[clamav-users] Fwd: Clamd performance issues in docker image
Zayan abdul shukoor
zayan.as.plc at gmail.com
Fri Sep 11 10:29:59 UTC 2020
Hi,
We observed performance issues using clamd docker image (
https://hub.docker.com/r/mkodockx/docker-clamav/dockerfile) for virus
scanning.
Our application and clamd (side car deployment) resides on the same pod.
The application sends .zip files (200 KB - 300 KB) to clamd over tcp to
scan using INSTREAM command. The client library that is used is
https://github.com/cdarras/clamav-client library. The .zip file usually
contains multiple xml files and txt files.
We were able to achieve around 4 request per second with 10 vcpu limit for
clamd docker image.
By turning off ScanArchive (false) , the request per second increases to
25. When the scanarchive is true, there are too many requests waiting in
the queue (QUEUEDSINCE) , as observed in clamdtop. But it doesn’t detect
the virus file inside the zip. Is it possible to detect virus inside the
zip with ScanArchive turned off?
Attached is the strace, clamd.conf, pidstat, iostat, htop data during
performance testing.
We are suspecting some issues while writing to the temp directory and
scanning the individual files inside the zip file. We are not able to root
cause the same.
Please let me know your thoughts. Your help is highly appreciated.
Thanks
Zayan
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.clamav.net/pipermail/clamav-users/attachments/20200911/71d860ed/attachment.htm>
-------------- next part --------------
strace: Process 15 attached
restart_syscall(<... resuming interrupted poll ...>) = 1
read(6, "\0", 1025) = 1
poll([{fd=6, events=POLLIN}, {fd=10, events=POLLIN}], 2, 30000) = 1 ([{fd=10, revents=POLLIN}])
recvmsg(10, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="nVERSIONCOMMANDS\n", iov_len=4104}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 17
sendto(10, "ClamAV 0.102.4/25925/Wed Sep 9 "..., 46, 0, NULL, 0) = 46
sendto(10, " COMMANDS:", 10, 0, NULL, 0) = 10
sendto(10, " SCAN", 5, 0, NULL, 0) = 5
sendto(10, " QUIT", 5, 0, NULL, 0) = 5
sendto(10, " RELOAD", 7, 0, NULL, 0) = 7
sendto(10, " PING", 5, 0, NULL, 0) = 5
sendto(10, " CONTSCAN", 9, 0, NULL, 0) = 9
sendto(10, " VERSIONCOMMANDS", 16, 0, NULL, 0) = 16
sendto(10, " VERSION", 8, 0, NULL, 0) = 8
sendto(10, " STREAM", 7, 0, NULL, 0) = 7
sendto(10, " END", 4, 0, NULL, 0) = 4
sendto(10, " SHUTDOWN", 9, 0, NULL, 0) = 9
sendto(10, " MULTISCAN", 10, 0, NULL, 0) = 10
sendto(10, " FILDES", 7, 0, NULL, 0) = 7
sendto(10, " STATS", 6, 0, NULL, 0) = 6
sendto(10, " IDSESSION", 10, 0, NULL, 0) = 10
sendto(10, " INSTREAM", 9, 0, NULL, 0) = 9
sendto(10, " DETSTATSCLEAR", 14, 0, NULL, 0) = 14
sendto(10, " DETSTATS", 9, 0, NULL, 0) = 9
sendto(10, " ALLMATCHSCAN", 13, 0, NULL, 0) = 13
sendto(10, "\n", 1, 0, NULL, 0) = 1
shutdown(10, SHUT_RDWR) = 0
close(10) = 0
futex(0x7fffd88c1b10, FUTEX_WAKE_PRIVATE, 1) = 1
poll([{fd=6, events=POLLIN}, {fd=10, events=POLLIN}], 2, 30000) = 2 ([{fd=6, revents=POLLIN}, {fd=10, revents=POLLIN}])
recvmsg(10, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="zINSTREAM\0\0\0\10\0PK\3\4\24\0\2\0\10\0e\227\345Niu\16:"..., iov_len=4104}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 4104
read(6, "\0", 1025) = 1
openat(AT_FDCWD, "/clamavtmp/clamav-40a202a036856c5f0af60b8ea348ad8b.tmp", O_RDWR|O_CREAT|O_EXCL|O_TRUNC, 0700) = 11
write(11, "PK\3\4\24\0\2\0\10\0e\227\345Niu\16:!`\0\0\324\20\4\0-\0\34\0002J"..., 2048) = 2048
