On Apr 9, 2008, at 7:12 PM, Mike Bird wrote:
Hose,
I turned on PUA signatures and got 3 seconds - not a significant
difference.
You seem to have a lot more signatures than I. Here's my clamd.conf
and my /var/lib/clamav. Any thoughts?
--Mike
# cat /etc/clamav/clamd.conf
#Automatically Generated by clamav-base postinst
#To reconfigure clamd run #dpkg-reconfigure clamav-base
#Please read /usr/share/doc/clamav-base/README.Debian.gz for details
LocalSocket /var/run/clamav/clamd.ctl
FixStaleSocket true
User clamav
AllowSupplementaryGroups true
ScanMail true
ScanArchive true
ArchiveMaxRecursion 5
ArchiveMaxFiles 1000
ArchiveMaxFileSize 10M
ArchiveMaxCompressionRatio 250
ArchiveLimitMemoryUsage false
ArchiveBlockEncrypted false
MaxDirectoryRecursion 15
FollowDirectorySymlinks false
FollowFileSymlinks false
ReadTimeout 180
MaxThreads 12
MaxConnectionQueueLength 15
StreamMaxLength 10M
LogSyslog false
LogFacility LOG_LOCAL6
LogClean false
LogVerbose false
PidFile /var/run/clamav/clamd.pid
DatabaseDirectory /var/lib/clamav
TemporaryDirectory /tmp
SelfCheck 3600
Foreground false
Debug false
ScanPE true
ScanOLE2 true
ScanHTML true
DetectBrokenExecutables false
MailFollowURLs false
ArchiveBlockMax false
ExitOnOOM false
LeaveTemporaryFiles false
AlgorithmicDetection true
ScanELF true
IdleTimeout 30
MailMaxRecursion 64
PhishingSignatures true
PhishingScanURLs true
PhishingRestrictedScan true
PhishingAlwaysBlockSSLMismatch false
PhishingAlwaysBlockCloak false
DetectPUA true
LogFile /var/log/clamav/clamav.log
LogTime true
LogFileUnlock false
LogFileMaxSize 0
# cd /var/lib/clamav
# ls -l *
-rw-r--r-- 1 clamav clamav 124218 2006-08-29 23:51
clamav-03676d29ae5d080a
-rw------- 1 clamav clamav 1196 2008-04-09 16:17 mirrors.dat
daily.inc:
total 1240
-rw-r--r-- 1 clamav clamav 17992 2007-04-26 00:59 COPYING
-rw-r--r-- 1 clamav clamav 106 2008-03-21 11:30 daily.cfg
-rw-r--r-- 1 clamav clamav 26014 2008-04-06 14:09 daily.db
-rw-r--r-- 1 clamav clamav 4875 2008-04-07 02:12 daily.fp
-rw-r--r-- 1 clamav clamav 5607 2008-02-26 12:07 daily.ftm
-rw-r--r-- 1 clamav clamav 275 2008-04-07 16:12 daily.hdb
-rw-r--r-- 1 clamav clamav 1224 2008-02-05 08:06 daily.hdu
-rw-r--r-- 1 clamav clamav 629 2008-04-09 10:17 daily.info
-rw-r--r-- 1 clamav clamav 892009 2008-04-09 10:17 daily.mdb
-rw-r--r-- 1 clamav clamav 33422 2008-04-08 03:15 daily.mdu
-rw-r--r-- 1 clamav clamav 227183 2008-04-09 08:17 daily.ndb
-rw-r--r-- 1 clamav clamav 6824 2008-04-06 05:02 daily.ndu
-rw-r--r-- 1 clamav clamav 3218 2008-03-26 16:17 daily.pdb
-rw-r--r-- 1 clamav clamav 1454 2008-02-27 11:08 daily.wdb
-rw-r--r-- 1 clamav clamav 2922 2007-09-03 11:53 daily.zmd
main.inc:
total 27616
-rw-r--r-- 1 clamav clamav 17992 2007-04-10 16:41 COPYING
-rw-r--r-- 1 clamav clamav 4733425 2008-04-06 14:08 main.db
-rw-r--r-- 1 clamav clamav 4815 2008-04-06 14:08 main.fp
-rw-r--r-- 1 clamav clamav 652769 2008-04-06 14:08 main.hdb
-rw-r--r-- 1 clamav clamav 318 2008-04-06 14:08 main.info
-rw-r--r-- 1 clamav clamav 7864180 2008-04-06 14:08 main.mdb
-rw-r--r-- 1 clamav clamav 14934069 2008-04-06 14:08 main.ndb
-rw-r--r-- 1 clamav clamav 217 2007-04-10 16:41 main.zmd
I currently only have 265244 sigs - it went down for some reason from
before (that line from the log above was from a previous restart, not
just a reloading of the database, but it had the socket creation
line). Another difference - we were having issues with .90.2 not
handling freshclam updates very well - since it was considered out of
date by clamav standards, the mirrors throttled our .diff downloads
significantly, even when we checked only once a day. Because of that,
we turned off ScriptedUpdates, pulled down main.cvd and daily.cvd
manually, restarted, and now freshclam downloads each of those fully
instead of the diffs. Clearly it's not the most efficient way to
update, but it mostly works.
In that vein, it looks like ScriptedUpdates branched your main.cvd
into the directory main.inc and daily.cvd into the directory
daily.inc, and uses some kind of different database. Currently our
clamav setup only has the regular databases and no ScriptedUpdates
directories:
-rw-r--r-- 1 clamav clamav 499635 2008-04-09 03:36 daily.cvd
-rw-r--r-- 1 clamav clamav 13050207 2008-04-07 03:01 main.cvd
-rw------- 1 clamav clamav 988 2008-04-09 20:03 mirrors.dat
This seems to be the only thing I can think of... but you were running
etch's version before without issue. Doh.
hose
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
