Re: [Clamav-users] Duplicate signatures?

2007-06-04 Thread Fajar A. Nugraha
Dennis Peterson wrote: > How does one get a main.inc directory? I thought it was having > ScriptedUpdates yes in the conf file and experimental code enabled at > build time but that doesn't do it. > > I believe ScriptedUpdates is enabled by default on non-experimental build as well, unless yo

Re: [Clamav-users] Duplicate signatures?

2007-06-04 Thread Dennis Peterson
Török Edvin wrote: > On 6/4/07, Fajar A. Nugraha <[EMAIL PROTECTED]> wrote: >> # ls -sR1 /var/clamav.bad >> 9145 main.cvd >>0 main.inc > > You have both a main.inc, and a main.cvd. Thus those signatures are > loaded twice. > This problem has been discussed on this list a while ago, look in the

Re: [Clamav-users] Duplicate signatures?

2007-06-04 Thread Fajar A. Nugraha
Török Edvin wrote: > On 6/4/07, Fajar A. Nugraha <[EMAIL PROTECTED]> wrote: > >> # ls -sR1 /var/clamav.bad >> 9145 main.cvd >>0 main.inc >> > > You have both a main.inc, and a main.cvd. Thus those signatures are > loaded twice. > Hi Edwin, thanks for your response. I use home-made r

[Clamav-users] freshclam mirror selection problem

2007-06-04 Thread Fajar A. Nugraha
Hi, I'm using clamav-0.91rc1 on Solaris10/sparc. I encountered a problem during database update (running freshclam manually) today # freshclam ClamAV update process started at Tue Jun 5 10:01:21 2007 main.inc is up to date (version: 43, sigs: 104500, f-level: 14, builder: sven) ERROR: getfile: d

Re: [Clamav-users] Stream connection timeouts while reading database

2007-06-04 Thread Dennis Peterson
Robert Blayzor wrote: > René Berber wrote: >> The timeout is caused by clamd taking 100% of the CPU for those 30 seconds, >> if >> you cannot increase the value then perhaps using 0.91rc1 is a better option >> (reloading databases is 10x faster, yep back to the 3 sec mark). > > > That's fine. A

Re: [Clamav-users] Stream connection timeouts while reading database

2007-06-04 Thread Robert Blayzor
René Berber wrote: > The timeout is caused by clamd taking 100% of the CPU for those 30 seconds, if > you cannot increase the value then perhaps using 0.91rc1 is a better option > (reloading databases is 10x faster, yep back to the 3 sec mark). That's fine. All I really wanted to know. I'll wai

Re: [Clamav-users] Stream connection timeouts while reading database

2007-06-04 Thread René Berber
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Robert Blayzor wrote: > Just to add to this... > > ClamAV 0.88.7 - Reading/loading of the virus database (~94k signatures) > took only 2-3 seconds. > > ClamAV 0.90.3 - 26-30 seconds. (122k signatures) > > > Same hardware/OS, no additional change

Re: [Clamav-users] Stream connection timeouts while reading database

2007-06-04 Thread Robert Blayzor
Just to add to this... ClamAV 0.88.7 - Reading/loading of the virus database (~94k signatures) took only 2-3 seconds. ClamAV 0.90.3 - 26-30 seconds. (122k signatures) Same hardware/OS, no additional changes. Does this seem about right? If so, it's causing clamd stream clients to hold up worker

Re: [Clamav-users] daily.wmd trouble with 0.91rc1

2007-06-04 Thread jef moskot
On Mon, 4 Jun 2007, Noel Jones wrote: > BTW, I'm *very* impressed with the db load speed improvements in > 0.91rc1. I agree. The load speed for 0.92 had me considering rolling back to 0.88, but 0.91rc1 is a tremendous improvement. Thanks for a great service. Jeffrey Moskot System Administrator

Re: [Clamav-users] daily.wmd trouble with 0.91rc1

2007-06-04 Thread Noel Jones
At 04:44 PM 6/4/2007, Tomasz Kojm wrote: >On Sat, 2 Jun 2007 13:02:54 +0200 >Tomasz Kojm <[EMAIL PROTECTED]> wrote: > > > On Sat, 02 Jun 2007 00:22:48 -0500 > > Noel Jones <[EMAIL PROTECTED]> wrote: > > > > > I recompiled clamav without --enable-experimental and still have the > > > error. It's un

[Clamav-users] Stream connection timeouts while reading database

2007-06-04 Thread Robert Blayzor
Upgraded from ClamAV 0.88.7 to 0.90.3 on FreeBSD4.x. All seems stable, but after the change I notice that when clamd reloads/re-reads the database, it seems incoming streams are held up longer than expected and clients timeout on the connection. (currently set to 10 seconds) When the database rel

Re: [Clamav-users] daily.wmd trouble with 0.91rc1

2007-06-04 Thread Tomasz Kojm
On Sat, 2 Jun 2007 13:02:54 +0200 Tomasz Kojm <[EMAIL PROTECTED]> wrote: > On Sat, 02 Jun 2007 00:22:48 -0500 > Noel Jones <[EMAIL PROTECTED]> wrote: > > > I recompiled clamav without --enable-experimental and still have the > > error. It's unclear if this flag does anything interesting right n

Re: [Clamav-users] daily.wmd trouble with 0.91rc1

2007-06-04 Thread Jason Frisvold
On 6/2/07, Bill Landry <[EMAIL PROTECTED]> wrote: > Noel, I started seeing the same problem this evening with ClamAV > 0.90.3. I finally had to recompile with --disable-experimental and > everything has run fine here since. I wonder if you disable the > experimental sections in the clamd.conf fil

Re: [Clamav-users] ClamAV timing out

2007-06-04 Thread Thomas Spuhler
On Monday 04 June 2007 03:23, Rob Sterenborg wrote: > >> Yes I'm aware of that. But.. clamdscan was as "slow" as clamscan as > >> clamavmodule. > > > > I would suggest that you either use clamdscan or clamavmodule. The > > time required for clamscan to load virus signatures (100 thousand or > > so)

Re: [Clamav-users] ClamAV timing out

2007-06-04 Thread Rob Sterenborg
>> Yes I'm aware of that. But.. clamdscan was as "slow" as clamscan as >> clamavmodule. > I would suggest that you either use clamdscan or clamavmodule. The > time required for clamscan to load virus signatures (100 thousand or > so) is enough (20-something seconds on my system) to justify the > ch

Re: [Clamav-users] ClamAV timing out

2007-06-04 Thread Fajar A. Nugraha
Rob Sterenborg wrote: > Yes I'm aware of that. But.. clamdscan was as "slow" as clamscan as > clamavmodule. I would suggest that you either use clamdscan or clamavmodule. The time required for clamscan to load virus signatures (100 thousand or so) is enough (20-something seconds on my system) to ju

Re: [Clamav-users] ClamAV timing out

2007-06-04 Thread Rob Sterenborg
>> So, I'm not so sure if this is ClamAV related. Maybe this doesn't >> belong here... I'll continue searching. > > Are you using clamscan instead of clamdscan? That could be > the reason for your trouble. Both programs take a long time to start > up, easily long enough to overrun a timeout. Lo

Re: [Clamav-users] [EMAIL PROTECTED] is getting thru

2007-06-04 Thread Trog
On Mon, 2007-06-04 at 11:13 +0530, BG Mahesh wrote: > hi > > We are using clamav-0.90.1 on Linux. Emails that are infected with > [EMAIL PROTECTED] are getting thru. Norton on our PC has been detecting > it. > Any idea what needs to be done to fix this problem? Since many users had > performance i