write(11, "\27\241\334En\275A\r\265s\204Xm<\342\n\370\331\rC\327\217\237\257`\307\n\v\365\7\0\16"..., 2038) = 2038
poll([{fd=6, events=POLLIN}, {fd=10, events=POLLIN}], 2, 180000) = 1 ([{fd=10, revents=POLLIN}])
recvmsg(10, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="3oL\236\346U\0\350\277\7\0\0\10\0\17\203\vb\217\2\330\324\347\255\232\260=y\3412\372\340"..., iov_len=4104}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 4104
write(11, "3oL\236\346U\0\350\277\7", 10) = 10
write(11, "\17\203\vb\217\2\330\324\347\255\232\260=y\3412\372\340\316\276\271!K\316\266\214h\361\274~L\331"..., 2048) = 2048
write(11, "\357\236\344\35f\372F\243\333\33\217&\17\335\232\333\352\364j\366\2445\306\313FX\2559\31w:\275"..., 2038) = 2038
poll([{fd=6, events=POLLIN}, {fd=10, events=POLLIN}], 2, 180000) = 1 ([{fd=10, revents=POLLIN}])
recvmsg(10, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\0227\t\207\311K<\346\0341\0\0\10\0~\374\215\307h\311\f\5\23|\30\360w\257;#\356\5"..., iov_len=4104}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 4104
write(11, "\0227\t\207\311K<\346\0341", 10) = 10
write(11, "~\374\215\307h\311\f\5\23|\30\360w\257;#\356\5\271\351\322\3744\200\375\301\273\2457\33\3431"..., 2048) = 2048
write(11, "\266\332C-\3m\32(\330d\336Z#\235\234\210!zx]\3356A3\326\344\211Z$\272'p"..., 2038) = 2038
poll([{fd=6, events=POLLIN}, {fd=10, events=POLLIN}], 2, 180000) = 1 ([{fd=10, revents=POLLIN}])
recvmsg(10, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\305N\362n\314\303\317\23w\4\0\0\10\0\177<\363\24^\336\34\0\235\210\224\22\365\215\v\2201\26"..., iov_len=4104}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 4104
write(11, "\305N\362n\314\303\317\23w\4", 10) = 10
write(11, "\177<\363\24^\336\34\0\235\210\224\22\365\215\v\2201\26\236\371\343\213\340\233?\v\334\361\225\370\10\301"..., 2048) = 2048
write(11, "z\345\224\2473\273\335\350$\253\37\3027\3\"\3357\224\321\3343\273\266\332\25\255\222\316 \312*z"..., 2038) = 2038
poll([{fd=6, events=POLLIN}, {fd=10, events=POLLIN}], 2, 180000) = 1 ([{fd=10, revents=POLLIN}])
recvmsg(10, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="-\3443\n|\306\t\327\215\17\0\0\10\0\31\34\267q\16\356\r\230\25\341\351\362=\323\25\332\3\261"..., iov_len=4104}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 4104
write(11, "-\3443\n|\306\t\327\215\17", 10) = 10
write(11, "\31\34\267q\16\356\r\230\25\341\351\362=\323\25\332\3\261\372*\376G\261#:\217ga\227\314Eb"..., 2048) = 2048
write(11, "X\234k\376\335d\26\256\345o\260\366\25*\nj\7\24aVv\32\367m\2578\327\374\1\305\322\215"..., 2038) = 2038
poll([{fd=6, events=POLLIN}, {fd=10, events=POLLIN}], 2, 180000) = 1 ([{fd=10, revents=POLLIN}])
recvmsg(10, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\242\263\223\5\205\3\262\360\253\355\0\0\10\0\v \247r\374\33]\276\0002(G\260\264\371\2\235\226"..., iov_len=4104}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 4104
write(11, "\242\263\223\5\205\3\262\360\253\355", 10) = 10
write(11, "\v \247r\374\33]\276\0002(G\260\264\371\2\235\226\316\25\226r\372a\270\213\365\371\201\30q\276"..., 2048) = 2048
write(11, "\314\6\225\217\223\0055\246H\212\304\264\367\3563&l\257\36s\17\224'\331\342)\245p>\373+\240"..., 2038) = 2038
poll([{fd=6, events=POLLIN}, {fd=10, events=POLLIN}], 2, 180000) = 1 ([{fd=10, revents=POLLIN}])
