[clamav-users] Continuous increase of startup time (is daily.cld broken?)

[Al Varnell]

On Mon, Sep 09, 2019 at 13:46 PM, Markus Kolb wrote:
> Sergey wrote:
> 
>> Since some time there has been a noticeable increase a launch time.
>> Startup with all databases takes about 220 seconds now. Startup
>> without daily.cld takes 12 seconds. What's happened with daily.cld?
> 
> Hey,
> 
> sorry for breaking the thread, I've just subscribed and have found your post in the archive:
> https://lists.clamav.net/pipermail/clamav-users/2019-September/008496.html <https://lists.clamav.net/pipermail/clamav-users/2019-September/008496.html>
> 
> So far I've found out, that the most time (about 90%) is lost in "daily.ldb".
> 
> What I can say is, that there is no specific signature which slows it down.
> It is the algorithm... it looks like the time needed to load a new signature depends on the number of sub-signatures (logic) and the number of signatures already loaded in memory.
> I think the Big-O-notation (https://en.wikipedia.org/wiki/Big_O_notation <https://en.wikipedia.org/wiki/Big_O_notation>) for this algorithm wouldn't look good.
> 
> So during loading the lines (virus signatures) of ldb-file it becomes slower and slower.
> Very slow is if there are many sub-signatures for a virus signature. There are more of this kind in the last 3rd or 4th of the ldb-file.
> 
> Maybe these signatures got added in the last months. My logfiles tell me that the startup time of clamd was ok until February/March 2019.
> 
> greets
> Markus

The only thing I can add to this discussion is that in the past there have been a lot of false positives involving .ldb signatures, apparently caused by too few sub-signatures being used to positively identify a file as being malware. So that would appear to be the tradeoff here...load time vs. FPs.

-Al-
-- 
ClamXAV User

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.clamav.net/pipermail/clamav-users/attachments/20190909/ebc7507f/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3907 bytes
Desc: not available
URL: <https://lists.clamav.net/pipermail/clamav-users/attachments/20190909/ebc7507f/attachment.bin>