We split the daily into two, essentially, from what I understand. Then changed the flevel on the second set. This will allow older versions of ClamAV to receive updates, without crashing and newer versions of ClamAV to handle everything.
Maybe the speed of the connection or the mirror? Sent from my iPhone > On Nov 7, 2016, at 9:12 AM, Mark Allan <markjal...@gmail.com> wrote: > > Hi Joel, > > Thanks for the explanation. I'm still confused/surprised as to why such a > large cdiff should cause freshclam to hang though. What is the file size > limit that freshclam can handle safely? Also, given the cdiff file was > approximately the same size as the entire daily db, would it have been better > simply to skip that cdiff, causing everyone to re-download a new daily.cvd? > Or is that not advisable for some reason? > > Thanks. > Mark > >> On 7 Nov 2016, at 1:58 pm, Joel Esler (jesler) <jes...@cisco.com> wrote: >> >> Oh my, I apologize, it just dawned on me that I sent a note to the mirrors >> list, but not to the users list. >> >> A "larger than normal" cdiff to the Daily.cvd was published. Unfortunately >> with the timeline that we had to publish it, and my personal travel >> schedule, I was not able to put out a note prior to it being published, but >> I wanted to take a second to explain what happened. >> >> The failure condition symptom in ClamAV was the message "LibClamAV Error: >> mpool_malloc(): Attempt to allocate 8388608<tel:8388608> bytes.", and was >> documented as ClamAV bug 11647: >> https://bugzilla.clamav.net/show_bug.cgi?id=11647. >> >> This affects ClamAV versions before 0.98. There is a maximum mpool size >> limit that was reached based on the total signatures combined in memory of >> ClamAV holding the main and daily CVD. >> >> Those versions of ClamAV are EOL, and we knew we wanted to continue to add >> coverage for ClamAV users. We found a way to fit a smaller working signature >> set within the memory limits for the unsupported older versions, while still >> providing all signature content for supported and future versions. Therefore >> many new signatures will be marked for ClamAV 0.98 and forward (flevel >> increase) , and we have shifted a large number of signatures to allow prior >> versions to load the smaller signature set. >> >> We still strongly recommend that ClamAV users update their software in order >> to get full coverage from ClamAV. We cannot change the hard limits of the >> old versions, but from the comments on the mailing list and Bugzilla this >> should smooth the upgrade path. For any users running into issues upgrading >> ClamAV, look on the ClamAV Bugzilla for details. Several other tricky >> upgrade related questions have already been raised and settled in the >> comment section. >> >> Bottom line is, if you are using a version of ClamAV prior to 0.98.0 (0.97, >> 0.96, etc) you need to upgrade _now_. >> >> Please do not hesitate to ask me any questions concerning this. >> >> Sent from my iPad >> >> On Nov 7, 2016, at 6:52 AM, Mark Allan >> <markjal...@gmail.com<mailto:markjal...@gmail.com>> wrote: >> >> Hi folks, >> >> Was "daily-22474.cdiff" supposed to be ~20MB in size? The freshclam binary >> seems to hang whilst processing it, and if left long enough, you end up with >> a corrupt daily.cld database. >> >> I'm surprised no-one else has reported this here, so I'm wondering was it >> only the UK mirrors that were affected? Has anyone any idea what went wrong? >> >> Mark > > _______________________________________________ > clamav-users mailing list > clamav-users@lists.clamav.net > http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users > > > Help us build a comprehensive ClamAV guide: > https://github.com/vrtadmin/clamav-faq > > http://www.clamav.net/contact.html#ml _______________________________________________ clamav-users mailing list clamav-users@lists.clamav.net http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
