[clamav-users] clamscan suddenly taking 25 minutes for a single mail

[Eddie]

Understood, which is why I'm looking to move to clamdscan.

But I'd like to understand why, on Sunday morning, the scan time which 
had been under a minute per mail, for over 4 months, suddenly jumped to 
25 minutes per mail and has remained at that.

Cheers.

On 4/6/2021 10:39 AM, Richard Graham wrote:
> Clamscan can spend a looooong time loading signatures, etc.  If you 
> run your command with strace (or monitor the process with lsof, etc.) 
> you'll probably see clamscan is busy accessing signature files.
>
> On Tue, Apr 6, 2021 at 5:44 PM Eddie via clamav-users 
> <clamav-users at lists.clamav.net <mailto:clamav-users at lists.clamav.net>> 
> wrote:
>
>     A POP3 proxy program I have running on a Debian 10.8 system, uses
>     clamscan to check incoming e-mails.  At some point in the very early
>     morning (US West Coast time) it suddenly started taking a very
>     long time
>     to scan each mail,  So much that the controlling process would
>     time out
>     before clamscan finished.  Up to this point it was running fine.
>
>     Running a test from the command line, on a very simple 1-line mail
>     took
>     around 25 minutes:
>
>     root at CleanMail:~# date ; clamscan test.msg -v  --no-summary ; date
>     Mon 05 Apr 2021 11:59:10 AM PDT
>     Scanning /root/test.msg
>     /root/test.msg: OK
>     Mon 05 Apr 2021 12:24:06 PM PDT
>     root at CleanMail:~#
>
>     Looking through the logs, I can't see anything happening in the
>     period
>     between the last good scan and the sloooooow ones.
>
>     Where should I be going next to track this down.
>
>     Cheers.
>
>     _______________________________________________
>
>     clamav-users mailing list
>     clamav-users at lists.clamav.net <mailto:clamav-users at lists.clamav.net>
>     https://lists.clamav.net/mailman/listinfo/clamav-users
>     <https://lists.clamav.net/mailman/listinfo/clamav-users>
>
>
>     Help us build a comprehensive ClamAV guide:
>     https://github.com/vrtadmin/clamav-faq
>     <https://github.com/vrtadmin/clamav-faq>
>
>     http://www.clamav.net/contact.html#ml
>     <http://www.clamav.net/contact.html#ml>
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.clamav.net/pipermail/clamav-users/attachments/20210406/2a45871e/attachment.htm>