[SOLVED] ESET Increases Processing Time

[zolthar]

I have followed the guide:
https://forum.proxmox.com/threads/how-to-integrate-eset-antivirus-with-pmg.49788/post-232199
https://forum.proxmox.com/threads/pmg-6-1-how-to-add-antivirus.67006/#post-320192

Since implementing ESET, my average processing time has almost tripled on the same hardware:

BEFORE (ClamAV only)
Mar 5 10:59:45 spam pmg-smtp-filter[114537]: 1A089D6222A7EE02F73: processing time: 3.182 seconds (3.037, 0.106, 0)
Mar 5 10:59:50 spam pmg-smtp-filter[114668]: 1A004A6222A7F2BFD92: processing time: 3.564 seconds (3.436, 0.088, 0)
Mar 5 10:59:43 spam pmg-smtp-filter[114376]: 1A004A6222A7ECB1EF9: processing time: 2.952 seconds (2.837, 0.046, 0)
Mar 5 10:58:55 spam pmg-smtp-filter[114537]: 1A004A6222A7BCA585D: processing time: 3.126 seconds (2.958, 0.1, 0)
Mar 5 10:58:18 spam pmg-smtp-filter[114537]: 1A004A6222A799F3488: processing time: 0.892 seconds (0.769, 0.056, 0)
Mar 5 10:51:28 spam pmg-smtp-filter[114482]: 1A004A6222A5FA3FBD8: processing time: 6.077 seconds (5.882, 0.128, 0)
Mar 5 10:44:59 spam pmg-smtp-filter[114335]: 1A06A36222A4783E140: processing time: 2.78 seconds (2.659, 0.046, 0)
Mar 5 10:44:16 spam pmg-smtp-filter[114035]: 1A06A36222A44C0EA7E: processing time: 4.465 seconds (4.333, 0.059, 0)
Mar 5 10:44:09 spam pmg-smtp-filter[114267]: 1A06A36222A4470A0E6: processing time: 2.443 seconds (2.408, 0.023, 0)

AFTER ESET (and ClamAV still active)
Mar 5 17:35:21 spam pmg-smtp-filter[9827]: 1A09446223049C47665: processing time: 13.116 seconds (7.383, 0.024, 5.689)
Mar 5 17:32:54 spam pmg-smtp-filter[10063]: 1A09446223040C22C4B: processing time: 10.471 seconds (4.626, 0.093, 5.722)
Mar 5 17:31:15 spam pmg-smtp-filter[9827]: 1A0944622303A41146B: processing time: 15.497 seconds (9.655, 0.102, 5.711)
Mar 5 17:30:14 spam pmg-smtp-filter[10063]: 1A09446223036C12093: processing time: 9.945 seconds (3.83, 0.094, 5.99)
Mar 5 17:30:14 spam pmg-smtp-filter[10063]: 1A09446223036C12093: processing time: 9.945 seconds (3.83, 0.094, 5.99)
Mar 5 17:25:54 spam pmg-smtp-filter[9827]: 1A09446223025BCEC27: processing time: 21.84 seconds (6.778, 7.307, 6.426)
Mar 5 17:22:35 spam pmg-smtp-filter[10063]: 1A0944622301A2ADEC3: processing time: 8.886 seconds (3.032, 0.051, 5.775)
Mar 5 17:15:07 spam pmg-smtp-filter[9827]: 1A09446222FFE020757: processing time: 11.169 seconds (2.945, 0.022, 6.79)
Mar 5 17:04:07 spam pmg-smtp-filter[9658]: 1A09446222FD4C7E0DD: processing time: 11.406 seconds (5.504, 0.134, 5.716)

Based on @Stoiko Ivanov , the third is "CustomCheckscripts".

If you have implemented ESET, have you had the same impact on the 3rd time or were you able to reduce the times?

System performance appears good:

root@spam:/tmp# dig proxmox.com

; <<>> DiG 9.16.22-Debian <<>> proxmox.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 52857
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;proxmox.com.                   IN      A

;; ANSWER SECTION:
proxmox.com.            2719    IN      A       212.224.123.69

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Sat Mar 05 17:46:25 AEDT 2022
;; MSG SIZE  rcvd: 56

root@spam:/tmp# pmgperf /
CPU BOGOMIPS:      47884.56
REGEX/SECOND:      1359465
HD SIZE:           104.57 GB (/dev/mapper/pmg-root)
BUFFERED READS:    266.57 MB/sec
AVERAGE SEEK TIME: 3.03 ms
FSYNCS/SECOND:     1054.84
DNS EXT:           125.73 ms
DNS INT:           4.90 ms (domain.com)

 

[zolthar]

After tinkering and waiting, I had trimmed the script and remove all references to ESET v4 and now works perfectly.