recvmsg(10, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="rv\177=\272\10\360\302\312D\0\0\10\0{)\306G\\\350\267m?D\355k\20>\257\215\310\5"..., iov_len=4104}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 4104
write(11, "rv\177=\272\10\360\302\312D", 10) = 10
write(11, "{)\306G\\\350\267m?D\355k\20>\257\215\310\5jI\262\251\301\v\326\215q\362&\n\220\266"..., 2048) = 2048
write(11, "\312i\321\255J/\364\37\207\343n\226e\211\264icMd\246d\252RX-\tp\2\245\310\223\251"..., 2038) = 2038
poll([{fd=6, events=POLLIN}, {fd=10, events=POLLIN}], 2, 180000) = 1 ([{fd=10, revents=POLLIN}])
recvmsg(10, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\342/\216g\241*\353\"\212\350\0\0\10\0\22e\326M\24\323%\312\254\2330\252\313\264YGq\\"..., iov_len=4104}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 4104
write(11, "\342/\216g\241*\353\"\212\350", 10) = 10
write(11, "\22e\326M\24\323%\312\254\2330\252\313\264YGq\\\227\252s\256\302\310.U\347\\\205\261]\252"..., 2048) = 2048
write(11, "\250\340\342\247\1\341\215\306#\317v\2\362\333\232\256w\263\245\330|6\210\360\f?)+\351\366I\364"..., 2038) = 2038
poll([{fd=6, events=POLLIN}, {fd=10, events=POLLIN}], 2, 180000) = 1 ([{fd=10, revents=POLLIN}])
recvmsg(10, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\315\343\256\234\350\315\200\343\241\1\0\0\10\0\f\253\325\222{X\1\n]\326m'\352\34\374\276\373)"..., iov_len=4104}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 4104
write(11, "\315\343\256\234\350\315\200\343\241\1", 10) = 10
write(11, "\f\253\325\222{X\1\n]\326m'\352\34\374\276\373)>\317K\370\3213y\235/\f\366\22\246O"..., 2048) = 2048
write(11, "\34\35\345\36\374\200.\3151\365\356\355)5'\326\274]\227N\345\213\337\24\220\345y\251\306\320\235\321"..., 2038) = 2038
poll([{fd=6, events=POLLIN}, {fd=10, events=POLLIN}], 2, 180000) = 1 ([{fd=10, revents=POLLIN}])
recvmsg(10, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\251\371\272S\323D\324\254NY\0\0\10\0\335\2119E\235B\335\225\260\212Z\305\272+\343\25\365\270"..., iov_len=4104}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 4104
write(11, "\251\371\272S\323D\324\254NY", 10) = 10
write(11, "\335\2119E\235B\335\225\260\212Z\305\272+\343\25\365\270\272+e\0265\271\272+e\0265\271\272+"..., 2048) = 2048
write(11, "\336h\361\316\354\304\21\353\314f0\31\365\271\250\f\4/b\261\255\313I\30\306\340\244\301\20ER("..., 2038) = 2038
poll([{fd=6, events=POLLIN}, {fd=10, events=POLLIN}], 2, 180000) = 1 ([{fd=10, revents=POLLIN}])
recvmsg(10, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\331\230\336*\262x\26\t\277\336\0\0\10\0\300\331:\357s\27\21\273\240\300\367\252\0{\364\2432\317"..., iov_len=4104}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 4104
write(11, "\331\230\336*\262x\26\t\277\336", 10) = 10
write(11, "\300\331:\357s\27\21\273\240\300\367\252\0{\364\2432\317\n!\336\261\316 \224\34Q{\352\323D\317"..., 2048) = 2048
write(11, "\355][s\3338\226~N\252\346?\240\263\17\233T\217e\336E\251\34\315\352\342\333D\262\325\226\234"..., 2038) = 2038
poll([{fd=6, events=POLLIN}, {fd=10, events=POLLIN}], 2, 180000) = 1 ([{fd=10, revents=POLLIN}])
recvmsg(10, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\347\20\v\260\311<\25Sl\236\0\0\10\0@\2572O\305\2541OP\374n\363\314\355\356\201F\370"..., iov_len=4104}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 4104
write(11, "\347\20\v\260\311<\25Sl\236", 10) = 10
write(11, "@\2572O\305\2541OP\374n\363\314\355\356\201F\370\237\346)4\317\203\23\177\35\204\326\271\7\365"..., 2048) = 2048
