[clamav-users] clamscan suddenly taking 25 minutes for a single mail

[Richard Graham]

>
> But I'd like to understand why, on Sunday morning, the scan time which had
> been under a minute per mail, for over 4 months, suddenly jumped to 25
> minutes per mail and has remained at that.


It's a good question.  Is there any way to reproduce what was happening on
Sunday morning?  ... and then compare it to what is happening today?

Has the size/location/access method to clamscan's signatures changed?  Is
your system (drives, network, etc.) healthy?

On Tue, Apr 6, 2021 at 8:31 PM Eddie <stunnel at attglobal.net> wrote:

> Understood, which is why I'm looking to move to clamdscan.
>
> But I'd like to understand why, on Sunday morning, the scan time which had
> been under a minute per mail, for over 4 months, suddenly jumped to 25
> minutes per mail and has remained at that.
>
> Cheers.
>
> On 4/6/2021 10:39 AM, Richard Graham wrote:
>
> Clamscan can spend a looooong time loading signatures, etc.  If you run
> your command with strace (or monitor the process with lsof, etc.) you'll
> probably see clamscan is busy accessing signature files.
>
> On Tue, Apr 6, 2021 at 5:44 PM Eddie via clamav-users <
> clamav-users at lists.clamav.net> wrote:
>
>> A POP3 proxy program I have running on a Debian 10.8 system, uses
>> clamscan to check incoming e-mails.  At some point in the very early
>> morning (US West Coast time) it suddenly started taking a very long time
>> to scan each mail,  So much that the controlling process would time out
>> before clamscan finished.  Up to this point it was running fine.
>>
>> Running a test from the command line, on a very simple 1-line mail took
>> around 25 minutes:
>>
>> root at CleanMail:~# date ; clamscan test.msg -v  --no-summary ; date
>> Mon 05 Apr 2021 11:59:10 AM PDT
>> Scanning /root/test.msg
>> /root/test.msg: OK
>> Mon 05 Apr 2021 12:24:06 PM PDT
>> root at CleanMail:~#
>>
>> Looking through the logs, I can't see anything happening in the period
>> between the last good scan and the sloooooow ones.
>>
>> Where should I be going next to track this down.
>>
>> Cheers.
>>
>> _______________________________________________
>>
>> clamav-users mailing list
>> clamav-users at lists.clamav.net
>> https://lists.clamav.net/mailman/listinfo/clamav-users
>>
>>
>> Help us build a comprehensive ClamAV guide:
>> https://github.com/vrtadmin/clamav-faq
>>
>> http://www.clamav.net/contact.html#ml
>>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.clamav.net/pipermail/clamav-users/attachments/20210406/31a6e83b/attachment.htm>