On Mon, Sep 09, 2019 at 13:46 PM, Markus Kolb wrote:

Sergey wrote:

Since some time there has been a noticeable increase a launch time.
Startup with all databases takes about 220 seconds now. Startup
without daily.cld takes 12 seconds. What's happened with daily.cld?

Hey,

sorry for breaking the thread, I've just subscribed and have found your post in the archive:
https://lists.clamav.net/pipermail/clamav-users/2019-September/008496.html

So far I've found out, that the most time (about 90%) is lost in "daily.ldb".

What I can say is, that there is no specific signature which slows it down.
It is the algorithm... it looks like the time needed to load a new signature depends on the number of sub-signatures (logic) and the number of signatures already loaded in memory.
I think the Big-O-notation (https://en.wikipedia.org/wiki/Big_O_notation) for this algorithm wouldn't look good.

So during loading the lines (virus signatures) of ldb-file it becomes slower and slower.
Very slow is if there are many sub-signatures for a virus signature. There are more of this kind in the last 3rd or 4th of the ldb-file.

Maybe these signatures got added in the last months. My logfiles tell me that the startup time of clamd was ok until February/March 2019.

greets
Markus

The only thing I can add to this discussion is that in the past there have been a lot of false positives involving .ldb signatures, apparently caused by too few sub-signatures being used to positively identify a file as being malware. So that would appear to be the tradeoff here...load time vs. FPs.