[clamav-users] clamd cache (was Re: clamscan --disable-cache)

[Dave Sill]

"G.W. Haywood via clamav-users" <clamav-users at lists.clamav.net> wrote:
> Hi there,
> 
> On Thu, 1 Oct 2020, Dave Sill via clamav-users wrote:
> 
> >It looks like my point was lost in the noise ...
> 
> Sorry, I guess it was late and I was in a hurry to get to bed. :(

No worries. Thanks for your help.
 
> >... on a much smaller scan, the cache made a huge difference. That
> >tells me that the cache isn't large enough to significantly speed up
> >large scans.
> 
> It might be too soon to draw that conclusion.  It's possible that the
> daemon reloaded its database during your test, and I'd expect that to
> cause any cached results to be discarded for obvious reasons.

Fair enough. I re-ran the same scan three times after rebooting and got
the following run times:

20:46
19:37
19:18

And the clamd logs show "SelfCheck: Database status OK" every 10 minutes
but no DB updates.

> >I don't see that the cache size is run-time configurable. Is that right?
> 
> Correct, but I'd thought its size would be limited only by the RAM you
> have free.  If you look at the code in libclamav/cache.c you can see
> that struct cache_set is just a few pointers, and if you only have 69k
> files under your home directory I wouldn't expect storage of that many
> sets of pointers to be an issue.
> 
> I'll dig into this a bit more when I have chance if somebody doesn't
> beat me to it.

I only have 16 GB RAM on this system but it still shows 1 GB free.
Maybe it limits itself somehow.

-Dave