Re: [clamav-users] Clamd CPU usage

2024-10-26 Thread Masaru Nomiya via clamav-users
Hello, I'm using clamav 1.4.1. In the Message; Subject : [clamav-users] Clamd CPU usage Message-ID : <3d9ff8d4-005e-4f14-a632-b0c481a54...@fibertel.com.ar> Date & Time: Mon, 14 Oct 2024 11:06:59 +0200 Limaunion via clamav-users has written: [...] > /dev/urandom t

[clamav-users] Clamd CPU usage

2024-10-14 Thread Limaunion via clamav-users
Hi! While doing a few random tests with the OnAccess scanner, I'm finding huge CPU usage and slowness. This are VMs based on RHEL9, using Clamav 1.0.7, with two or more vCPUs. Running 'dd' to create 25 file of 10Mb each, first run using urandom, second run using zero, I got the below results.

Re: [clamav-users] clamd: Is chunked scanning possible/sensible for files > 2Gbyte?

2023-09-01 Thread Andy Ragusa (aragusa) via clamav-users
rs ML Subject: [clamav-users] clamd: Is chunked scanning possible/sensible for files > 2Gbyte? Hi there, in my previous post I learned that there is in fact a hard file size limit in ClamAV of 2GByte. My company is not using ClamAV for the ususal e-Mail scanning, but for documents uploa

Re: [clamav-users] clamd: Is chunked scanning possible/sensible for files > 2Gbyte?

2023-08-31 Thread Al Varnell via clamav-users
I am not an authority here, but do recall having seen previous responses to similar suggestions and such an approach was not recommended. This has to do with the way many of the signatures are designed to look for multiple ascii or hex strings that could well occur with such strings located in d

[clamav-users] clamd: Is chunked scanning possible/sensible for files > 2Gbyte?

2023-08-30 Thread Ray
Hi there, in my previous post I learned that there is in fact a hard file size limit in ClamAV of 2GByte. My company is not using ClamAV for the ususal e-Mail scanning, but for documents uploaded to a collaboration platform. Some of the documents there are larger than 2 GByte. Therefore the

Re: [clamav-users] Clamd non recursive MULTISCAN?

2022-03-07 Thread Jorge Elissalde via clamav-users
Ok, thank you. El sáb, 5 mar 2022 a las 8:48, G.W. Haywood via clamav-users (< clamav-users@lists.clamav.net>) escribió: > Hi there, > > On Fri, 4 Mar 2022, Jorge Elissalde via clamav-users wrote: > > > ... > > Trying to be more forthcoming I can explain the code I'm making. > > > > - I get the f

Re: [clamav-users] Clamd non recursive MULTISCAN?

2022-03-05 Thread G.W. Haywood via clamav-users
Hi there, On Fri, 4 Mar 2022, Jorge Elissalde via clamav-users wrote: ... Trying to be more forthcoming I can explain the code I'm making. - I get the full list of files under c:\windows\system32 folder, just files, not folders (4913 files in my case). - I send every file name to clamd using t

Re: [clamav-users] Clamd non recursive MULTISCAN?

2022-03-04 Thread Jorge Elissalde via clamav-users
Thank you for your answer. Trying to be more forthcoming I can explain the code I'm making. - I get the full list of files under c:\windows\system32 folder, just files, not folders (4913 files in my case). - I send every file name to clamd using the SCAN command. The whole process takes almost 5

Re: [clamav-users] Clamd non recursive MULTISCAN?

2022-03-04 Thread Jorge Elissalde via clamav-users
Thank you for your answer. Trying to be more forthcoming I can explain the code I'm making. - I get the full list of files under c:\windows\system32 folder, just files, not folders (4913 files in my case). - I send every file name to clamd using the SCAN command. The whole process takes almost 5

Re: [clamav-users] Clamd non recursive MULTISCAN?

2022-03-04 Thread G.W. Haywood via clamav-users
Hi there, On Fri, 4 Mar 2022, Jorge Elissalde via clamav-users wrote: ... If I send the command "MULTISCAN c:\windows\system32", the recursive scanning will scan everything including folders, which is not what I want. This scanning must be processed using multi threads ... Can you be more fo

[clamav-users] Clamd non recursive MULTISCAN?

2022-03-04 Thread Jorge Elissalde via clamav-users
Hi, I'm trying to scan the files under c:\windows\system32 but excluding folders. I made a list of files and sent it to clamd using a session and SCAN command for every file, the whole process takes about 4 minutes (4200 files). If I send the command "MULTISCAN c:\windows\system32", the recursive

Re: [clamav-users] clamd RAM issue?

2021-11-01 Thread G.W. Haywood via clamav-users
Hi there, On Mon, 1 Nov 2021, Robert M. Stockmann via clamav-users wrote: ... If ... system invokes a perl based tool, anything can happen. ... Er, if you let it. :) I run a couple of Perl milters which do the heavy lifting for our mail filtering. One of them _is_ pretty heavy but I only al

Re: [clamav-users] clamd RAM issue?

