since updating; I've had to kill the process since it was taking close to 100% CPU on a Monday morning. I'm wondering where to start troubleshooting this.

This is only happening on one of three SME 7.1 servers. None of the servers handle email, they're really just file servers. One of the servers has a lot more data on it than the one in question too, which doesn't make apparent sense...

Thanks,

-P

[CharlieBrady]

I'm wondering where to start troubleshooting this.

All problems should be reported via the Bug Tracker.

[dtech]

I'm wondering where to start troubleshooting this.

All problems should be reported via the Bug Tracker.

Charlie;

It's possible that clamscan is behaving exactly as it should. I'm asking the community for advice on troubleshooting; I've only done a cursory investigation of the issue at this point, and am not ready to decide that the issue I am experiencing is a bug. I'm inclined to try to figure out the problem first, that way I learn. Furthermore, about half of my issues are self inflicted and I don't care to waste the developers' time with that stuff.

If there is a defined protocol for bug discovery and reporting that suggests going straight to bugzilla, I'd like to read it so I can comply. Please direct me to it.

Thanks,

-P

[mercyh]

dtech,

If this is a multiprocessor machine I would check that the .smp kernel is loaded after the update.

uname -a

should return which kernal is in use.

[dtech]

dtech,

If this is a multiprocessor machine I would check that the .smp kernel is loaded after the update.

uname -a

should return which kernal is in use.

Hi mercyh;

It's a single processor machine;

Code: [Select]

Linux cmgc-server 2.6.9-42.0.3.ELsmp #1 SMP Fri Oct 6 06:21:39 CDT 2006 i686 athlon i386 GNU/Linux

-P

[mercyh]

You are running the multiprocessor kernel. I don't really think that is a problem though.

You probably know this but the single processor kernel is the .EL kernel

[mercyh]

dtech,

Do a search on the forum on clamscan scanning time. There was a topic a few months ago on which users were asked to post there server information, amount of data and scanning time. This might let you know if what you are experiencing is "normal".

[mercyh]

here is the thread. Don't know if this helps as the change from 7.0>7.1 seems to have changed something for you.

http://forums.contribs.org/index.php?topic=34024.0

[dtech]

dtech,

Do a search on the forum on clamscan scanning time. There was a topic a few months ago on which users were asked to post there server information, amount of data and scanning time. This might let you know if what you are experiencing is "normal".

mercyh;

I'm comparing the current (7.1) scanning time on this particular server to the previous (7.0) scanning time on the same server; it's tripled. I'm thinking this has something to do with something on the server that resides in /home/e-smith/files/? added recently that is slowing things down.

With this in mind, I think I may try a clamscan with verbose logging enabled, and then look to see where it's spending its time. I guess I should put that off until after work hours.

-P

[dtech]

OK, did a test scan yesterday. clamscan churned along just fine until it got to a 400+ MB email mbox file. Then, running top, kswapd0 and clamscan were the top two alternating processes for about seven hours before I killed clamscan. The verbose output from clamscan showed that it was still working on the previously mentioned mbox file.

Looking through bugzilla again I see this, which looks like the problem I'm having.

http://bugs.contribs.org/show_bug.cgi?id=1660

This server has 512 MB RAM, which I will upgrade to 1 GB soon and try again.

CharlieBrady, does this look like something that I should put in bugzilla at this point? It seems like it's a problem with clamav, not SME. What do you recommend?

-P

[jester]

dtech,

Maybe your findings are related to this:
http://bugs.contribs.org/show_bug.cgi?id=461

Kind regards,
jester.

[piran]

[shows what's being excluded]

Code: [Select]

/sbin/e-smith/db configuration getprop clamav FilesystemScanExclude

[dtech]

I've added my comments to bug 461.

http://bugs.contribs.org/show_bug.cgi?id=461

[dtech]

Just to follow up; I added 512 MB to this particular server, so now it has a GB of RAM. Also instructed the users to do some housekeeping. The original file that clamscan was getting stuck on is a little smaller, about 378 MB. I ran a scan last night, and it went through 25,539 files, 21520.90 MB in 369 minutes and 34 seconds.

-P

[dtech]

Another item of note relative to this thread, I see on freshmeat today that the new .90 version of clam claims this improvement:

Email decoding has been improved to reduce both the memory requirements and the time taken to process attachments.

-P