[clamav-users] Squid + ClamAV

[Andrea Venturoli]

Hello.

I'm trying the combination Squid + C-ICAP + SquidClamAV + ClamAV, and 
I'm seeing terrible performance.
It seems there's no SquidClamAV specific mailing list and asking on 
generic Squid list did not help much.
Perhaps someone here is using the same thing or knows how to better 
tweak the engine.



The whole thing is working, but page loading times varies a lot: 
sometimes they'll load as fast as without virus scanning, but often (the 
same pages) will take several seconds to display (with ClamAV eating a 
lot of CPU).
I tried to see what is being scanned, but since SquidClamaAV uses inline 
connections, clamdtop seems to be helpless.

So I'm looking for suggestions on how to fine-tune ClamAV (and/or 
SquidClamaAV) for this specific use case: whitelists, blacklists, which 
ruleset are to be used/avoided, and so on.

Anyone already had a look at this?

  bye & Thanks
	av.