2021-11-01 Thread Robert M. Stockmann via clamav-users
On Sun, 31 Oct 2021, Mark G Thomas wrote: > Date: Sun, 31 Oct 2021 13:05:35 -0400 > From: Mark G Thomas > > I'm running sendmail+mimedefang+clamav on a bunch of MX servers. > > This morning over a period of several hours each of my instances > appear to have caused clamd to consume all RAM and

Re: [clamav-users] clamd RAM issue?

2021-11-01 Thread Mark G Thomas
Hi, On Sun, Oct 31, 2021 at 08:32:00PM -0400, Michael Orlitzky via clamav-users wrote: > On Sun, 2021-10-31 at 13:05 -0400, Mark G Thomas wrote: > > > > Has anyone else had similar experiences recently? > > Not recently per se, but it happens. Do you limit the number of scans > that can be run

Re: [clamav-users] clamd RAM issue?

2021-10-31 Thread G.W. Haywood via clamav-users
Hi there, On Sun, 31 Oct 2021, Mark G Thomas wrote: I'm running sendmail+mimedefang+clamav on a bunch of MX servers. This morning over a period of several hours each of my instances appear to have caused clamd to consume all RAM and swap. Normally swap is empty and 10GB of the 16GB per host is

Re: [clamav-users] clamd RAM issue?

2021-10-31 Thread Michael Orlitzky via clamav-users
On Sun, 2021-10-31 at 13:05 -0400, Mark G Thomas wrote: > > Has anyone else had similar experiences recently? > Not recently per se, but it happens. Do you limit the number of scans that can be run simultaneously, if (for example) some doofus BCCs a 20MB nested zip file to everyone in his organ

[clamav-users] clamd RAM issue?

2021-10-31 Thread Mark G Thomas
Hi, I'm running sendmail+mimedefang+clamav on a bunch of MX servers. This morning over a period of several hours each of my instances appear to have caused clamd to consume all RAM and swap. Normally swap is empty and 10GB of the 16GB per host is free. This happened immediately following db up

[clamav-users] ClamD Socket Error on MacOS

2021-07-21 Thread Wayne Ho via clamav-users
Hi, I recently installed ClamAV via MacPorts was able to run the freshclam command after changing the following path to allow read/write permissions for the administrator account. //opt/local//bin/ For some reason, the opt folder and subfolders created by MacPorts only gives read/write perm

Re: [clamav-users] Clamd virus detection logging and notification

2020-11-28 Thread G.W. Haywood via clamav-users
Hi there, On Sat, 28 Nov 2020, Will Watters via clamav-users wrote: When the clamd daemon is running and automatically detects a virus - Nothing is "automatically detected". The daemon will scan something when you tell it to. How you do that is up to you. Read the manual about 'clamdscan'

[clamav-users] Clamd virus detection logging and notification

2020-11-27 Thread Will Watters via clamav-users
Hello, When the clamd daemon is running and automatically detects a virus - does it send to a specific log file or does this log file location need to be enabled or specified in the scan.conf? Also, is there any notification process when a virus is automatically detected by the clamd daemon as

Re: [clamav-users] Clamd freshclam Service

2020-11-26 Thread G.W. Haywood via clamav-users
Hi there, On Thu, 26 Nov 2020, Will Watters via clamav-users wrote: Is there anywhere to get clamd freshclam file to run as a daemon for Centos 6 please, so the service can be stopped and started, etc. Yes of course there is. There are several ways to do such a trivial administrative task, b

Re: [clamav-users] Clamd freshclam Service

2020-11-26 Thread Andrew C Aitchison via clamav-users
On Thu, 26 Nov 2020, Will Watters via clamav-users wrote: Hello, Is there anywhere to get clamd freshclam file to run as a daemon for Centos 6 please, so the service can be stopped and started, etc. I have this for Centos 7 but is systemd residing in /lib/systemd/system/clamd-freshclam.service

[clamav-users] Clamd freshclam Service

2020-11-26 Thread Will Watters via clamav-users
Hello, Is there anywhere to get clamd freshclam file to run as a daemon for Centos 6 please, so the service can be stopped and started, etc. I have this for Centos 7 but is systemd residing in /lib/systemd/system/clamd-freshclam.service, which does not work for Centos 6: # Run freshclam as a d

Re: [clamav-users] clamd scan problem

2020-11-01 Thread G.W. Haywood via clamav-users
Hi there, On Sat, 31 Oct 2020, Tsutomu Oyamada wrote: Scanning certain files will result in a memory error in clamd version 0.101.5. In the context of virus scanning, one year old is very old indeed. On Sat, 31 Oct 2020, G.W. Haywood wrote: That is rather an old version, released over a ye

Re: [clamav-users] clamd scan problem

2020-11-01 Thread Tsutomu Oyamada
Hi, Mark Thank you for your reply. The RAM size of my system is 4GB. I think it's not a system spec issue, it's a CVD issue. This is because an event occurred in the CVD update. Regards T.Oyamada On Sat, 31 Oct 2020 14:10:29 + Mark Fortescue via clamav-users wrote: > How much memory is a

