[clamav-users] ClamAV scan time improvement

[Andrew C Aitchison]

On Tue, 8 Nov 2022, Vijay Kumar Kamannavar via clamav-users wrote:

> Hello Team,
>
> We are leveraging ClamAV agent for our vm's malware detection.
>
> we tried to scan a vm with 30GB used space and it took approx 1.30Hrs(we
> tried to capture certain file extensions to reduce number of files and
> passed file lists as arguments to clamdclient)
> Note:
> 1. we tried above test with 4 core 8GB vm
> 2. We tried clamdscan as below
>
> /bin/parallel -j 10 clamdscan -m --fdpass --no-summary --file-list

parallel is running the scanner 10 times isn't it ?
so each scan takes 9 minutes (90/10) ?
You only have 4 cores, so why do ten things at once ?

Since you use clamdscan, most of the work happens in the clamd daemon
processes. How many of those are you running ?

Does it make sense to use -m *and* parallel ? I don't know.

How long does it take to read 30GB of file from storage ?
On my (old) machine it takes 3minutes. Three times that to
scan for >8million viruses doesn't sound too bad to me.

> we have below queries
>
> 1. Where can we find bench mark results for clamdscan?
>
> 2.What is the recommendation to  make the scan faster for 30GB?
>
> 3. What is the recommendation if we have a VM of size >~500GB.
>
>
> I really appreciate any kind of support here. It helps alot.
>
> Thanks,
>
> Vijay
>

-- 
Andrew C. Aitchison                      Kendal, UK
                    andrew at aitchison.me.uk