Re: Difference between clamscan and clamdsc an scanning time

neel roy via clamav-users <[email protected]>
Newsgroups gmane.comp.security.virus.clamav.user
Message-ID <1733541429.S.2847.autosave.drafts.1733541658.16219@webmail.rediffmail.com>
Hello Paul,

Thanks for reply. Yes, I have read that. I am expecting that engine creation and virus definition loading will take some time. Based on output I see, it takes about 23 seconds to load virus definitions, to round of I considered 30 seconds. That leaves about 2 min 40 seconds. I do not see any messages even with &quot;-v&quot; (verbose) option about engine creation. But assume it takes another 40 seconds.That&#39;s still 2 minutes versus 9 seconds. Should there be *that* big a difference?

Thanks in advance,
-Neel.

From: Paul Silvestri &lt;[email protected]&gt;
Sent: Sat, 07 Dec 2024 08:43:59
To: Eddie via clamav-users &lt;[email protected]&gt;
Cc: neel roy &lt;[email protected]&gt;
Subject: Re: [clamav-users] Difference between clamscan and clamdscan scanning time
&nbsp;Per the docs:

&quot;clamscan is a command line tool which uses libclamav to scan files and/or directories for viruses. Unlike clamdscan, clamscan does not require a running clamd instance to function. Instead,&nbsp;clamscan will create a new engine and load in the virus database each time it is run.&nbsp;It will then scan the files and/or directories specified at the command line, create a scan report, and exit.&quot;

https://docs.clamav.net/manual/Usage/Scanning.html#clamscan
On Dec 6, 2024, 10:08 PM -0500, neel roy via clamav-users &lt;[email protected]&gt;, wrote:
Hello,

I passed 10,000 files listed in the file to clamscan and clamdscan. I see very big difference on 4 cpu bare metal machine. Why is it?
I am using clamav 1.0.7.

clamscan -f large_files.txt - 3 mins 5 seconds
clamdscan --fdpass -f large_files.txt - 9 seconds

Notes
- For clamdscan, I am *not* using -m option.
- For clamdscan, without &quot;--fdpass&quot; it would give &quot;permission denied&quot; errors.

I understand that first 20-30 seconds or so I see clamscan is loading virus definitions. Even without that, the difference is difference is very big. What accounts for it?

Thanks in advance,
-Neel.
_______________________________________________

Manage your clamav-users mailing list subscription / unsubscribe:
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/Cisco-Talos/clamav-documentation

https://docs.clamav.net/#mailing-lists-and-chat

_______________________________________________

Manage your clamav-users mailing list subscription / unsubscribe:
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/Cisco-Talos/clamav-documentation

https://docs.clamav.net/#mailing-lists-and-chat
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.