Re: [clamav-users] clamd scan problem

2020-10-31 Thread G.W. Haywood via clamav-users
Hi there, On Sat, 31 Oct 2020, Tsutomu Oyamada wrote: Scanning certain files will result in a memory error in clamd version 0.101.5. That is rather an old version, released over a year ago. There have been some significant changes since then. You should upgrade. The platform is AIX. This

Re: [clamav-users] clamd scan problem

2020-10-31 Thread Mark Fortescue via clamav-users
Hi Tsutomu, How much memory is available on your AIX system ? Recommendations vary but I think the general rule will be you need 4GBytes or more for any server that has to do more than just run Clamd. Anything less that 2GBytes is going to be very slow or fail. Regards Mark. On 31/1

Re: [clamav-users] clamd cache (was Re: clamscan --disable-cache)

2020-10-07 Thread G.W. Haywood via clamav-users
Hi there, On Wed, 7 Oct 2020, Dave Sill via clamav-users wrote: "G.W. Haywood via clamav-users" wrote: Perhaps try enabling libclamav debug logging. I poked around a bit and didn't see an obvious way to do that ... You just need a line Debug yes in clamd.conf. There might be a "Debug

Re: [clamav-users] clamd cache (was Re: clamscan --disable-cache)

2020-10-07 Thread Dave Sill via clamav-users
"G.W. Haywood via clamav-users" wrote: > > Perhaps try enabling libclamav debug logging. I poked around a bit and didn't see an obvious way to do that, like a configure option or a .h file. Couldn't really tell where it would be logging. > During your scans I suspect that ClamAV may be reaching

Re: [clamav-users] clamd cache (was Re: clamscan --disable-cache)

2020-10-03 Thread G.W. Haywood via clamav-users
Hello again, On Sat, 3 Oct 2020, G.W. Haywood via clamav-users wrote: Stay tuned. Perhaps try enabling libclamav debug logging. During your scans I suspect that ClamAV may be reaching some limit(s) which is causing caching to be disabled. The limits are mostly tunable (in some cases perhaps

Re: [clamav-users] clamd cache (was Re: clamscan --disable-cache)

2020-10-03 Thread G.W. Haywood via clamav-users
Hi there, On Fri, 2 Oct 2020, G.W. Haywood wrote: Trying a bigger directory, this is going to take a while... Doesn't look like telling us anything this side of Christmas so I've killed the process. Time to think a bit harder. Stay tuned. -- 73, Ged. _

Re: [clamav-users] clamd cache (was Re: clamscan --disable-cache)

2020-10-02 Thread Dave Sill via clamav-users
Dave Sill via clamav-users wrote: > > Both of my test systems are RHEL 7, so off to try another platform. On Fedora 32: # find ~dave/Mail -type f|wc -l 26671 # clamdscan --fdpass ~dave/Mail Time: 932.395 sec (15 m 32 s) # clamdscan --fdpass ~dave/Mail Time: 489.627 sec (8 m 9 s) So

Re: [clamav-users] clamd cache (was Re: clamscan --disable-cache)

2020-10-02 Thread Dave Sill via clamav-users
On the desktop system: $ find Mail -type f|wc -l 123719 # clamdscan --fdpass ~de5/Mail Time: 2137.531 sec (35 m 37 s) # clamdscan --fdpass ~de5/Mail Time: 2138.778 sec (35 m 38 s) So, still not seeing a benefit from the cache. Both of my test systems are RHEL 7, so off to try another platform.

Re: [clamav-users] clamd cache (was Re: clamscan --disable-cache)

2020-10-02 Thread Dave Sill via clamav-users
"G.W. Haywood via clamav-users" wrote: > > Only 4GB on my clamd server. > > $ du -sh images/ > 16G images/ > $ find ./images -type f | wc -l > 11586 > $ clamdscan images/ > ... > Time: 12547.333 sec (209 m 7 s) > ... > $ clamdscan images/ > ... > Time: 1477.782 sec (24 m 37 s) That's a nic

Re: [clamav-users] clamd cache (was Re: clamscan --disable-cache)

2020-10-02 Thread G.W. Haywood via clamav-users
Hi there, On Thu, 1 Oct 2020, Dave Sill via clamav-users wrote: "G.W. Haywood via clamav-users" wrote: It might be too soon to draw that conclusion. It's possible that the daemon reloaded its database during your test, and I'd expect that to cause any cached results to be discarded for obvio

Re: [clamav-users] clamd cache (was Re: clamscan --disable-cache)

2020-10-01 Thread Micah Snyder (micasnyd) via clamav-users
ill Subject: Re: [clamav-users] clamd cache (was Re: clamscan --disable-cache) "G.W. Haywood via clamav-users" wrote: > Hi there, > > On Thu, 1 Oct 2020, Dave Sill via clamav-users wrote: > > >It looks like my point was lost in the noise ... > > Sorry, I g

Re: [clamav-users] clamd cache (was Re: clamscan --disable-cache)

2020-10-01 Thread Dave Sill via clamav-users
"G.W. Haywood via clamav-users" wrote: > Hi there, > > On Thu, 1 Oct 2020, Dave Sill via clamav-users wrote: > > >It looks like my point was lost in the noise ... > > Sorry, I guess it was late and I was in a hurry to get to bed. :( No worries. Thanks for your help. > >... on a much smaller

