On Fri, 19 Nov 2004 at 22:26:24 -0600, Damian Menscher wrote: > On Sat, 20 Nov 2004, Tomasz Papszun wrote: > >On Fri, 19 Nov 2004 at 20:09:06 -0600, Damian Menscher wrote: > >> > >>Clamd didn't find the EICAR pattern. Your virus database(s) could be > >>borked! > > > >Eicar-Test-Signature was moved to daily.cvd to let us update it later > >(because currently it causes FPs with some files), resulting in a short > >absence. > > I'm confused. If you have to change it, why not change main.cvd once, > rather than changing main.cvd to remove it then again to put it back?
We update main.cvd from time to time, not very often - to minimize mirrors'(and clients') network resources usage. As we were doing the update anyway, we moved the signature to daily.cvd even though an improved one wasn't ready yet - to not make another change of main.cvd only to replace one or a few signatures as it would be a thoughtless wastefulness. Moreover, the updated signature won't be put into main.cvd at once anyway, because newly created signatures aren't placed in main.cvd - they are placed in daily.cvd. > Are we expected to check for updates to the daily.cvd more often than > for updates to main.cvd? No. > I guess it goes without saying (but I will anyway) that changing things > in a way that doesn't cause clamdwatch.pl to fail would be greatly > appreciated. That's the way we try to proceed (surprise, surprise!). > (Imagine lots of scared little sysadmins trying to figure > out what to do when they get emails about ClamAV being "borked". ;) -- Tomasz Papszun SysAdm @ TP S.A. Lodz, Poland | And it's only [EMAIL PROTECTED] http://www.lodz.tpsa.pl/iso/ | ones and zeros. [EMAIL PROTECTED] http://www.ClamAV.net/ A GPL virus scanner _______________________________________________ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
