Re: small change in virus signatures count causes big change in scan duration

On Fri 19/Sep/2025 21:12:57 +0200 Jan Hutař via clamav-users wrote:
> Some time ago we noticed significant change in a virus scan duration. We 
> tracked this change down to virus database version change. With ClamAV 
> virus DB version 27709 average scan time was 52 seconds, with 27710 scan 
> time jumped to 114 seconds. Number of known viruses in 27709 is 8707631 and 
> in 27710 it is 8718439.


I think timings can be tricky.  Until January 24, I used to measure the time 
taken by to load the database by something like so:

     time_t start, end;
     time(&start);
     ...
     time(&end);
     if (end > start)
         filelog(logfile, LOG_INFO,
             "loaded in: %d sec(s)", (int)(end - start));

Since then, measurement has changed in a more convoluted way:

     struct timespec before, after;
     int time_rtc = clock_gettime(CLOCK_MONOTONIC, &before);
     ...
     time_rtc |= clock_gettime(CLOCK_MONOTONIC, &after);
     if (time_rtc == 0)
     {
         struct timeval b, a, diff;
         TIMESPEC_TO_TIMEVAL(&a, &after);
         TIMESPEC_TO_TIMEVAL(&b, &before);
         timersub(&a, &b, &diff);
         filelog(logfile, LOG_INFO,
             "loaded in: %ld.%06lds", diff.tv_sec, diff.tv_usec);
     }

The difference is impressive.  I attach a plot from January 1st to September 16.

Best
Ale

_______________________________________________

Manage your clamav-users mailing list subscription / unsubscribe:
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/Cisco-Talos/clamav-documentation

https://docs.clamav.net/#mailing-lists-and-chat