[clamav-users] clamscan suddenly taking 25 minutes for a single mail

[Eddie]

On 4/6/2021 8:56 AM, Matus UHLAR - fantomas wrote:
> On 06.04.21 08:43, Eddie via clamav-users wrote:
>> A POP3 proxy program I have running on a Debian 10.8 system, uses 
>> clamscan to check incoming e-mails.  At some point in the very early 
>> morning (US West Coast time) it suddenly started taking a very long 
>> time to scan each mail,  So much that the controlling process would 
>> time out before clamscan finished.  Up to this point it was running 
>> fine.
>>
>> Running a test from the command line, on a very simple 1-line mail 
>> took around 25 minutes:
>>
>> root at CleanMail:~# date ; clamscan test.msg -v  --no-summary ; date
>> Mon 05 Apr 2021 11:59:10 AM PDT
>> Scanning /root/test.msg
>> /root/test.msg: OK
>> Mon 05 Apr 2021 12:24:06 PM PDT
>> root at CleanMail:~#
>>
>> Looking through the logs, I can't see anything happening in the 
>> period between the last good scan and the sloooooow ones.
>>
>> Where should I be going next to track this down.
>
> you should prefer clamdscan, that uses tunning clamd to scan, this way 
> you
> skip virus DB initialization at each scan.
>
> Note that the memory question is important. clamd uses >1GB RAM on my
> machine. you need at least 2GB of RAM to scan in reasonable time

Watching via "top" while it's scanning, I do see it's taking a chunk of 
memory, but it's not overly excessive.  swap space is basically unused.

I'm looking at moving over to clamdscan.

Cheers.