Re: [clamav-users] clamd cache (was Re: clamscan --disable-cache)

2020-10-01 Thread G.W. Haywood via clamav-users
Hi there, On Thu, 1 Oct 2020, Dave Sill via clamav-users wrote: It looks like my point was lost in the noise ... Sorry, I guess it was late and I was in a hurry to get to bed. :( The cache only saved a little over a minute on a 24 minute scan. I tried something similar here on a directory

Re: [clamav-users] clamd cache (was Re: clamscan --disable-cache)

2020-10-01 Thread Dave Sill via clamav-users
It looks like my point was lost in the noise so I'll try to distill it. I ran clamdscan twice on my /home (69k files) and got: # clamdscan --fdpass /home ... Time: 1428.433 sec (23 m 48 s) # clamdscan --fdpass /home ... Time: 1355.057 sec (22 m 35 s) # The cache only saved a little over a minut

Re: [clamav-users] clamd cache (was Re: clamscan --disable-cache)

2020-09-30 Thread G.W. Haywood via clamav-users
Hi there, On Wed, 30 Sep 2020, Dave Sill via clamav-users wrote: Unfortunately, it looks like the cache is too small to help. I ran clamdscan twice on my /home (69k files) and got: # clamdscan --fdpass /home /home/de5/eicar.tar.gz: Eicar-Signature FOUND WARNING: /home/de5/.cisco/hostscan/.lib

[clamav-users] clamd cache (was Re: clamscan --disable-cache)

2020-09-30 Thread Dave Sill via clamav-users
Dave Sill via clamav-users wrote: > > > >Skipping multiple copies of the same file won't really help because > > >the duplication is across systems, and because every file will be > > >rescanned every time clamscan is run. > > > > That's not true of clamdscan. > > Hmm...that's promising. I'll g

Re: [clamav-users] Clamd crashes frequently - macOS Catalina

2020-05-07 Thread Mark Allan via clamav-users
0.32 for case-insensitive patterns. > > If you have a sample and signature that cause the issue, I’d love a copy so I > can investigate further. > > -Micah > > From: Mark Allan > Date: Tuesday, May 5, 2020 at 5:20 AM > To: ClamAV users ML , Micah Snyder (micasnyd)

Re: [clamav-users] Clamd crashes frequently - macOS Catalina

2020-05-06 Thread James Brown via clamav-users
On 2 May 2020, at 9:32 am, Micah Snyder (micasnyd) via clamav-users wrote: > > It doesn’t appear that there is a primary maintainer for homebrew’s clamav > package, so I’ve placed a PR with the homebrew-core project to try to switch > the brew clamav package from pcre to pcre2: > https://githu

Re: [clamav-users] Clamd crashes frequently - macOS Catalina

2020-05-05 Thread G.W. Haywood via clamav-users
Hi there, On Tue, 5 May 2020, Micah Snyder (micasnyd) via clamav-users wrote: If you have a sample and signature that cause the issue, I’d love a copy so I can investigate further. If it will help I'd be happy to run it past my scanners too - I've taken no action on the offending signature, b

Re: [clamav-users] Clamd crashes frequently - macOS Catalina

2020-05-05 Thread Micah Snyder (micasnyd) via clamav-users
, 2020 at 5:20 AM To: ClamAV users ML , Micah Snyder (micasnyd) Subject: Re: [clamav-users] Clamd crashes frequently - macOS Catalina Hi Micah, Al is correct, we're using 10.32. I see 10.34 is now available, so I'll compile against that when I get a chance and see if it makes any differe

Re: [clamav-users] Clamd crashes frequently - macOS Catalina

2020-05-05 Thread Mark Allan via clamav-users
gt;> >> Regards, >> Micah >> >> From: clamav-users > <mailto:clamav-users-boun...@lists.clamav.net>> >> Date: Saturday, May 2, 2020 at 5:50 PM >> To: ClamAV users ML > <mailto:clamav-users@lists.clamav.net>> >> Cc: Mark Allan mailto:

Re: [clamav-users] Clamd crashes frequently - macOS Catalina

2020-05-04 Thread Al Varnell via clamav-users
ds, > Micah > > From: clamav-users <mailto:clamav-users-boun...@lists.clamav.net>> > Date: Saturday, May 2, 2020 at 5:50 PM > To: ClamAV users ML <mailto:clamav-users@lists.clamav.net>> > Cc: Mark Allan mailto:markjal...@gmail.com>> > Subject: Re: [clamav

Re: [clamav-users] Clamd crashes frequently - macOS Catalina

2020-05-04 Thread Micah Snyder (micasnyd) via clamav-users
Hi Mark, Which pcre2 version are you using? Regards, Micah From: clamav-users Date: Saturday, May 2, 2020 at 5:50 PM To: ClamAV users ML Cc: Mark Allan Subject: Re: [clamav-users] Clamd crashes frequently - macOS Catalina Hi James, Glad that seems to have helped. Al and others are correct

