On 10/08/2020 15:10, G.W. Haywood via clamav-users wrote:
Hi there,
On Mon, 10 Aug 2020, Paul via clamav-users wrote:
Can anybody explain why when "PhishingScanURLs no " I get Loaded
9042923 signatures in logs and when "PhishingScanURLs yes" I get
Loaded 11256306 signatures
I would have expected the difference to be the count of urls in
daily.pdb (263) not 2,213,383. What else is not getting loaded when
"PhishingScanURLs no" is set.
I suspect at least one fundamental misunderstanding. It isn't clear
to me how you have reached the conclusion that the 'PhishingScanURLs'
configuration option should have the effect which you describe (nor is
it clear why you mention only 'daily.pdb'). ClamAV signatures have a
complex structure. Without a good understanding of it, you'll find it
difficult to work with them. Please see the documentation, especially
http://www.clamav.net/documents/phishsigs#hints
which should explain why the number of URLs which you have counted (by
_whatever_ method) in any of the signature databases is not relevant
to the observed difference in the numbers of signatures loaded.
The entry for the 'PhishingScanURLs' configuration option in the man
page for clamd.conf may also help.
Apart from curiosity, is there some deeper reason behind the question
such as memory consumption, performance, vulnerability, ...? It's a
great deal more important to understand the limitations and potential
downsides of enabling certain features than it is to count signatures.
I'm tempted to say that a bare signature count is, to all intents and
purposes, more or less meaningless.
Hi
Further digging has led me to find that when 'PhishingScanURLs no" is
set the signatures in safebrowsing.cld are not loaded by clamd.
paule@larch:clamscan -d safebrowsing.cld /etc/hosts
/etc/hosts: OK
----------- SCAN SUMMARY -----------
Known viruses: 2213119
Engine version: 0.102.4
Scanned directories: 0
Scanned files: 1
Infected files: 0
Data scanned: 0.00 MB
Data read: 0.00 MB (ratio 0.00:1)
Time: 3.954 sec (0 m 3 s)
Thanks Paul
_______________________________________________
clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users
Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq
http://www.clamav.net/contact.html#ml
