UKHomeOffice/docker-clamav

Scanning performance slow for fairly small ZIP files

Opened this issue · 2 comments

What we see with v1.5.0

When clamd first starts it's using an old set of virus definitions embedded in the image. Meanwhile freshclam is updating with new definitions and after 30 minutes (default) clamd does a self-check and reloads its database with the new definitions. After this our scanning time of 17MB zip files goes from 11 seconds to 70-80 seconds.

What we see with v1.6.1

The image already has newer definitions embedded (they're pulled as part of the build process) so the scanning times are slow immediately.

The files we're scanning are 17MB in size, containing around 4200 individual XML files.

I think we've spoken about this and found its an issue with the clamav database?
Not sure if you've managed to fix this on your deployment, but if so would be keen to see a PR?

Our fix was to wait for the virus definitions to be updated however last time I checked they've regressed again to where performance is borderline.