[clamav-users] Clamd no stop scan

[jmedard at amv-sa.fr]

Morning,

 

Some email scan are very slow. This is happening more and more often, and
seems more related to Clamd's demime problems than real email attachments
concerns.

Here is an example of an email that takes several minutes to analyze:

 

# time clamdscan 1hDTxy-0002Dk-Lc.eml

/tmp/eml/1hDTxy-0002Dk-Lc.eml: OK

 

----------- SCAN SUMMARY -----------

Infected files: 0

Time: 199.716 sec (3 m 19 s)

 

real    3m19,720s

user    0m0,004s

sys     0m0,000s

 

 

Regardless of this, regardless of the file transmitted to clamd by
clamdscan, if the analysis is interrupted (for example after 5 seconds of
analysis), the analysis of it continues, even after the ReadTimeout or any
other TimeOut. Attached is a copy of clamdtop after making a CTRL + C
clamdscan. It lasts until complete analysis (more than 5 minutes).

 

Do you find normal that the clamd process continues its analysis despite the
end of the clamdscan call process and even after exceeding the various
TimeOut?

Regards

 

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.clamav.net/pipermail/clamav-users/attachments/20190408/c39d28b0/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: clamdscan.png
Type: image/png
Size: 16806 bytes
Desc: not available
URL: <https://lists.clamav.net/pipermail/clamav-users/attachments/20190408/c39d28b0/attachment.png>