Hi there,
On Mon, 10 Aug 2020, Paul via clamav-users wrote:
Can anybody explain why when "PhishingScanURLs no " I get Loaded 9042923
signatures in logs and when "PhishingScanURLs yes" I get Loaded 11256306
signatures
I would have expected the difference to be the count of urls in daily.pdb
(263) not 2,213,383. What else is not getting loaded when "PhishingScanURLs
no" is set.
I suspect at least one fundamental misunderstanding. It isn't clear
to me how you have reached the conclusion that the 'PhishingScanURLs'
configuration option should have the effect which you describe (nor is
it clear why you mention only 'daily.pdb'). ClamAV signatures have a
complex structure. Without a good understanding of it, you'll find it
difficult to work with them. Please see the documentation, especially
http://www.clamav.net/documents/phishsigs#hints
which should explain why the number of URLs which you have counted (by
_whatever_ method) in any of the signature databases is not relevant
to the observed difference in the numbers of signatures loaded.
The entry for the 'PhishingScanURLs' configuration option in the man
page for clamd.conf may also help.
Apart from curiosity, is there some deeper reason behind the question
such as memory consumption, performance, vulnerability, ...? It's a
great deal more important to understand the limitations and potential
downsides of enabling certain features than it is to count signatures.
I'm tempted to say that a bare signature count is, to all intents and
purposes, more or less meaningless.
--
73,
Ged.
_______________________________________________
clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users
Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq
http://www.clamav.net/contact.html#ml