write(11, "\252\245\250\222\30\2332\227U$T\250&18en\261\332\211A\230\262\30\2342\227U$TK\225"..., 2038) = 2038
poll([{fd=6, events=POLLIN}, {fd=10, events=POLLIN}], 2, 180000) = 1 ([{fd=10, revents=POLLIN}])
recvmsg(10, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="c\363\222M\331h<\253\2200\0\0\10\0\255\306\303\337\0026yWa\253q\353\267\200M\331U\330"..., iov_len=4104}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 4104
write(11, "c\363\222M\331h<\253\2200", 10) = 10
write(11, "\255\306\303\337\0026yWa\253q\353\267\200M\331U\330j\374\372-`Sw\25\266\32W~\v\330"..., 2048) = 2048
write(11, "I\231zmRt\307\21\374\306\215\351\324B\364\25\3514\37(?-\351\373\323Q\245\266!%m\355"..., 2038) = 2038
poll([{fd=6, events=POLLIN}, {fd=10, events=POLLIN}], 2, 180000) = 1 ([{fd=10, revents=POLLIN}])
recvmsg(10, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\227\265r\256\231\343\352|\366\353\0\0\10\0\371v\16\371\242\313U\307\0U\366\7#\261\366\32\321\325"..., iov_len=4104}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 4104
write(11, "\227\265r\256\231\343\352|\366\353", 10) = 10
write(11, "\371v\16\371\242\313U\307\0U\366\7#\261\366\32\321\325\270\365fL\\#\217uj\6\266\3329\307"..., 2048) = 2048
write(11, "\10>\35\16\237\2545\341\217\3457\202\323\303\353~\247\251t\7\270;\200\377\346\316\265G\353\366\270K"..., 2038) = 2038
poll([{fd=6, events=POLLIN}, {fd=10, events=POLLIN}], 2, 180000) = 1 ([{fd=10, revents=POLLIN}])
recvmsg(10, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="1\27610uVv\3116S\0\0\10\0e[l\326th\204\232\322\250\31\206\331xQ\10\212^"..., iov_len=4104}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 4104
write(11, "1\27610uVv\3116S", 10) = 10
write(11, "e[l\326th\204\232\322\250\31\206\331xQ\10\212^\372\267\"8\264]{^2\340\275V\324D"..., 2048) = 2048
write(11, "\211\252+`\3001\235\313Z;\311\33\3000\7\363\236\257\326d\n\25\26\376\206\326\16\26>\272}\10"..., 2038) = 2038
poll([{fd=6, events=POLLIN}, {fd=10, events=POLLIN}], 2, 180000) = 1 ([{fd=10, revents=POLLIN}])
recvmsg(10, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\230LZ\240\322\264\277\340\305B\0\0\10\0H\267D\244\323\354\341e\262\366\220\31U\227xU\367\261"..., iov_len=4104}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 4104
write(11, "\230LZ\240\322\264\277\340\305B", 10) = 10
write(11, "H\267D\244\323\354\341e\262\366\220\31U\227xU\367\2617\215:\335\253\210\314\6\311$\273\314\0\351"..., 2048) = 2048
write(11, "D\21\230\215BU\375ljG\225\274:\305m\206\t\251\371T\312\325\17\31e\303\251\24)\216\225\233"..., 2038) = 2038
poll([{fd=6, events=POLLIN}, {fd=10, events=POLLIN}], 2, 180000) = 1 ([{fd=10, revents=POLLIN}])
recvmsg(10, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\364\313\263L\360\25v\312\242\263\0\0\10\0Lo\346#\r\310\367\246\21b{\332h\34c\34z\376"..., iov_len=4104}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 4104
write(11, "\364\313\263L\360\25v\312\242\263", 10) = 10
write(11, "Lo\346#\r\310\367\246\21b{\332h\34c\34z\376\374q\7\262\206\336\320\214\326Vk\327\317\7"..., 2048) = 2048
write(11, "0\267JP\333:AK\331*A}S\202\3154A}\273\0047\269K\320R\37\247\310Y\202M"..., 2038) = 2038
poll([{fd=6, events=POLLIN}, {fd=10, events=POLLIN}], 2, 180000) = 1 ([{fd=10, revents=POLLIN}])
recvmsg(10, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\4\35<\204\304\307\340\205\343\24\0\0\10\0\306w\353\0Z\250SHB\233\240\217\242\266T%\227D"..., iov_len=4104}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 4104