Re: [clamav-users] Clamd crashes frequently - macOS Catalina

2020-05-02 Thread Mark Allan via clamav-users
Hi James, Glad that seems to have helped. Al and others are correct that the distro should be updated to use pcre2, but I'm not convinced that's the root of the problem. We're seeing the issue with that signature despite already using pcre2 in our build. Mark > On 2 May 2020, at 3:45 am, Al V

Re: [clamav-users] Clamd crashes frequently - macOS Catalina

2020-05-01 Thread Al Varnell via clamav-users
Although I complete support what Mark has recommended, I would caution that there could easily be a future signature that will cause this same issue if the root cause of not upgrading to pcre2 is not accomplished, and figuring out what signature that is won’t be easy. Sent from my iPad -Al- >

Re: [clamav-users] Clamd crashes frequently - macOS Catalina

2020-05-01 Thread Robert Kudyba
Nice On Fri, May 1, 2020, 9:38 PM James Brown via clamav-users < clamav-users@lists.clamav.net> wrote: > On 1 May 2020, at 8:31 pm, Mark Allan via clamav-users < > clamav-users@lists.clamav.net> wrote: > > > Try excluding Email.Exploit.Efail-6641027-1 from the main ClamAV set. > > > Thanks Mark. A

Re: [clamav-users] Clamd crashes frequently - macOS Catalina

2020-05-01 Thread James Brown via clamav-users
On 1 May 2020, at 8:31 pm, Mark Allan via clamav-users wrote: > > Try excluding Email.Exploit.Efail-6641027-1 from the main ClamAV set. Thanks Mark. After over 12 hours clamd is still up and running. Looks like that sig was causing the problem. James. smime.p7s Description: S/MIME cryptograp

Re: [clamav-users] Clamd crashes frequently - macOS Catalina

2020-05-01 Thread Micah Snyder (micasnyd) via clamav-users
1, 2020 at 3:55 PM To: ClamAV users ML Cc: Micah Snyder (micasnyd) , G.W. Haywood , ClamAV Binary package maintainers Subject: Re: [clamav-users] Clamd crashes frequently - macOS Catalina Ged, This may be an excellent observation. I also see that you’re using libpcre instead of libpcre2

Re: [clamav-users] Clamd crashes frequently - macOS Catalina

2020-05-01 Thread Micah Snyder (micasnyd) via clamav-users
Re: [clamav-users] Clamd crashes frequently - macOS Catalina Hi there, On Fri, 1 May 2020, James Brown via clamav-users wrote: > Getting lots of crashes of clamd. No indication of an issue in the clamd.log. > ... > --> STACK GUARD70a1c000-70a1d000 [4K] --

Re: [clamav-users] Clamd crashes frequently - macOS Catalina

2020-05-01 Thread James Brown via clamav-users
> On 1 May 2020, at 8:31 pm, Mark Allan via clamav-users > wrote: > > Try excluding Email.Exploit.Efail-6641027-1 from the main ClamAV set. You can > do that by adding the signature name to a file called anything_you_like.ign2 > and putting it in your database directory. > > We had an issue w

Re: [clamav-users] Clamd crashes frequently - macOS Catalina

2020-05-01 Thread James Brown via clamav-users
On 1 May 2020, at 7:20 pm, G.W. Haywood via clamav-users wrote: > > it gave me the impression that the OS is "for entertainment only” Some people think that, but it does have BSD Unix as its base. > Do the clamd crashes happen at particular times, such as when clamd is > reloading its databa

Re: [clamav-users] Clamd crashes frequently - macOS Catalina

2020-05-01 Thread Mark Allan via clamav-users
Try excluding Email.Exploit.Efail-6641027-1 from the main ClamAV set. You can do that by adding the signature name to a file called anything_you_like.ign2 and putting it in your database directory. We had an issue with something crashing clamd and we strongly suspect that signature is to blame.

Re: [clamav-users] Clamd crashes frequently - macOS Catalina

2020-05-01 Thread G.W. Haywood via clamav-users
Hi there, On Fri, 1 May 2020, James Brown via clamav-users wrote: Getting lots of crashes of clamd. No indication of an issue in the clamd.log. ... --> STACK GUARD70a1c000-70a1d000 [4K] ---/rwx SM=NUL stack guard for thread 2 Stack 7

[clamav-users] Clamd crashes frequently - macOS Catalina

2020-04-30 Thread James Brown via clamav-users
Getting lots of crashes of clamd. No indication of an issue in the clamd.log. Installed via Homebrew. Crash Report has: Process: clamd [29231] Path: /usr/local/Cellar/clamav/0.102.2/sbin/clamd Identifier:clamd Version: 0 Code Type:

Re: [clamav-users] clamd onaccess scanning NFS

2019-11-11 Thread Kris Deugau
Mark Parker via clamav-users wrote: Hi all,     I'm investigating clamav as a solution for a couple hundred linux boxes. We need onaccess scanning but I'm running into an issue. For clamd to do onaccess scanning it needs to be run as root to use the inotify components, but since we export our

