Topic: ClamAV scan suddenly very slow

[henry44]

Here 3 consecutive entries from clamd/clamscan.log

----------- SCAN SUMMARY -----------
Known viruses: 140122
Engine version: 0.90.1
Scanned directories: 14871
Scanned files: 86613
Infected files: 0
Data scanned: 6174.15 MB
Time: 7061.625 sec (117 m 41 s)

----------- SCAN SUMMARY -----------
Known viruses: 140180
Engine version: 0.91.1
Scanned directories: 15656
Scanned files: 89607
Infected files: 73
Data scanned: 6988.00 MB
Time: 22815.491 sec (380 m 15 s)

----------- SCAN SUMMARY -----------
Known viruses: 140254
Engine version: 0.91.1
Scanned directories: 15699
Scanned files: 89639
Infected files: 0
Data scanned: 6988.30 MB
Time: 22881.301 sec (381 m 21 s)

Previous to the first post the scan took about 2 hours. After the jump, about 6 hours.
This happened on or about the 23rd of July of this year.

I looked in the logs and found nothing out of the ordinary. A search of the forums was fruitless as well.

This is a fully patched v.7.2 SME box with no add-ons.
Dual P3 933 MHz, 1GB ram, 2x10k SCSI 18GB drives in raid1 (SME software raid)
Drive management indicates no problems

The difference seems to be the engine version, 0.90.1 then 0.91.1.
What happened?
Is this a problem? I think it is, the box is less responsive during the scan.
How to fix it?

[byte]

What happened?

Well looking at the reports you have an additional 4000+ files and a few hundred more folders...so I'd say thats what happend

[henry44]

I could see an increase in time taken of maybe 30 minutes, but an increase of 4 hours?

Looking at it this way:

Increase in number of files: 785
Percent increase: 5% of 14871
Expected time increase: 5% of 117 minutes=about 6 minutes
Actual time increase: 263 minutes= about 4.5 hours

I don't think the increase in data scanned alone can account for the increase in the time taken. My guess is there is some change in the engine from version 0.90.1 to 0.91.1 that broke something on my installation.

[raem]

My guess is there is some change in the engine from version 0.90.1 to 0.91.1 that broke something on my installation.

If you suspect that, then lodge a bug report at bugzilla. You don't have to prove it, just lodge it & let the support team ask you for what they need to prove or disprove your suspicion.

[henry44]

Done.

[girkers]

Could you post a link to the bug report to make it easier to follow please 

[henry44]

Here you go

http://bugs.contribs.org/show_bug.cgi?id=3353

[henry44]

The suggestion was made to update to the latest engine ver. 0.91.2. that has been done and the problem remains.

[henry44]

Here is the ClamAV bugtracker
https://wwws.clamav.net/bugzilla/show_bug.cgi?id=653

I cleaned out the quarantine folder to reduce the number of files, but no change.
I assume if I change the clamav settings to not quarantine infected files, the files will be deleted. I am going to try that next.

[raem]

henry44

Here is the ClamAV bugtracker
https://wwws.clamav.net/bugzilla/show_bug.cgi?id=653

I cannot access that bug, I get
Access Denied
You are not authorized to access bug #653.

I opened an account & did login. If I search on ALL bugs I get a listing up to bug #648

Is that the right bug number ?

[henry44]

I just checked the page by clicking on the link and was taken to the bug report. I have no idea why you can not get to it.

[raem]

Can anyone else reading this thread access this link ?
https://wwws.clamav.net/bugzilla/show_bug.cgi?id=653
Thanks

[byte]

Can anyone else reading this thread access this link ?
https://wwws.clamav.net/bugzilla/show_bug.cgi?id=653

No, I see what you are getting Ray.

[henry44]

I don't know what to tell you. I can click on the link and get to the bug report.

When I go through the ClamAV home page and search for bug #653, I get to the same bug report.

[jfarschman]

To see that bug you need to have a user on their system.