Mailinglist Archive: opensuse (1556 mails)

["Carlos E. R." <robin.listas@xxxxxxxxxxxxxx>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



On Wednesday, 2009-08-12 at 17:47 +0200, Per Jessen wrote:

> > > > cer@nimrodel:~/viruses> ls -l ; time clamscan *
> > >
> > > Well yeah. That's a very different task - comparing that to scanning
> > > a single email make little sense.
> >
> > You are difficult to convince... ok, look:
> >
> > Apr 9 13:26:15 nimrodel amavis[15716]: (15716-16) Blocked INFECTED
> > (Worm.Nimda.e), <cer@xxxxxxxxxxxxxxxx> -> <cer@xxxxxxxxxxxxxxxx>,
> > quarantine: virus-tUVBodzmeu6A, Message-ID:
> > <20090409112612.93EF2D2658@xxxxxxxxxxxxxxxx>, mail_id: tUVBodzmeu6A,
> > Hits: - -, size: 405149, 3038 ms
> >
> > See? Three seconds to scan (when typical time to scan a plain text
> > email is half a second)
>
> Okay, I had one of those too - yet the vast majority was processed in
> less than 100 milliseconds.  On an ancient 400MHz machine, that is
> pretty good.  Your 3038ms example is perhaps just the exception to
> prove the rule.

I get very few viruses, I had to search months back in my logs to find 
one. But when I enabled virus scan in amavis time ago (2-3 yr back), I had 
to disable it because it (viruscan) was so slow... I think back then 
amavis scanned all mails, now it only scans executables. I'm not sure of 
this.


> > To be exact, I would have to reconfigure amavis-new not to scan for
> > virus, feed a sample email, then repeat reconfiguring for virus scan,
> > and repeat the send. Considering for a large overhead, taking out,
> > say, 1.5 seconds, would still leave a full second for clamav... not
> > milliseconds.
>
> Carlos, you can't keep running on 486's - you must be way due for an
> upgrade :-)

It is a Pentium IV ;-)

But yes, I'm in the upgrade process.

> I think perhaps it is your amavis-thingie that is slow, not clamav?

Both :-p


> > And you haven't commented on the sample test I showed of clamav not
> > detecting a virus that antivir did detect. A trojan, actually.  >:-)
>
> Sorry, I didn't get that far. Can you send me that file off-line,
> please?  I'm very surprised that clamav didn't catch it.  Don't bother
> encrypting it, just send normally, then we'll see if my test system
> catches it or not.

Ok, will do. Provided that my amavis lets me...

[...]

I think it passed. "Passed BANNED ... 1373 ms", it said.

- -- 
Cheers,
       Carlos E. R.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.9 (GNU/Linux)

iEYEARECAAYFAkqDF0sACgkQtTMYHG2NR9VYgQCfVuk4Nnwitk2V2kiKehcUZIZ5
aBwAoIjuPXuDzQXQ5w5ESStgzUrhzbgA
=a0oi
-----END PGP SIGNATURE-----
--
To unsubscribe, e-mail: opensuse+unsubscribe@xxxxxxxxxxxx
For additional commands, e-mail: opensuse+help@xxxxxxxxxxxx