Re: [clamav-users] clamd onaccess scanning NFS

2019-11-11 Thread G.W. Haywood via clamav-users
Hi there, On Mon, 11 Nov 2019, Mark Parker via clamav-users wrote: On 11/11/2019 12:05 PM, G.W. Haywood via clamav-users wrote: On Mon, 11 Nov 2019, Mark Parker via clamav-users wrote: ... need onaccess scanning but .. clamd .. doesn't have permissions to view a user's home directory contents

Re: [clamav-users] clamd onaccess scanning NFS

2019-11-11 Thread Mark Parker via clamav-users
Well, I don't want to change permissions on 30 million files to make this work. Seems like the wrong thing to do. On 11/11/2019 12:05 PM, G.W. Haywood via clamav-users wrote: Hi there, On Mon, 11 Nov 2019, Mark Parker via clamav-users wrote: ... need onaccess scanning but .. clamd .. doesn't

Re: [clamav-users] clamd onaccess scanning NFS

2019-11-11 Thread G.W. Haywood via clamav-users
Hi there, On Mon, 11 Nov 2019, Mark Parker via clamav-users wrote: ... need onaccess scanning but .. clamd .. doesn't have permissions to view a user's home directory contents. Am I missing something? Group read? -- 73, Ged. ___ clamav-users ma

[clamav-users] clamd onaccess scanning NFS

2019-11-11 Thread Mark Parker via clamav-users
Hi all,     I'm investigating clamav as a solution for a couple hundred linux boxes. We need onaccess scanning but I'm running into an issue. For clamd to do onaccess scanning it needs to be run as root to use the inotify components, but since we export our NFS volumes with root_squash, it doe

[clamav-users] clamd and not user root

2019-11-09 Thread Frans de Boer
LS, The idea is noble, allowing clamd to drop privileges and thus being less vulnerable to manipulations. Running Clamonacc as root and feeding clamd with only the fd of a file. Alas, this still requires clamd to have read permission to read a file outside it's own user and group settings. O

Re: [clamav-users] Clamd OnAccess + OnAccessPrevention performance questions (linux)...

2019-10-16 Thread Micah Snyder (micasnyd) via clamav-users
Hi Ian, Sorry about the delayed response. It looks like no one else got back to you. I'll try to answer inline, best I can... Micah On 10/11/19, 11:46 AM, "clamav-users on behalf of Ian via clamav-users" wrote: > 1) Does OnAccessPrevention mean that it blocks access to files when they are

Re: [clamav-users] clamd@scan.service starting but not running

2019-10-13 Thread Ralf Hartings
Hi! Many thanks Reio! That did the trick! It needed almost about a minut to get started (I know it's a slow backup machine), but it runs now! It complains though about "Failed to get properties: Unit name clamd@.service is missing the instance name.", see below. Nothing to worry about

Re: [clamav-users] clamd@scan.service starting but not running

2019-10-13 Thread Reio Remma via clamav-users
On 13.10.2019 12:55, Ralf Hartings wrote: Hi, I had to fire-up a CENTOS 7 backup server as the main CENTOS 7 server crashed and I updated the backup server to the latest CENTOS version 7, incl Clamav 0.101.4. The log says, the clam service is starting, but never gets to run properly. Every

[clamav-users] clamd@scan.service starting but not running

2019-10-13 Thread Ralf Hartings
Hi, I had to fire-up a CENTOS 7 backup server as the main CENTOS 7 server crashed and I updated the backup server to the latest CENTOS version 7, incl Clamav 0.101.4. The log says, the clam service is starting, but never gets to run properly. Every systemctl status check I do says, it has r

[clamav-users] Clamd OnAccess + OnAccessPrevention performance questions (linux)...

2019-10-11 Thread Ian via clamav-users
1) Does OnAccessPrevention mean that it blocks access to files when they are in the queue, while scanned, and forevermore if detected as malicious, or is it a subset of this? Conversely, if OnAccessPrevention is disabled, can I expect a performance boost since there should be no blocking at any

[clamav-users] clamd using 100% CPU in Fedora 30 with sendmail & clamav-milter, : Probe for slot 1 returned: failed

2019-07-30 Thread Robert Kudyba
rpm -qa clamav-milter clamav-milter-0.101.2-2.fc30.x86_64 rpm -qa clamd clamd-0.101.2-2.fc30.x86_64 See some logs and statuses below. clamd takes up all of the CPU. clamd does appear to start based on the ps command but you can see the status shows no running; PID USER PR NIVIRTRE

Re: [clamav-users] Clamd fails to start with daily.cvd

2019-07-24 Thread Reio Remma via clamav-users
It was that simple! Thank you very much! :) Reio On 24/07/2019 15:31, Axb via clamav-users wrote: try this: in file clamd.service to section: [Service] add TimeoutSec=900 restart clamd service h2h On 7/24/19 1:49 PM, Reio Remma via clamav-users wrote: Hello! I rebooted my CentOS 7 mail s

Re: [clamav-users] Clamd fails to start with daily.cvd

2019-07-24 Thread Axb via clamav-users
try this: in file clamd.service to section: [Service] add TimeoutSec=900 restart clamd service h2h On 7/24/19 1:49 PM, Reio Remma via clamav-users wrote: Hello! I rebooted my CentOS 7 mail server last night and all of a sudden clamd is refusing to start - it burns CPU for a couple of minut

