Re: Difference between clamscan and clamdsc an scanning time

Hello Paul,

No, I believe it's cache! If I restart clamd and run scan, it would take same amount of time as clamscan. But from next time onwards, it would take considerably less. This is mainly because the server I am trying is almost still. With busy server, the benefit would be proportional to number of files changed\added.

That makes me ask question, what is "--disable-cache" option for *clamscan* is which states "Disable caching and cache checks for hash sums of scanned files."?

I came across following question in this list: https://www.mail-archive.com/[email protected]/msg49220.html

/quote
..Correct, but I'd thought its size would be limited only by the RAM you have free...
/quote

Does that mean clamscan does not have cache at all or caching means something else here or is it that when running clamscan do I to somehow _activate_ cache?

Thanks in advance,
-Neel.



From: Paul Silvestri <[email protected]>
Sent: Sat, 07 Dec 2024 08:55:13
To: neel roy <[email protected]>
Cc: Eddie via clamav-users <[email protected]>
Subject: Re: [clamav-users] Difference between clamscan and clamdscan scanning time
 Ah my apologies, I misread the first part of your message. 

It may be worth checking your clamd.conf and recreate those options via the CLI commands when running clamscan.
On Dec 6, 2024, 10:21 PM -0500, neel roy <[email protected]>, wrote:
Hello Paul,

Thanks for reply. Yes, I have read that. I am expecting that engine creation and virus definition loading will take some time. Based on output I see, it takes about 23 seconds to load virus definitions, to round of I considered 30 seconds. That leaves about 2 min 40 seconds. I do not see any messages even with "-v" (verbose) option about engine creation. But assume it takes another 40 seconds.That's still 2 minutes versus 9 seconds. Should there be *that* big a difference?

Thanks in advance,
-Neel.

From: Paul Silvestri <[email protected]>
Sent: Sat, 07 Dec 2024 08:43:59
To: Eddie via clamav-users <[email protected]>
Cc: neel roy <[email protected]>
Subject: Re: [clamav-users] Difference between clamscan and clamdscan scanning time
 Per the docs:

"clamscan is a command line tool which uses libclamav to scan files and/or directories for viruses. Unlike clamdscan, clamscan does not require a running clamd instance to function. Instead, clamscan will create a new engine and load in the virus database each time it is run. It will then scan the files and/or directories specified at the command line, create a scan report, and exit."

https://docs.clamav.net/manual/Usage/Scanning.html#clamscan
On Dec 6, 2024, 10:08 PM -0500, neel roy via clamav-users <[email protected]>, wrote:
Hello,

I passed 10,000 files listed in the file to clamscan and clamdscan. I see very big difference on 4 cpu bare metal machine. Why is it?
I am using clamav 1.0.7.

clamscan -f large_files.txt - 3 mins 5 seconds
clamdscan --fdpass -f large_files.txt - 9 seconds

Notes
- For clamdscan, I am *not* using -m option.
- For clamdscan, without "--fdpass" it would give "permission denied" errors.

I understand that first 20-30 seconds or so I see clamscan is loading virus definitions. Even without that, the difference is difference is very big. What accounts for it?

Thanks in advance,
-Neel.
_______________________________________________

Manage your clamav-users mailing list subscription / unsubscribe:
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/Cisco-Talos/clamav-documentation

https://docs.clamav.net/#mailing-lists-and-chat

_______________________________________________

Manage your clamav-users mailing list subscription / unsubscribe:
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/Cisco-Talos/clamav-documentation

https://docs.clamav.net/#mailing-lists-and-chat