Some AV tests taking very long time

[Jānis]

Citēts Jānis <je at ktf.rtu.lv>
Sun, 07 Jul 2019 00:07:51 +0300:

> Hi!
>
> I have a strange problem with amavis:
>
> some tests are taking extreeemly long time:
>
> Jul  6 23:48:52 server.fqdn /usr/sbin/amavisd-new[17773]: (17773-03)  
> size: 16137, TIMING [total 119977 ms] - SMTP greeting: 2.9 (0%)0
> , SMTP EHLO: 2.0 (0%)0, SMTP pre-MAIL: 1.2 (0%)0, SMTP MAIL: 2.2  
> (0%)0, SMTP pre-DATA-flush: 178 (0%)0, SMTP DATA: 354 (0%)0,  
> check_init: 0.9
> (0%)0, digest_hdr: 3.7 (0%)0, digest_body_dkim: 22 (0%)0,  
> collect_info: 4.8 (0%)0, mime_decode: 21 (0%)0, get-file-type2: 134  
> (0%)1, parts_dec
> ode: 0.6 (0%)1, check_header: 1.4 (0%)1, AV-scan-1: 7010 (6%)6,  
> AV-scan-2: 111634 (93%)99, AV-scan-3: 0.1 (0%)99, spam-wb-list: 3.8  
> (0%)99, SA
>  msg read: 0.6 (0%)100, SA parse: 6 (0%)100, SA check: 358 (0%)100,  
> decide_mail_destiny: 8 (0%)100, notif-quar: 0.5 (0%)100,  
> fwd-connect: 40 (
> 0%)100, fwd-xforward: 1.0 (0%)100, fwd-mail-pip: 9 (0%)100,  
> fwd-rcpt-pip: 0.4 (0%)100, fwd-data-chkpnt: 0.1 (0%)100,  
> write-header: 1.1 (0%)100
> , fwd-data-contents: 0.3 (0%)100, fwd-end-chkpnt: 152 (0%)100,  
> prepare-dsn: 1.8 (0%)100, report: 2.5 (0%)100, main_log_entry: 12  
> (0%)100, upda
> te_snmp: 3.5 (0%)100, SMTP pre-response: 0.6 (0%)100, SMTP response:  
> 0.6 (0%)100, unlink-2-files: 0.7 (0%)100, rundown: 1.2 (0%)100
>
> (especially - AV-scan-2: 111634 (93%)
>
> and - as a result - sending server does not receive timely  
> acceptance and interrupts transmission. The message is sent  
> repeatedly over and over
>
> Jul  6 23:48:52 server.fqdn /usr/sbin/amavisd-new[17773]: (17773-03)  
> SMTP session over, timer stopped
> Jul  6 23:48:52 server.fqdn /usr/sbin/amavisd-new[17773]: (17773-03)  
> ESMTP: notice: client broke the connection without a QUIT ()
>
> What this AV-scan-2 represents? may be it is some problem with  
> clamav (0.101.2) - on servers with older one I do not observe such  
> delays.

It seems i found the problem - in the cfg file there was a wrong  
reference to clamd.sock which in my case is clamd.socket, so amavis  
fell over to fallback routine which is much more CPU and time intense.

Now it flies again!

Janis