I'm not sure that I can provide a more satisfactory answer.  The built-in interpreter executes bytecode operations more slowly but doesn't have a compilation step.  LLVM compiles the bytecodes signatures down to machine language and executes it quickly, but that compile step makes the speed boost a bit of wash because the bytecode signatures are for the most part not very large functions.  

At this time, I'm not able to recommend one over the other, with the exception that using LLVM adds an extra dependency. 

Micah Snyder
ClamAV Development
Talos
Cisco Systems, Inc.


On Jul 19, 2018, at 4:23 AM, Sergey <a_s_y@sama.ru> wrote:

On Tuesday 17 July 2018, Micah Snyder (micasnyd) wrote:

If you don't provide the older LLVM 3.6 for ClamAV, it will
use it's built-interpreter rather than just-in-time-compile
the signatures.   

b.t.w. Can you describe differences between built-interpreter
and LLVM in short ? Which is more preferable to use ?

--
Regards, Sergey
_______________________________________________
clamav-users mailing list
clamav-users@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml