[Mimedefang] uvscan exceedingly slow

[Ole Holm Nielsen]

Thanks for some quick answers !!  Delays of 13 seconds for each mail
being sent out from our mail clients are indeed unacceptable.

One additional observation:  My Redhat ES2.1 server runs on a 2.0 GHz
Pentium Xeon (Proliant server), and uvscan incurs a 13 seconds overhead.
On a Redhat 9 server running on a 450 MHz Pentium-II the real time is
only 1.5 seconds with 0.15 seconds of overhead on the very same
quarantined message (copied over).  So there is a 100-fold increase
in the overhead when running Redhat ES2.1, even disregarding the
much faster processor :-(

Yes, strace does show 2 delays lasting several seconds each.  They occur as
indicated below:
....
lstat64("/usr/local/uvscan/MCSCNAFC.TXT", 0xbffeaaa4) = -1 ENOENT (No such file 
or directory)
open("/usr/local/uvscan/MCSCNAFC.TXT", O_RDONLY) = -1 ENOENT (No such file or 
directory)
time([1063200445])                      = 1063200445
time(NULL)                              = 1063200445
open("/proc/devices", O_RDONLY)         = 4
fstat64(4, {st_mode=S_IFREG|0444, st_size=0, ...}) = 0
old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 
0x40435000
read(4, "Character devices:\n  1 mem\n  2 p"..., 4096) = 396
stat64("/dev/hda", {st_mode=S_IFBLK|0660, st_rdev=makedev(3, 0), ...}) = 0
stat64("/dev/hda", {st_mode=S_IFBLK|0660, st_rdev=makedev(3, 0), ...}) = 0
open("/dev/hda", O_RDONLY
....delay.....
stat64("/dev/hda", {st_mode=S_IFBLK|0660, st_rdev=makedev(3, 0), ...}) = 0
open("/dev/hda", O_RDONLY
....delay.....

Can anyone point to problems here ?

Some information regarding the libraries installed on Redhat ES2.1:

# ldd /usr/local/bin/uvscan
         liblnxfv.so.4 => /usr/local/lib/liblnxfv.so.4 (0x40018000)
         libstdc++.so.2.8 => /usr/lib/libstdc++.so.2.8 (0x40292000)
         libm.so.6 => /lib/libm.so.6 (0x402d3000)
         libc.so.6 => /lib/libc.so.6 (0x402f6000)
         /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000)
# rpm -qf /usr/lib/libstdc++.so.2.8.0
compat-libstdc++-6.2-2.9.0.16

David F. Skoll wrote:
> It depends... if he's using the server as the outgoing SMTP server for
> MUA's, 13 seconds is terrible.
> 
> There is something wrong with a virus-scanner that takes 13 seconds to
> scan a message.  Does strace yield any enlightenment?
> 


Ole Holm Nielsen wrote:
> Our users are complaining that delivering mail is exceedingly slow,
> and since we recently introduced the McAfee uvscan virus scanner in
> our server, I investigated the overhead of running uvscan on one of
> our quarantined message.  The timing of running uvscan from the
> command line is pretty appalling:
> 
> real    0m13.567s
> user    0m0.400s
> sys     0m0.080s
> 
> Can anyone suggest how to eliminate or minimize this 13-second overhead ?

Ole Holm Nielsen
Department of Physics
Technical University of Denmark