Hy!

I used antivir for more than one year now but for some reason I would like to switch to clamav.

Now I installed everything fine.

Everything is working but:

Clamav take more than a tripple of the time antivir needs for the same amount of files.

I usered a small directory to test

antivir --allfiles * (scan time: 00:00:03)

vs.

clamdscan * (Infected files: 0 Time: 120.746 sec (2 m 0 s))


So this is really very slow. For this small dir its not to bad but I have to scan 530GB!!

Every day, which can`t be done if the scan take more than 24 hours!!

I looked around at http://www.clamav.net/ and the mail archive but i didn`t find anything interesting.

Does anybody here have an idea how to speed up the scan or does anybody use clamav to scan a gread amount of data ?

Version : ClamAV 0.88.7/2395/Sat Dec 30 00:16:50 2006

Thanks!

I, too, used antivir for over a year. After they merged with, I forget who now, I became quickly unimpressed and switched to AVG. I never used ClamAV, but I think I can point to a possibility: your syntax for the antivir command is very short. I remember using more switches to include all files, subdirectories, archives, etc... Maybe ClamAV includes all that by default. It won't speed up anything but it might help explain the difference.

I think it depends on a lot of things. First of all you're not about clear what amount, size and type of files you're scanning and what HW resources can be used. Next to that the Holy Grail of each AV is its detection engine and they will defend it like, uh, something that defends well ;-p Some engines are faster compared to others, but like Dracolich kind of implies by the switch stuff, speed is a trade-off for accuracy. I did a small test not so long ago (see here) with BitDefender, ClamAV, F-prot and NOD32 which could give you an idea of what accuracy looks like for real. Goes to show enigines are more mature than others combining speed with accuracy. Unfortunately for most of those you'll have to shell out cash (thus keeping the AV monopolies alive). Best thing to do is *test* and compare.

Other than that my taxonomy tells me this is not a Linux Security issue, more about tweaking or testing AV, so I'll be moving this thread to the Linux Software forum RSN.