[prev in list] [next in list] [prev in thread] [next in thread] 

List:       clamav-devel
Subject:    Re: [Clamav-devel] Question
From:       Török_Edwin <edwintorok () gmail ! com>
Date:       2010-04-27 13:19:31
Message-ID: 4BD6E463.3090303 () gmail ! com
[Download RAW message or body]

On 04/26/2010 10:20 PM, Mohammed Al-Saleh wrote:
> Hi Edwin,
> 
> Thanks for your reply.
> I need to know the cases where ClamAV has performance bottlenecks or issues.

The best way to do that is by measuring it.
Read the last part of this reply:
http://lurker.clamav.net/message/20081204.212941.c9fa45c2.en.html

> What kind of texts that could make ClamAV takes more time than usual. 

That question is hard to answer, since the signatures change each day,
thus the AC trie changes, the prefiltering patterns change ...

> Aho-Corasick and Boyer-Moore might have some situations that cause performance issue.

There is also a prefiltering step now.
You can search bugzilla on why it was introduced.

> I might consider doing improvements or study performance impact.

Don't expect it to be easy to make improvements.

I spent quite a lot of time on the prefiltering step, and the problem is
that some signatures falsely match a lot of times (like 'PE' from the PE
signature), but the entire signature usually doesn't.
So ClamAV has to stop the trie lookup, test the match, continue the trie
lookup lots of times.
Although the actual test is "fast enough", if it happens a million times
it does slow things down.

Also the AC and BM are not "textbook" versions, they contain extensions
(like wildcards).
It is important that you study the performance with the actual
signatures from main/daily.cvd, and on real files (both clean and infected).

> Do you think that this could be a realistic problem to study?

That depends if you have some specific ideas on how to improve AC/BM, or
you just want to try improving it, and give up if its not possible.

Best regards,
--Edwin
_______________________________________________
http://lurker.clamav.net/list/clamav-devel.html
Please submit your patches to our Bugzilla: http://bugs.clamav.net
[prev in list] [next in list] [prev in thread] [next in thread]