search

tw4l / brunnhilde

Siegfried-based characterization tool for directories and disk images
MIT License
82 stars 11 forks source link

Using clamdscan instead of clamscan to take advantage of multithreading? #66

Open kieranjol opened 3 months ago

kieranjol commented 3 months ago

In a similar vein to https://github.com/tw4l/brunnhilde/issues/65, clamscan tends to run quite slow in general. As a result, we've stoped running clamav as part of brunnhilde and run it seperately for timing and workflow reasons. I'm now realising that clamd+clamscan allows for the '-m' option to be triggered, which hugely speeds up performance, but adds complexity as it relies on the clamd.conf for settings and it requires the clamd daemon to be running. I've seen performance increases of about 6-8 times greater speed on mac and windows.

I think this is a significant change as launching the daemon is different on mac and windows.

tw4l commented 3 months ago

Interesting! I'm all for making changes to speed up virus scanning so long as the user configuration doesn't get too complicated. Would you have bandwidth to look into this a bit further?