Hi,
Micah Snyder, Do you know if Clamav was able to trace the orgine of getting crawled in the database "daily.cld" and was able to fix the problem?
Regards
Maarten,
This is very concerning, and the details you’ve provide are quite helpful. Thank you for investigating.
Hopefully we can figure out why the newer daily.cld/cvd is scanning significantly slower than before. Any other details you can provide would probably be helpful. If you’re aware if any specific file types are causing the issue, or if all files appear to scanning slower that will also help.
-Micah
Micah Snyder
ClamAV Development
Talos
Cisco Systems, Inc.
We've noticed a marked increase in scan times over the last couple of weeks as well. From the look of it, there's something in the daily file that's causing it. Whether this is similar to the safebrowsing issue (where the ordering of entries in the file caused a 3000% increase in time) is unclear.
--Maarten Broekman
Full scans without the daily cvd/cld: Scan time ~60seconds
Full scans with the daily from March 11th: Scan time: 84seconds
Full scans with the daily from March 17th: Scan time: 109seconds
~/clamav# ls -larth /tmp/clamdtest*/daily.cld
-rw-r--r-- 1 clamav clamav 110M Mar 11 04:15 /tmp/clamdtest2/daily.cld
-rw-r--r-- 1 clamav clamav 113M Mar 17 04:15 /tmp/clamdtest/daily.cld
~/clamav# wc /tmp/clamdtest*/daily.cld
1514589 1517471 115031552 /tmp/clamdtest2/daily.cld
1524782 1527664 118202368 /tmp/clamdtest/daily.cld
Single file scans with JUST the daily.cld:
~/clamav# time /opt/clamav/clamav/bin/clamscan -d /tmp/clamdtest2/daily.cld test42.js
----------- SCAN SUMMARY -----------
Data read: 0.00 MB (ratio 0.00:1)
Time: 5.255 sec (0 m 5 s)
~/clamav# time /opt/clamav/clamav/bin/clamscan -d /tmp/clamdtest/daily.cld test42.js
----------- SCAN SUMMARY -----------
Data read: 0.00 MB (ratio 0.00:1)
Time: 9.300 sec (0 m 9 s)