[Mimedefang] Problem running clamd but not clamscan

[Bryan Stansell]

On Wed, Jan 28, 2004 at 11:44:51AM -0500, Ole Craig wrote:
> 
> Scott -
> 	The problem I had seemed to be that MD wasn't actually talking
> to clamd. (Do you catch the EICAR text file with clamd enabled?) It
> would make sense that MD processed significantly faster if it's not
> incurring the virusscan overhead at all. Maybe we could have someone
> with a working MD<->clamd setup try your speed test and report the
> difference in MD time between clamav and clamd...

the overhead of reading the virus defs each time clamscan runs is rather
large (at least on my 'lil box).  here's a simple test i ran to show
time differences between clamscan and clamd (5.039s vs 0.045s).

    underdog (root) 6:# clamdscan PART.1.BODY
    PART.1.BODY: Worm.SCO.A FOUND

    ----------- SCAN SUMMARY -----------
    Infected files: 1
    Time: 0.045 sec (0 m 0 s)
    underdog (root) 7:# clamscan PART.1.BODY
    PART.1.BODY: Worm.SCO.A FOUND

    ----------- SCAN SUMMARY -----------
    Known viruses: 20583
    Scanned directories: 0
    Scanned files: 1
    Infected files: 1
    Data scanned: 0.02 MB
    I/O buffer size: 131072 bytes
    Time: 5.039 sec (0 m 5 s)
    underdog (root) 8:#

i've been using the latest mimedefang and clamav (using clamd) and had
no problems (after getting all the permissions and configs set up).  not
using clamd would probably slaughter performance here.  fyi, i'm running
solaris and built everything from source.

Bryan