Hi there, On Mon, 26 Apr 2021, Haukur Valgeirsson via clamav-users wrote:
The only config I was able to locate is below. ... # cat /etc/clamav/freshclam.conf ... NotifyClamd /etc/clamav/clamd.conf
This seems to be saying you have a clamd.conf, otherwise freshclam wouldn't be able to find it and I'd expect it to give an error. If you do have a clamd.conf but don't have a clamd running I'd expect freshclam to throw an error when it tried to contact clamd to tell it to update its databases. On Tue, 27 Apr 2021, Haukur Valgeirsson via clamav-users wrote:
Now the plot thickens.
:/
Sorry for the "spam", but I am just trying to convey useful information. ...
Don't apologize, useful information is good. :) Mostly I'm responding to let you know that I'm still here, but also to say some of what you've said seems to me as if it might be expected behaviour. I haven't been able to look at the issues carefully, but I will unless someone beats me to it. What I mean by expected behaviour is that if you whitelist something by means of the digest of its uncompressed form, then the scanner sees it in compressed form, the scanner will uncompress it automatically - and then find that it's whitelisted. But you seem to be saying that things change when you move files around in the filesystem, and other things (for example things like directory/filesystem/size/scan/whatever restrictions) being equal, I don't see why there should be any difference in behaviour when the scan target is moved so I'd like to look into that when I have time.
Should I file a bugreport on this?
I'd think that's quite reasonable. :) -- 73, Ged. _______________________________________________ clamav-users mailing list clamav-users@lists.clamav.net https://lists.clamav.net/mailman/listinfo/clamav-users Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
