X-Spam-Check-By: sourceware.org From: "Hannu E K Nevalainen" <_garbage_collector_ AT telia DOT com> To: Subject: RE: stat(2) triggers on-demand virus scan Date: Sat, 14 Jan 2006 20:06:09 +0100 Message-ID: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----=_NextPart_000_0005_01C61945.F5A8DC40" In-reply-to: <43C8927B.9010902@earthlink.net> X-IsSubscribed: yes Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm Precedence: bulk List-Unsubscribe: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: cygwin-owner AT cygwin DOT com Mail-Followup-To: cygwin AT cygwin DOT com Delivered-To: mailing list cygwin AT cygwin DOT com ------=_NextPart_000_0005_01C61945.F5A8DC40 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit pmcferrin wrote: > The stat(2) system call runs very slowly because it is constantlt > triggering the McAfee on-demand virus scanner to scan the file that > is being stat'ed. This may not seem like a big thing but I frequently > stat thousands of files at a batch. I find that the stat runs much > faster when I temporarily disable the on-demand virus scanner. Judging from previous messages on this list it *seems* that one of the slowest things you can do in cygwin is accessing files; stat(), fopen() and the like. In general... FWIW/IMO; If you have the option to replace M*Af**[1] with a just as good an AV, then do that - I suggest to avoid Sym*ntec[2] products too as they seem to have similar problems. OTOH, I have good experience with what you find at f-secure dot com - I've had this one installed since cygwin 1.3.x was current, and prior to that. I've always considered S. and M. AV's to be CPU hogs in general terms - and have found f-secure to be much lighter in this respect. Now I wonder how M. and S. AV's compare to what I have done in a simple (attached) comparasion with fsecure V5.30 ON/OFF (Use e.g. NOTEPAD, and a monospace font to view it) /H [1] I've got previous experience with having it on my private PC. [2] I'm forced to live with such a thing at work. -- ------=_NextPart_000_0005_01C61945.F5A8DC40 Content-Type: text/plain; name="AV_fsecure-impact.txt" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="AV_fsecure-impact.txt" Test object: Windows partition with some additional SW installed Included on this disk is a huge cygwin installation. Test run several times prior taking these samples. Also making sure it ran without interference from other running software - this was to ensure somewhat persistent timings. AV ON AV OFF find =3Dprints=3D> 201195 (files+dirs) real 30.089 28.165 27.875 real 27.547 28.113 27.988 user 5.576 5.498 5.779 user 5.529 5.732 5.451 sys 23.966 22.123 21.638 sys 21.562 21.842 21.874 find - per file/dir, microseconds calculated from the above file/dir count 150 140 139 137 140 139 du -s =3Dprints=3D> 7431252 =09=09=09=09=09=09=09=09 real 87.608 88.285 87.523 real 43.355 41.916 41.815 user 8.155 8.03 7.89 user 7.358 8.015 7.624=20 sys 77.156 77.905 77.734 sys 33.531 32.062 32.312 du - per file/dir, microseconds calculated from the above file/dir count 435 439 435 215 208 208 From this it seems that "du" does something that triggers the f-secure AV in some way (AV doing the same as "du"?). This has the impact of doubling the scan time per file/dir. **** It would be interesting to see similar measurements done with McAFee and Symantec antivirus packages. **** -- actual test session log follows -- $ cd W: # Sempron 2800+, 1G RAM - has Win2K and related files on W:=20 --- AV enabled -- $ for (( i=3D0; i<3 ;i++ )) ;do time find 2>/dev/null -printf "%f\n" | wc -= l ;done 201195 real 0m30.089s user 0m5.576s sys 0m23.966s 201195 real 0m28.165s user 0m5.498s sys 0m22.123s 201195 real 0m27.875s user 0m5.779s sys 0m21.638s 201195 -- AV disabled -- $ for (( i=3D0; i<3 ;i++ )) ;do time find 2>/dev/null -printf "%f\n" | wc -= l ;done 201195 real 0m27.547s user 0m5.529s sys 0m21.562s 201195 real 0m28.113s user 0m5.732s sys 0m21.842s 201195 real 0m27.988s user 0m5.451s sys 0m21.874s 201195 $ for (( i=3D0; i<3 ;i++ )) ;do time du -s 2>/dev/null ;done 7431252 . real 0m43.355s user 0m7.358s sys 0m33.531s 7431252 . real 0m41.916s user 0m8.015s sys 0m32.062s 7431252 . real 0m41.815s user 0m7.624s sys 0m32.312s 7431252 . -- AV enabled -- $ for (( i=3D0; i<3 ;i++ )) ;do time du -s 2>/dev/null ;done 7431252 . real 1m27.608s user 0m8.155s sys 1m17.156s 7431252 . real 1m28.285s user 0m8.030s sys 1m17.905s 7431252 . real 1m27.523s user 0m7.890s sys 1m17.734s 7431252 . $ uname -a CYGWIN_NT-5.0 amd 1.5.19s(0.149/4/2) 20051229 16:10:48 i686 unknown unknown= Cygwin ------=_NextPart_000_0005_01C61945.F5A8DC40 Content-Type: text/plain; charset=us-ascii -- Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple Problem reports: http://cygwin.com/problems.html Documentation: http://cygwin.com/docs.html FAQ: http://cygwin.com/faq/ ------=_NextPart_000_0005_01C61945.F5A8DC40--