write(11, "\4\35<\204\304\307\340\205\343\24", 10) = 10
write(11, "\306w\353\0Z\250SHB\233\240\217\242\266T%\227D^:IC\220\7\360R\224\226\246\200j>"..., 2048) = 2048
write(11, "\250W\326\314v/ooS\30\5\324X8\252^:\313K\27\311\2618\206p\2125\4\234b\206\372"..., 2038) = 2038
poll([{fd=6, events=POLLIN}, {fd=10, events=POLLIN}], 2, 180000) = 1 ([{fd=10, revents=POLLIN}])
recvmsg(10, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\275\246\343\302\361KD\207\177b\0\0\10\0\347\212Z\213\200~\211,\243w9\304^|\345:0\360"..., iov_len=4104}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 4104
write(11, "\275\246\343\302\361KD\207\177b", 10) = 10
write(11, "\347\212Z\213\200~\211,\243w9\304^|\345:0\360\372B\214b\2051]\332\270\252\265\306\203\f"..., 2048) = 2048
write(11, "\205;\375\262\347\203\33\357\227GX\235\330\336\222\371\230\354\206\321\232\364\330\7\355B\355\332\313\352\272y"..., 2038) = 2038
poll([{fd=6, events=POLLIN}, {fd=10, events=POLLIN}], 2, 180000) = 1 ([{fd=10, revents=POLLIN}])
recvmsg(10, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="Y\351\365\366\16\217\244\346\236\246\0\0\10\0\34j{\255\326\240\277\247\r\244\236\3312\265\2766\350\37"..., iov_len=4104}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 3986
write(11, "Y\351\365\366\16\217\244\346\236\246", 10) = 10
write(11, "\34j{\255\326\240\277\247\r\244\236\3312\265\2766\350\37\354sj\220\324`\360\311\272\244w\16f\253"..., 2048) = 2048
write(11, "t4\313\250\320\2118\"\35\303jU\350D\34\221N\313\222\253@\210Y\"-\260\364*\255\230\205q"..., 1920) = 1920
poll([{fd=6, events=POLLIN}, {fd=10, events=POLLIN}], 2, 180000) = 1 ([{fd=10, revents=POLLIN}])
recvmsg(10, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="4\20\302\261\232\7\326\n\334\373\200N\255U\34\205[\246\201\30\36\250\310\22118\254LB)\373\33"..., iov_len=4104}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 4104
write(11, "4\20\302\261\232\7\326\n\334\373\200N\255U\34\205[\246\201\30\36\250\310\22118\254LB)\373\33"..., 128) = 128
write(11, "\240Z\212\244\211\201)s\363\225\0TKQ%16en^\21\250XMbp\312\334b\265\203A"..., 2048) = 2048
write(11, "|\372\350\262ArzA\330$\331\v\322\255a<\313\263G\314\201!>5\2675rjd^rK"..., 1920) = 1920
poll([{fd=6, events=POLLIN}, {fd=10, events=POLLIN}], 2, 180000) = 1 ([{fd=10, revents=POLLIN}])
recvmsg(10, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="$o\0\303\34\314{\276Z\223)TX\370\33Z;X\370\350\366>8^\255!?\335\301\31I\25"..., iov_len=4104}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 4104
write(11, "$o\0\303\34\314{\276Z\223)TX\370\33Z;X\370\350\366>8^\255!?\335\301\31I\25"..., 128) = 128
write(11, "2\373\332\273\207~\3672N\351C\263U\231\225M\243\vdt\334\37\237\266\311\332e\341\251qm\215"..., 2048) = 2048
write(11, "p\320\3\215\16\214h\34\307*3\373\334\r\376\332\316\201\357\311>\333\30\333\372\376\344\253\35\314ny"..., 1920) = 1920
poll([{fd=6, events=POLLIN}, {fd=10, events=POLLIN}], 2, 180000) = 1 ([{fd=10, revents=POLLIN}])
recvmsg(10, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="7P\217\270\370#\345\330N\206c;)\207\315\312g\227:\23B\"\242fG\322\5J\"\304\326\204"..., iov_len=4104}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 4104
write(11, "7P\217\270\370#\345\330N\206c;)\207\315\312g\227:\23B\"\242fG\322\5J\"\304\326\204"..., 128) = 128
write(11, "\rY\2577u\243.\327#\205\230Q\224\24\333-`r\212E\353\363tN\234\317\3\317a\361\0\36"..., 2048) = 2048
