[clamav-users] Slow reload

[Bowie Bailey]

On 3/19/2019 4:27 PM, Bowie Bailey wrote:
> On 3/19/2019 10:44 AM, Arnaud Jacques wrote:
>> Hello Bowie,
>>
>> Le 19/03/2019 à 15:35, Bowie Bailey a écrit :
>>> ClamAV is taking about 2 1/2 minutes to reload its database on my mail server.  This
>>> seems to frequently happen when we are sending an email, so the Thunderbird will time
>>> out on the send (although the message will frequently go through anyway).
>>>
>>> I do have a bunch of third party signatures installed from Sanesecurity and
>>> SecuriteInfo.  Is there a way to get timing information on which signature files are
>>> taking the longest to load?  Or is this mainly a function of file size?
>> javascript.ndb is taking most of the reload time.
>> You can test the time to reload without this file
> Without javascript.ndb, the reload time drops to 2 minutes.  Better, but still longer
> than I'd like.
>
> Is there a way to get the details on how long each file take to load, or do I just
> have to test them one by one?

I did a check on the SecuriteInfo signatures.  I grepped my clamd logs for hits on
SecuriteInfo signatures and then matched them to the file they came from.

#1 was spam_marketing.ndb with 110 hits
#2 was javascript.ndb with 10 hits

And that was it.  securiteinfo.hdb, securiteinfohtml.hdb, and securiteinfoascii.hdb
did not produce a single hit on my system in the past year.  Unfortunately, removing
those signatures does not have much of an effect on the reload times.

-- 
Bowie