[clamav-users] Clamd fails to start with daily.cvd

2019-07-24 Thread Reio Remma via clamav-users
Hello! I rebooted my CentOS 7 mail server last night and all of a sudden clamd is refusing to start - it burns CPU for a couple of minutes and then gives up. I've now narrowed it down as much as I could and it seems there is a problem loading daily.cvd/daily.cld. I started by removing all un

Re: [clamav-users] ClamD dependent on MSVCR100D.dll

2019-05-30 Thread Micah Snyder (micasnyd) via clamav-users
://www.clamav.net/downloads#otherversions Regards, Micah Micah Snyder Software Engineer Talos Cisco Systems, Inc. From: clamav-users On Behalf Of DGone via clamav-users Sent: Thursday, May 30, 2019 2:37 PM To: clamav-users Cc: DGone Subject: [clamav-users] ClamD dependent on MSVCR100D.dll

[clamav-users] ClamD dependent on MSVCR100D.dll

2019-05-30 Thread DGone via clamav-users
Not sure if this is the right forum to ask this but appreciate any insight that can be provided. We are running clamd on a web server with IIS (Windows server)configured with srvany to run clamd as a service which the application calls during uploads to check files on their way in.  I've up

Re: [clamav-users] clamd using ~1GB memory on Debian Stretch

2019-05-16 Thread Alessandro Vesely via clamav-users
On Mon 13/May/2019 16:55:57 +0200 Avinash Sonawane via clamav-users wrote: > Now, for loading time, when I start firefox within 5-6 seconds it > immediately fills up 250+ Mb memory so for 950+ Mb (clamd) loading time > shouldn't be that of an issue. I use more or less average ~1GB too: PID USE

Re: [clamav-users] clamd using ~1GB memory on Debian Stretch

2019-05-14 Thread Avinash Sonawane via clamav-users
On Tue, 14 May 2019 14:53:27 + Graeme Fowler wrote: > If you're running a mail server that receives one email per > day... maybe do that in a different way so you use your resources for > something else! I'm not running a mail server. I'm using clamAV at user end scanning incoming email via

Re: [clamav-users] clamd using ~1GB memory on Debian Stretch

2019-05-14 Thread Graeme Fowler via clamav-users
On 13/05/2019, 15:57, Avinash Sonawane wrote: > Of course, at scanning time those signs/dbs need to be in memory. At > scanning time not *all the time*. e.g. I am expecting an email at 6 PM. > I don't mind clamd taking that much of a memory *at* 6 PM and then > release it. I find it absolutely inco

Re: [clamav-users] clamd using ~1GB memory on Debian Stretch

2019-05-13 Thread Matus UHLAR - fantomas
On 13.05.19 16:40, Matus UHLAR - fantomas wrote: but much longer time: # time clamscan /tmp/hwinfo /tmp/hwinfo: OK --- SCAN SUMMARY --- Known viruses: 9157095 Engine version: 0.100.3 Scanned directories: 0 Scanned files: 1 Infected files: 0 Data scanned: 0.57 MB Data read: 0.29

Re: [clamav-users] clamd using ~1GB memory on Debian Stretch

2019-05-13 Thread G.W. Haywood via clamav-users
Hi there, On Mon, 13 May 2019, Avinash Sonawane wrote: e.g. I am expecting an email at 6 PM. I don't mind clamd taking that much of a memory *at* 6 PM and then release it. I find it absolutely inconvenient to having to forgo ~1GB memory since the morning. As I said, a poor bargain. The barga

Re: [clamav-users] clamd using ~1GB memory on Debian Stretch

2019-05-13 Thread Kris Deugau
Avinash Sonawane via clamav-users wrote: On Mon, 13 May 2019 16:21:15 +0200 Matus UHLAR - fantomas wrote: loading takes time, much time. How much time are we talking about here? I suppose by 'time' we mean loading time (load binary and signatures) + processing time (comparing signatures).

Re: [clamav-users] clamd using ~1GB memory on Debian Stretch

2019-05-13 Thread Avinash Sonawane via clamav-users
On Mon, 13 May 2019 16:21:15 +0200 Matus UHLAR - fantomas wrote: > loading takes time, much time. How much time are we talking about here? I suppose by 'time' we mean loading time (load binary and signatures) + processing time (comparing signatures). Now, for loading time, when I start firefox

Re: [clamav-users] clamd using ~1GB memory on Debian Stretch

2019-05-13 Thread Alan Stern
On Mon, 13 May 2019, Matus UHLAR - fantomas wrote: > >> On Mon, 13 May 2019 19:30:12 +0530 > >> Avinash Sonawane wrote: > >> > >> > Single email account here. On average, I receive one email a day. > >> > Devoting 1Gb memory all the time for that seems a poor bargain. > > >On Mon, 13 May 2019, A

