2

I use a Sophos antivirus program to scan email in antispam software ASSP, server OS Centos 7.4, MTA EXIM.

It run in this way

/usr/local/bin/savscan -sc -s -archive /file

It works very well to block malware but there is a problem. Every time savscan executes it needs to load in memory all its virus signatures , approximately 6 seconds only to start .

If you consider that in the server I receive about 40 email per minute , it's a huge waste of time and resources. I already contacted Sophos and they told me that they are not interested to create a scanner daemon such as clamAV daemon does...

So my question is , is there any way to run /usr/local/bin/savscan faster after its first execution ? Could it possible to run it as daemon , or put in memory the program after first execution so that the next executions will be much faster ?

2

Memory is not cleared if not required, so the program itself is probably still in memory.

It is the program itself that needs those 6 seconds for its initialization. The file should already be in memory, as well, so the disk might not be the most important factor.

I suggest to trace during these 6 seconds the program's use of CPU and disk, to see where is the this time spent.

If it is mostly the disk, you might be able to migrate the program and its signatures file to a RAM disk.

If the problem is in using the CPU, there is no solution except switching antivirus.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.