write(11, "\f\301-\37:\264qo\v at 3\210C7\1d\370\325a\303\7\225\235\345\332'\237l/\300\v2"..., 1920) = 1920
poll([{fd=6, events=POLLIN}, {fd=10, events=POLLIN}], 2, 180000) = 1 ([{fd=10, revents=POLLIN}])
recvmsg(10, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\372j\322%\351e\354;]\316\212*\205s\207\257\257r\361\0215f;\334\225\265\23J?o\376\343"..., iov_len=4104}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 4104
write(11, "\372j\322%\351e\354;]\316\212*\205s\207\257\257r\361\0215f;\334\225\265\23J?o\376\343"..., 128) = 128
write(11, "dd;6\276\206M\336\r?\16\356\224}{\234G\342\243\343\2*\343\275\203\204\217\215\213\220\334\31"..., 2048) = 2048
write(11, "9\367J}\211\361\254-\211\242\224\25\17\251 \370\311\232a\327\350\271N\340\271\266\215\2754[\267\27"..., 1920) = 1920
poll([{fd=6, events=POLLIN}, {fd=10, events=POLLIN}], 2, 180000) = 1 ([{fd=10, revents=POLLIN}])
recvmsg(10, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\324k\211\4?\t\246vY&_1SV\236j\241\234\236;\367\314\205A\16\367\245\225\314\241\362\205"..., iov_len=4104}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 4104
write(11, "\324k\211\4?\t\246vY&_1SV\236j\241\234\236;\367\314\205A\16\367\245\225\314\241\362\205"..., 128) = 128
write(11, "\255Z>\243T\205)\374Z\251\362\2442\0T\t\224'\220\253\370u\"\25\311\270\201iW$A\331"..., 2048) = 2048
write(11, "\307:\217\325\23\375\6\324\361\214l\301\302\264\255\242_:,\334X\337;\217\333s\24.\37y&Y"..., 1920) = 1920
poll([{fd=6, events=POLLIN}, {fd=10, events=POLLIN}], 2, 180000) = 1 ([{fd=10, revents=POLLIN}])
recvmsg(10, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\320\320\337\336\363\23\320\32\337\222\0\374\221\225w\275\376\322\247!\316NN\350?\344\224I'\10<\353"..., iov_len=4104}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 4104
write(11, "\320\320\337\336\363\23\320\32\337\222\0\374\221\225w\275\376\322\247!\316NN\350?\344\224I'\10<\353"..., 128) = 128
write(11, "\234(\252V\221N\350\277E\216`uR\342\211\240\265\252\222\242\313\323\244\223\331V:\242XU\365\333"..., 2048) = 2048
write(11, "\f\220G\222\304L\342\210/}\2109\20\305K\253\304\346(\261\4<i9\375\25!\226\320Xh\221"..., 1920) = 1920
poll([{fd=6, events=POLLIN}, {fd=10, events=POLLIN}], 2, 180000) = 1 ([{fd=10, revents=POLLIN}])
recvmsg(10, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\353\0_\314bKW\243h\25\333\315,\237\27i\221\\qA\35W\2678b$*XI\217\226\317"..., iov_len=4104}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 4104
write(11, "\353\0_\314bKW\243h\25\333\315,\237\27i\221\\qA\35W\2678b$*XI\217\226\317"..., 128) = 128
write(11, "\232\"\327\353\212\311jZ\211Pd\0\352\200\200\27U\321\22&S\304\35\262\245\212%L\2468Z\372"..., 2048) = 2048
write(11, "\360wl\245\302\307d\33\26n,\372\262c\303\30\243*\22\217B\357\354\276\206\316\331\345\360\347\35\0"..., 1920) = 1920
poll([{fd=6, events=POLLIN}, {fd=10, events=POLLIN}], 2, 180000) = 1 ([{fd=10, revents=POLLIN}])
recvmsg(10, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="07052019132143.xml \242\30\0(\240\24\0\0\0\0\0\0\0"..., iov_len=4104}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 4104
write(11, "07052019132143.xml \242\30\0(\240\24\0\0\0\0\0\0\0"..., 128) = 128
write(11, "\352\7\216\347\376\372\223\330\20~\"\324\235xS\307\235\375\372\323\365\370\364\320\370\211\374\255\375\303q\277"..., 2048) = 2048
write(11, "<\326\326ehA\241\214g\343ZQM.\21\316\264\244\224R\"\222kM%-\332\5\352\314\347\336"..., 1920) = 1920