Mar 5 20:22:51 spam pmg-smtp-filter[3892]: 1A097062232BE4B2D7B: processing time: 7.078 seconds (6.928, 0.058, 0.049)
Mar 5 20:21:02 spam pmg-smtp-filter[3872]: 1A097062232B7DBC950: processing time: 0.766 seconds (0.578, 0.088, 0.049)
Mar 5 20:18:09 spam pmg-smtp-filter[3832]: 1A097062232ACFD19FE: processing time: 1.479 seconds (1.253, 0.093, 0.048)
Mar 5 20:16:54 spam pmg-smtp-filter[3773]: 1A097062232A84D2DF2: processing time: 1.996 seconds (1.791, 0.103, 0.047)

 

[TRIXServer.com]

Hello, I suggest using ICAP service from ESET antivirus as described here

https://forum.proxmox.com/threads/pmg-6-1-how-to-add-antivirus.67006/post-448915

 

[zolthar]

Thanks @TRIXServer.com ,

I have just tried to implement your script, however now getting a completely different problem whereby ESET is not scanning and its all reverting back to ClamAV.

1. Restarted EFS Service
2. Reinstalled EFS
3. Created Custom Script (both methods)
4. Applied chmod +x to script
5. Checked Service
6. pmg.conf custom_check 1 is set
7. Rebooted server
8. Reinstalled
   1. c-icap
   2. pve-headers-`uname -r`

But its always scanned with ClamAV now - it was working before I started to make changes to the custom script.

I am sure I overlooked something - any help would be much appreciated.


efs.service

  efs.service - ESET Server Security
     Loaded: loaded (/lib/systemd/system/efs.service; enabled; vendor preset: enabled)
     Active: active (running) since Sun 2022-03-06 09:11:13 AEDT; 51s ago
    Process: 696 ExecStartPre=/opt/eset/efs/lib/install_scripts/check_start.sh (code=exited, status=0/SUCCESS)
    Process: 730 ExecStartPost=/bin/sleep 2 (code=exited, status=0/SUCCESS)
   Main PID: 729 (startd)
      Tasks: 42 (limit: 9453)
     Memory: 389.8M
        CPU: 12.576s
     CGroup: /system.slice/efs.service
             ├─729 /opt/eset/efs/sbin/startd
             ├─800 /opt/eset/efs/lib/logd
             ├─807 /opt/eset/efs/lib/scand
             ├─808 /opt/eset/efs/lib/sysinfod
             ├─809 /opt/eset/efs/lib/updated
             ├─810 /opt/eset/efs/lib/licensed
             ├─812 /opt/eset/efs/lib/utild
             ├─813 /opt/eset/efs/lib/confd
             └─825 /opt/eset/efs/lib/oaeventd

Mar 06 09:11:11 spam systemd[1]: Starting ESET Server Security...
Mar 06 09:11:13 spam systemd[1]: Started ESET Server Security.

tracker log

Mar 6 09:18:46 spam pmg-smtp-filter[1251]: 1A09806223E1C47B7FE: virus detected: Win.Trojan.Jaik-9939241-0 (clamav)

 

[zolthar]

Ok, I finally got it working with the original script (script misconfig) and the time for the script gone up to 6s again *** sigh *** Trimming the script did not work this time.

@TRIXServer.com I used your script, however it reverts back to ClamAV. Doesnt say any error on Tracker logs. Is there anywhere I should look to determine why that script is not working?

 

[TRIXServer.com]

Do you have Eset File Security? Did you enable remote scanning? whats eset file security log says? Be sure to setup eset to "NO CLEANING"




Here my config

 

[zolthar]

@TRIXServer.com .. I am such an ... Ive uninstalled and reinstalled so much I overlook the most important switch and assumed it was enabled!

I missed that most important switch:
Objects to scan > email files = disabled

Well Doh!...

AWESOME - thank you heaps. It is working and the time has dropped with your script:

Mar 6 11:03:50 spam pmg-smtp-filter[2169]: 1A09806223FA6512967: processing time: 1.603 seconds (1.437, 0, 0.104)
Mar 6 11:04:05 spam pmg-smtp-filter[2351]: 1A09806223FA7178261: processing time: 3.62 seconds (3.41, 0.109, 0.068)
Mar 6 11:05:42 spam pmg-smtp-filter[2161]: 1A09806223FAD245B6C: processing time: 3.771 seconds (3.547, 0.132, 0.03)