Cisco-Talos/clamav

Problem with slow clamscan

ebo-47 opened this issue · 3 comments

ebo-47 commented

With Pi 4 B Buster 32 bit clamscan:
USB-HDD 1TB mounted in fstab with: /dev/sda1 /Documents ntfs-3g recover,noatime 0 0
Start in the terminal for user files: sudo /usr/bin/clamscan -r -i -l /Documents/clamav.log /Documents/Files*/
(previously executed freshclam)

----------- SCAN SUMMARY -----------
Known viruses: 8697741
Engine version: 0.103.9 (aus Repository)
Scanned directories: 93
Scanned files: 3351
Infected files: 0
Data scanned: 12147.82 MB
Data read: 46156.46 MB (ratio 0.26:1)
Time: 3653.004 sec (60 m 53 s) corresponds to 1h
Start Date: 2024:09:01 00:59:01
End Date: 2024:09:01 01:59:54

With Pi 4 B Bookworm 64 bit clamscan:
USB-HDD 1TB mounted in fstab with : /dev/sda1 /Documents ntfs-3g recover,noatime 0 0
Start in the terminal for user files: sudo /usr/bin/clamscan -r -i -l /Documents/clamav.log /Documents/Files*/
(previously executed freshclam)

----------- SCAN SUMMARY -----------
Known viruses: 8698823
Engine version: 1.0.5 (aus Repository)
Scanned directories: 93
Scanned files: 3353
Infected files: 0
Data scanned: 17547.89 MB
Data read: 46156.81 MB (ratio 0.38:1)
Time: 46123.837 sec (768 m 43 s) corresponds to 12h 48min
Start Date: 2024:09:26 17:35:08
End Date: 2024:09:27 06:23:52

What is the reason?

micahsnyder commented

Have a look at #590

TL;DR: We increased the scan limits. We also added a feature to create a fuzzy hash for image files, and that had a bigger performance impact than expected.

You might try these options to get behavior closer to 0.103: #590 (comment)

ebo-47 commented

Test:
sudo /usr/bin/clamscan -r -i -v --exclude=pdf$ --exclude=jpg$ --exclude=jpeg$ --exclude=png$ --exclude=PDF$ --exclude=JPG$ --exclude=JPEG$ --max-filesize=25M -- max-scansize=100M --max-embeddedpe=10M --max-htmlnormalize=10M --max-htmlnotags=2M --max-scriptnormalize=5M --pcre-max-filesize=25M -l /Dokumente/clamav. log /Dokumente/Dateien*/
Result 3min only 30 files scanned out of 3353

sudo /usr/bin/clamscan -r -i -v --max-filesize=25M --max-scansize=100M --max-embeddedpe=10M --max-htmlnormalize=10M --max-htmlnotags=2M --max-scriptnormalize=5M --pcre-max-filesize=25M -l /Dokumente/clamav.log /Dokumente/Dateien*/
Result after more than 4h cancellation with 534 of 3353 files approx. 1/6 of the files

micahsnyder commented

I'm closing this ticket because it is basically a duplicate of #590.