poll([{fd=6, events=POLLIN}, {fd=10, events=POLLIN}], 2, 180000) = 1 ([{fd=10, revents=POLLIN}])
recvmsg(10, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\355\207\316\304Y\332\25;p\265}\321h\310\320\t%Ao\250\252\266\361U\202\27\205`\315\33\4["..., iov_len=4104}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 4104
write(11, "\355\207\316\304Y\332\25;p\265}\321h\310\320\t%Ao\250\252\266\361U\202\27\205`\315\33\4["..., 128) = 128
write(11, "\236\"\205\16(;\203\230\234:\363\260n\320\332\322\277\220p?\252!\353\257\v\241\22\357<is4"..., 2048) = 2048
write(11, "\351\364\317I*\30%\361S\34\260~$U5QK\321\312V\356{\240R\215:\250\262\332\253q\22"..., 1920) = 1920
poll([{fd=6, events=POLLIN}, {fd=10, events=POLLIN}], 2, 180000) = 1 ([{fd=10, revents=POLLIN}])
recvmsg(10, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="5\213T\334\1\0\0f\r\0\0Y\0\34\0ExtendedLogs/98a5"..., iov_len=4104}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 4104
write(11, "5\213T\334\1\0\0f\r\0\0Y\0\34\0ExtendedLogs/98a5"..., 128) = 128
write(11, "\0\0\0\0\325\226[O\302@\20\205\317\263\211\377\201GM\212\21D\224\307\202\20\215(\336\320\2304"..., 2048) = 2048
write(11, "ardwareScanActivity.json \242\30\0(\240\24\0"..., 1920) = 1920
poll([{fd=6, events=POLLIN}, {fd=10, events=POLLIN}], 2, 180000) = 1 ([{fd=10, revents=POLLIN}])
recvmsg(10, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\200.\202{\314\236\nV\33\236\2173\301]\0064\230\3R\274\255\346\2\2131\25\244\321\311\230\334'"..., iov_len=4104}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 4104
write(11, "\200.\202{\314\236\nV\33\236\2173\301]\0064\230\3R\274\255\346\2\2131\25\244\321\311\230\334'"..., 128) = 128
write(11, "\252\357\242>\332<\233\372\250K\0b=\324jkmW\310\301\354\360\"\7\263\363\362\6\201\251\362\342"..., 2048) = 2048
write(11, "\373\206\334\222\32\0Z\272\2752\254\365\373\306\375\342C\263\337\370\365\362\347\237.\266\372\352|hh\353"..., 1920) = 1920
poll([{fd=6, events=POLLIN}, {fd=10, events=POLLIN}], 2, 180000) = 1 ([{fd=10, revents=POLLIN}])
recvmsg(10, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\341\23\\\352\332\346\341vHu\326a\206\371ar\263\265\35\203\355Xx\256\330\345\203e\n\223\301m"..., iov_len=4104}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 4104
write(11, "\341\23\\\352\332\346\341vHu\326a\206\371ar\263\265\35\203\355Xx\256\330\345\203e\n\223\301m"..., 128) = 128
write(11, ":\26\252\215\300\7mc\230/`fj\256\277\344\vF\355;\240\16\26\0030\270UF \35\361\262"..., 2048) = 2048
write(11, "\0(\240\24\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\215\221OO\0021\20"..., 1920) = 1920
poll([{fd=6, events=POLLIN}, {fd=10, events=POLLIN}], 2, 180000) = 1 ([{fd=10, revents=POLLIN}])
recvmsg(10, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="SA_07032019095848.xmlPK\1\2-\0\24\0\2\0\10"..., iov_len=4104}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 2053
write(11, "SA_07032019095848.xmlPK\1\2-\0\24\0\2\0\10"..., 128) = 128
write(11, "\2055\221 \0\0'\5\1\0+\0\0\0\0\0\0\0\0\0\0\0\0\0z\310\0\0DDV/"..., 1917) = 1917
clone(child_stack=0x7f758d46df30, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tidptr=0x7f758d46e9d0, tls=0x7f758d46e700, child_tidptr=0x7f758d46e9d0) = 508
futex(0x55973b73ba90, FUTEX_WAKE_PRIVATE, 1) = 1
poll([{fd=6, events=POLLIN}], 1, 3600000
-------------- next part --------------
A non-text attachment was scrubbed...
