Topic: clamd versus clamscan

[mophilly]

Today I noticed that clamscan was running, and that it ran for nearly 7 hours. The system does have a fair amount of data, about 180GB. However, I wasn't aware that clamscan was being invoked. I thought clamd was handling the workload.

I can see clamd show up in top from time to time as expected. I do have SME backup (not affa) enabled.

What is the normal use of clamd and clamscan in the SME distro?

[janet]

Mophilly

clamd monitors email for viruses, enabled in server manager
clamscan scans your server files for viruses, seperately (than clamd) enabled in server manager

PS a google search would have answered both these for you, so please search first

[mophilly]

Thank you, Janet.

I did not state my question properly.

We have observed clamscan running for eight hours today, and yesterday. This is causing a drag on the system, naturally.

My expectation is that a full scan occurs on some schedule, say weekly, but not daily. It seems to me the daily scan should consider only files changed or added in the past 24 hours.

This also seems to be a new behavior, or previously unnoticed, as we have not modified the system save for SME updates in the past month or so.

My question is this, what is the normal schedule of operations for invoking clamscan? Do I need to adjust something to gain better system performance?

[Stefano]

Well.. Did you spend at least 2 mins to check cron* files/dirs and your configuration?
As Janet pointed out, clamd is used for mail real-time scan and clamscan for fs scan.
You're here since a quite long time now: I expect you're able to debug your server.
If you find something that isn't working as expected, please give us some facts (configuration, logs etc) to help you
Thank you

[janet]

Mophilly

As advised, virus scan schedule setting is in server manager.
It seems you have daily  file system scanning enabled, so as you are less happy with this, then I suggest you change it to weekly scan.

Virus scanning will use a lot of  processor resources.
File system scanning time will increase as your file system gets bigger & the size & types of files also affect performance.

What you have advised so far does not seem abnormal.

My expectation is that a full scan occurs on some schedule, say weekly, but not daily.

My question is this, what is the normal schedule of operations for invoking clamscan?

[mophilly]

Doh! I completely forgot about the manager panel! Sorry for the noise.

Still, a question remains. This setting has not been changed in a very long time. Yet, we have noticed slower performance recently. There has been news about the Intel processor flaws and performance. I am wondering what might be different from, say, last week.

In any case, thank you for your responses. Very much appreciated.

[janet]

Mophilly

I am wondering what might be different from, say, last week.

Already answered in part.
File system scanning time will increase as your file system gets bigger & the size & types of files also affect performance.

You need to investigate your server to see what else may be going on.

What problem are you actually noticing (apart from taking 8 hrs to complete)  ?

You could temporarily disable file system scanning to see if you notice a significant change (improvement).
Maybe you want to exclude certain ibays from scanning and/or play with "nice" settings for clamscan & so on...

[SchulzStefan]

Doh! I completely forgot about the manager panel! Sorry for the noise.

Still, a question remains. This setting has not been changed in a very long time. Yet, we have noticed slower performance recently. There has been news about the Intel processor flaws and performance. I am wondering what might be different from, say, last week.

In any case, thank you for your responses. Very much appreciated.

Maybe you want to read this: https://forums.contribs.org/index.php/topic,53476.0.html