KDE - snapshots increasing virus scan time

**lord_valarian** · 12-Aug-2015, 14:10

I created with help a virus scan script to scan both linux and mswin. It's self-contained and simplifies virus scanning.

The opensuse 13.2 install added something called snapshots. The virus scan showed I had 178+ system '.snapshots' after a short time. Before, virus scans took less than 20 mins. This one I stopped at about four hours. Can I just delete them automatically through the script? These snapshots are ^ increasing scan time.

Need help here, thanks.

**gogalthorp** · 12-Aug-2015, 14:19

Well yes you can both remove them and stop them if you don't want them or you can reduce the number kept by changing the frequency of the shots. But they are restore points so may come in handy at some point. If you did detect a virus you might want to use them. Perhaps better is not to scan the snapshot directory in the first place.

**robin_listas** · 12-Aug-2015, 14:38

On 2015-08-12 23:16, lord valarian wrote:
>
> I created with help a virus scan script to scan both linux and mswin.
> It's self-contained and simplifies virus scanning.
>
> The opensuse 13.2 install added something called snapshots. The virus
> scan showed I had 178+ system '.snapshots' after a short time. Before,
> virus scans took less than 20 mins. This one I stopped at about four
> hours. Can I just delete them automatically through the script? These
> snapshots are ^ increasing scan time.

Simply tell your script to ignore the .snapshots directory.

--
Cheers / Saludos,

Carlos E. R.
(from 13.1 x86_64 "Bottle" at Telcontar)

**lord_valarian** · 12-Aug-2015, 15:12

Originally Posted by robin_listas

On 2015-08-12 23:16, lord valarian wrote:
>
> I created with help a virus scan script to scan both linux and mswin.
> It's self-contained and simplifies virus scanning.
>
> The opensuse 13.2 install added something called snapshots. The virus
> scan showed I had 178+ system '.snapshots' after a short time. Before,
> virus scans took less than 20 mins. This one I stopped at about four
> hours. Can I just delete them automatically through the script? These
> snapshots are ^ increasing scan time.

Simply tell your script to ignore the .snapshots directory.

--
Cheers / Saludos,

Carlos E. R.
(from 13.1 x86_64 "Bottle" at Telcontar)

I was doing that excluding '.snapshots' after I found the problem. So, I don't need to scan them? I can make an scan option to skip '.snapshots', on by default.

How do reduce max snapshots? Where in yast?

**gogalthorp** · 12-Aug-2015, 15:39

Misc-snapper

Snapper is the name of the program. It comes default on in BTRFS in openSUSE

**robin_listas** · 12-Aug-2015, 15:41

On 2015-08-13 00:16, lord valarian wrote:

> I was doing that excluding '.snapshots' after I found the problem. So, I
> don't need to scan them?

You decide. They are, although not exactly, old versions of all the
files. Say you have a hundred snapshots. It may be that on each one only
a file changes, but the filesystem presents you a virtual directory with
ALL the files as they were when the photo was taken, appearing to use a
hundred times the available space in the disk. It is a trick. And your
script is fooled by it, because it is scanning many times the same
files, not only those that changed.

So, you either skip scanning that directory entirely, or design a way to
detect changed files, by studying how snapshots work in the documentation.

--
Cheers / Saludos,

Carlos E. R.

(from 13.1 x86_64 "Bottle" (Minas Tirith))

**hcvv** · 13-Aug-2015, 03:33

Originally Posted by lord_valarian

So, I don't need to scan them?

That is of course your personal decission. As it is your personal decission to do a virus scan on a Linux system. Most people decided not to do that at all.

**lord_valarian** · 07-Sep-2015, 14:38

Originally Posted by hcvv

That is of course your personal decision. As it is your personal decision to do a virus scan on a Linux system. Most people decided not to do that at all.

Thanks for the info.

Command Opensuse:

Code:

clamscan -r / --exclude-dir=/sys --exclude-dir=/proc --exclude-dir=/dev --exclude-dir=/.snapshots --follow-dir-symlinks=0  --follow-file-symlinks=0"

This command is right for scanning linux dirs? Not following symlinks?

**hcvv** · 08-Sep-2015, 00:54

Originally Posted by lord_valarian

This command is right for scanning linux dirs? Not following symlinks?

As you may have understood, I never used that program, nor did I read the man page, thus I can not comment on the correctness of the options you use.

But in general, when you want to to something to "all" files (either literaly all fles in the system, or all files below a certain directory/mount point), it is of no use to follow symlinks, because you either will come to the file in any case using it's proper name (and doing the action again through one or more of it's symlinks does not seem to be very useful to me), or the symlink will point outside the part of the directory tree you want to act on and thus is of no interest to you. Thus, not following symlinks, seems logical to me.

**lord_valarian** · 09-Sep-2015, 13:58

Originally Posted by hcvv

As you may have understood, I never used that program, nor did I read the man page, thus I can not comment on the correctness of the options you use.

But in general, when you want to to something to "all" files (either literaly all fles in the system, or all files below a certain directory/mount point), it is of no use to follow symlinks, because you either will come to the file in any case using it's proper name (and doing the action again through one or more of it's symlinks does not seem to be very useful to me), or the symlink will point outside the part of the directory tree you want to act on and thus is of no interest to you. Thus, not following symlinks, seems logical to me.

Unless someone has a comment on the command line for scanning linux, this line will be used in scan virus. Thanks to all.