Morning,

Some email scan are very slow. This is happening more and more often, and seems more related to Clamd's demime problems than real email attachments concerns.

Here is an example of an email that takes several minutes to analyze:

# time clamdscan 1hDTxy-0002Dk-Lc.eml

/tmp/eml/1hDTxy-0002Dk-Lc.eml: OK

----------- SCAN SUMMARY -----------

Infected files: 0

Time: 199.716 sec (3 m 19 s)

real    3m19,720s

user    0m0,004s

sys     0m0,000s

Regardless of this, regardless of the file transmitted to clamd by clamdscan, if the analysis is interrupted (for example after 5 seconds of analysis), the analysis of it continues, even after the ReadTimeout or any other TimeOut. Attached is a copy of clamdtop after making a CTRL + C clamdscan. It lasts until complete analysis (more than 5 minutes).

Do you find normal that the clamd process continues its analysis despite the end of the clamdscan call process and even after exceeding the various TimeOut?

Regards