Re: [Dazuko-help] CLAMD CPU usage.

[John Ogness]

On 2010-01-11, Senthil Murugan Palani - ERS, HCL Tech <address@hidden> wrote:
>> - What version of Dazuko(FS)?
>
>     I am using Dazuko-2.3.7
>
>> - What version of ClamAV?
>
>       Clamav-0.95.2

With these versions I assume that Dazuko is not the reason for the
high CPU usage.

> Do we have any option to set priority to clamd. If so can you brief
> me how to do it!

That won't really help you. The problem is that ClamAV requires a lot
of time to scan the files. Dazuko does not allow an application to
open a file until ClamAV has returned its results. Increasing clamd's
priority (using renice or chrt) will allow ClamAV to get greater
scheduled blocks or higher scheduling priority, respectively, but I do
not think this will make things notably faster. In fact, it will most
likely make other running applications (or the entire system) notably
slower.

There are a lot of files that are opened, even for seamingly simple
operations. For example, on my system, when I call "man printf" the
following files are opened:

/usr/lib/man-db/man
/usr/lib/libgdbm.so.3.0.0
/usr/lib/libz.so.1.2.3.3
/usr/lib/locale/locale-archive
/usr/lib/gconv/gconv-modules.cache
/usr/share/man/man1/printf.1.gz
/usr/share/man/man3/printf.3.gz
/usr/share/man/man1/printf.1.gz
/usr/share/man/man1/printf.1.gz
/usr/bin/tbl
/usr/lib/man-db/manconv
/usr/bin/nroff
/usr/bin/zsoelim
/usr/bin/less
/usr/lib/locale/locale-archive
$HOME/.lesshst
/usr/lib/libstdc++.so.6.0.10
/usr/lib/libz.so.1.2.3.3
/usr/lib/locale/locale-archive
/usr/lib/libz.so.1.2.3.3
/usr/lib/locale/locale-archive
/usr/lib/gconv/gconv-modules.cache
/usr/lib/locale/locale-archive
/usr/lib/gconv/gconv-modules.cache
/usr/bin/nroff
/usr/lib/gconv/ISO8859-1.so
/usr/bin/locale
/usr/lib/locale/locale-archive
/usr/bin/groff
/usr/lib/libstdc++.so.6.0.10
/usr/lib/gconv/gconv-modules.cache
/usr/lib/gconv/ISO8859-1.so
/usr/lib/locale/locale-archive
/usr/share/groff/1.18.1/font/devutf8/DESC
/usr/bin/grotty
/usr/bin/troff
/usr/lib/libstdc++.so.6.0.10
/usr/lib/gconv/gconv-modules.cache
/usr/lib/gconv/ISO8859-1.so
/usr/lib/locale/locale-archive
/usr/lib/libstdc++.so.6.0.10
/usr/lib/gconv/gconv-modules.cache
/usr/lib/gconv/ISO8859-1.so
/usr/lib/locale/locale-archive
/usr/share/groff/1.18.1/font/devutf8/DESC
/usr/share/groff/1.18.1/font/devutf8/R
/usr/share/groff/1.18.1/font/devutf8/I
/usr/share/groff/1.18.1/font/devutf8/B
/usr/share/groff/1.18.1/font/devutf8/BI
/usr/share/groff/1.18.1/font/devutf8/M
/usr/share/groff/1.18.1/font/devutf8/G
/usr/share/groff/1.18.1/tmac/troffrc
/usr/share/groff/1.18.1/tmac/tty.tmac
/usr/share/groff/1.18.1/tmac/latin1.tmac
/usr/share/groff/1.18.1/tmac/hyphen.us
/usr/share/groff/1.18.1/tmac/tty-char.tmac
/usr/share/groff/1.18.1/tmac/latin1.tmac
/usr/share/groff/1.18.1/tmac/andoc.tmac
/usr/share/groff/1.18.1/tmac/troffrc-end
/usr/share/groff/1.18.1/tmac/an-old.tmac
/usr/share/groff/1.18.1/tmac/an-ext.tmac
/usr/share/groff/1.18.1/font/devutf8/DESC
/usr/share/groff/1.18.1/font/devutf8/R
/usr/share/groff/1.18.1/font/devutf8/B
/usr/share/groff/1.18.1/font/devutf8/I

Scanning these files using clamscan (without Dazuko) takes 6 seconds
_after_ the ClamAV engine has been loaded into memory.

That means, with Dazuko/Clamuko running, the command "man printf"
takes 6 seconds longer than it normally would. Considering it normally
takes less than 1 second, calling "man printf" suddenly isn't much
fun anymore.

Many of the files in that list are listed more than once. If Clamuko
supported scan result caching, that would speed the scan up by a
factor of 2 (in this example). Of course, 3 seconds also is not very
fast. But calling "man printf" a second time would show very little
notable extra latency.

However, all of this has nothing to do with Dazuko. A more appropriate
place to discuss improving Clamuko performance is on the ClamAV
mailing lists.

John Ogness

-- 
Dazuko Maintainer