Name: htop-during-test.png
Type: image/png
Size: 441802 bytes
Desc: not available
URL: <https://lists.clamav.net/pipermail/clamav-users/attachments/20200911/71d860ed/attachment.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: clamd.conf
Type: application/octet-stream
Size: 2060 bytes
Desc: not available
URL: <https://lists.clamav.net/pipermail/clamav-users/attachments/20200911/71d860ed/attachment.obj>
-------------- next part --------------
---------------------------------------------------------------------------------------------------------------------------------------------------------------
BEFORE TEST
---------------------------------------------------------------------------------------------------------------------------------------------------------------
pidstat -urd -h
Linux 4.15.0-1092-azure (intake-deployment-65d765c84c-7kknb) 09/11/20 _x86_64_ (16 CPU)
# Time UID PID %usr %system %guest %wait %CPU CPU minflt/s majflt/s VSZ RSS %MEM kB_rd/s kB_wr/s kB_ccwr/s iodelay Command
06:42:42 0 1 0.00 0.00 0.00 0.00 0.00 8 0.00 0.00 3736 2972 0.01 0.00 0.00 0.00 0 bootstrap.sh
06:42:42 0 15 0.00 0.00 0.00 0.00 0.00 0 0.01 0.00 140056 17004 0.05 0.00 4.56 2.43 0 freshclam
06:42:42 0 16 0.01 0.00 0.00 0.00 0.01 4 1.71 0.00 1344256 1117300 3.39 0.00 0.00 0.00 0 clamd
06:42:42 0 21 0.00 0.00 0.00 0.00 0.00 1 0.00 0.00 2388 764 0.00 0.00 0.04 0.01 0 sh
06:42:42 0 208 0.00 0.00 0.00 0.00 0.00 2 0.00 0.00 4968 748 0.00 0.00 0.00 0.00 0 pidstat
iostat
Linux 4.15.0-1092-azure (intake-deployment-65d765c84c-7kknb) 09/11/20 _x86_64_ (16 CPU)
avg-cpu: %user %nice %system %iowait %steal %idle
1.83 0.00 0.40 0.01 0.00 97.75
Device tps kB_read/s kB_wrtn/s kB_read kB_wrtn
loop0 0.00 0.00 0.00 8 0
sdb 0.02 0.11 437.82 17150 68291144
sda 4.05 6.08 283.65 949101 44244277
scd0 0.00 0.00 0.00 526 0
#
---------------------------------------------------------------------------------------------------------------------------------------------------------------
DURING TEST
---------------------------------------------------------------------------------------------------------------------------------------------------------------
PS C:\Windows\System32> kubectl exec --stdin --tty intake-deployment-65d765c84c-7kknb --container clamd -- /bin/sh
# pidstat -urd -h
Linux 4.15.0-1092-azure (intake-deployment-65d765c84c-7kknb) 09/11/20 _x86_64_ (16 CPU)
# Time UID PID %usr %system %guest %wait %CPU CPU minflt/s majflt/s VSZ RSS %MEM kB_rd/s kB_wr/s kB_ccwr/s iodelay Command
06:53:45 0 1 0.00 0.00 0.00 0.00 0.00 8 0.00 0.00 3736 2972 0.01 0.00 0.00 0.00 0 bootstrap.sh
06:53:45 0 15 0.00 0.00 0.00 0.00 0.00 0 0.01 0.00 140056 17004 0.05 0.00 4.54 2.42 0 freshclam
06:53:45 0 16 1.45 0.24 0.00 0.00 1.69 1 434.14 0.00 4967856 1256272 3.82 0.00 30.37 30.22 0 clamd
06:53:45 0 21 0.00 0.00 0.00 0.00 0.00 3 0.00 0.00 2388 1588 0.00 0.00 0.04 0.01 0 sh
06:53:45 0 279 0.00 0.00 0.00 0.00 0.00 5 0.00 0.00 2388 764 0.00 0.00 0.00 0.00 0 sh
06:53:45 0 284 0.00 0.00 0.00 0.00 0.00 3 0.00 0.00 5720 4144 0.01 0.00 0.00 0.00 0 htop
06:53:45 0 285 0.00 0.00 0.00 0.00 0.00 10 0.00 0.00 2388 696 0.00 0.00 0.00 0.00 0 sh
06:53:45 0 290 0.00 0.00 0.00 0.00 0.00 15 0.00 0.00 5040 752 0.00 0.00 0.00 0.00 0 pidstat
# iostat
Linux 4.15.0-1092-azure (intake-deployment-65d765c84c-7kknb) 09/11/20 _x86_64_ (16 CPU)
avg-cpu: %user %nice %system %iowait %steal %idle
1.91 0.00 0.42 0.01 0.00 97.66
Device tps kB_read/s kB_wrtn/s kB_read kB_wrtn
loop0 0.00 0.00 0.00 8 0
sdb 0.02 0.11 436.01 17150 68291144
sda 4.04 6.06 282.67 949461 44273853
scd0 0.00 0.00 0.00 526 0
More information about the clamav-users
mailing list