Re: [clamav-users] clamd using ~1GB memory on Debian Stretch

2019-05-13 Thread Matus UHLAR - fantomas
On Mon, 13 May 2019 19:30:12 +0530 Avinash Sonawane wrote: > Single email account here. On average, I receive one email a day. > Devoting 1Gb memory all the time for that seems a poor bargain. On Mon, 13 May 2019, Avinash Sonawane via clamav-users wrote: Why can't clamd let databases/signatu

Re: [clamav-users] clamd using ~1GB memory on Debian Stretch

2019-05-13 Thread Alan Stern
On Mon, 13 May 2019, Avinash Sonawane via clamav-users wrote: > On Mon, 13 May 2019 19:30:12 +0530 > Avinash Sonawane wrote: > > > Single email account here. On average, I receive one email a day. > > Devoting 1Gb memory all the time for that seems a poor bargain. > > Why can't clamd let datab

Re: [clamav-users] clamd using ~1GB memory on Debian Stretch

2019-05-13 Thread Matus UHLAR - fantomas
On Mon, 13 May 2019 19:30:12 +0530 Avinash Sonawane wrote: Single email account here. On average, I receive one email a day. Devoting 1Gb memory all the time for that seems a poor bargain. On 13.05.19 19:46, Avinash Sonawane via clamav-users wrote: Why can't clamd let databases/signatures sta

Re: [clamav-users] clamd using ~1GB memory on Debian Stretch

2019-05-13 Thread Avinash Sonawane via clamav-users
On Mon, 13 May 2019 19:30:12 +0530 Avinash Sonawane wrote: > Single email account here. On average, I receive one email a day. > Devoting 1Gb memory all the time for that seems a poor bargain. Why can't clamd let databases/signatures stay in secondary memory itself. Just load them when you actu

Re: [clamav-users] clamd using ~1GB memory on Debian Stretch

2019-05-13 Thread Matus UHLAR - fantomas
On Mon, 13 May 2019 15:46:42 +0200 Matus UHLAR - fantomas wrote: redusing the number of signatures is the only way I know of. On 13.05.19 19:30, Avinash Sonawane via clamav-users wrote: Actually, I was thinking if I could tweak some clamd conf without removing AV databases/signatures thereby

Re: [clamav-users] clamd using ~1GB memory on Debian Stretch

2019-05-13 Thread Avinash Sonawane via clamav-users
On Mon, 13 May 2019 15:46:42 +0200 Matus UHLAR - fantomas wrote: > On 13.05.19 18:53, Avinash Sonawane via clamav-users wrote: > redusing the number of signatures is the only way I know of. Actually, I was thinking if I could tweak some clamd conf without removing AV databases/signatures there

Re: [clamav-users] clamd using ~1GB memory on Debian Stretch

2019-05-13 Thread Matus UHLAR - fantomas
On 13.05.19 18:53, Avinash Sonawane via clamav-users wrote: I'm using ClamAV 0.100.3/25448 on Debian Stretch. It's a default install without any tweaks (as far as I remember). As seen from the below top o/p, without any active scan clamd is using ~1Gb memory. That's unacceptable. May I know how

[clamav-users] clamd using ~1GB memory on Debian Stretch

2019-05-13 Thread Avinash Sonawane via clamav-users
Hello! I'm using ClamAV 0.100.3/25448 on Debian Stretch. It's a default install without any tweaks (as far as I remember). As seen from the below top o/p, without any active scan clamd is using ~1Gb memory. That's unacceptable. May I know how do I reduce clamd memory usage? PID USER PR NI

[clamav-users] Clamd Service hangs on startup

2019-04-09 Thread Sebastiano Dante Alighieri via clamav-users
Hello all, i'm a newbie with ClamAv. I've been using it for a few years with MailScanner using the 'wrapper' method. but lately that has proven to be very slow. I think it may be due to ClamAv engine startup time, everytime MailScanner calls on it. a run of 'Time MailScanner --lint' shows a 3 min

Re: [clamav-users] Clamd no stop scan

2019-04-08 Thread JME via clamav-users
s unnecessarily in this case. JME De : Micah Snyder (micasnyd) Envoyé : lundi 8 avril 2019 18:26 À : ClamAV users ML Cc : jmed...@amv-sa.fr Objet : Re: [clamav-users] Clamd no stop scan G’day, Based on your clamdtop screenshot, it looks like your signature database is up to da

Re: [clamav-users] Clamd no stop scan

2019-04-08 Thread Micah Snyder (micasnyd) via clamav-users
11:22 AM To: "clamav-users@lists.clamav.net" Cc: "jmed...@amv-sa.fr" Subject: [clamav-users] Clamd no stop scan Morning, Some email scan are very slow. This is happening more and more often, and seems more related to Clamd's demime problems than real email attachm

[clamav-users] Clamd no stop scan

2019-04-08 Thread JME via clamav-users
Morning, Some email scan are very slow. This is happening more and more often, and seems more related to Clamd's demime problems than real email attachments concerns. Here is an example of an email that takes several minutes to analyze: # time clamdscan 1hDTxy-0002Dk-Lc.eml /tmp/eml/1hDTx

Re: [clamav-users] Clamd instream scanning

2019-04-04 Thread Micah Snyder (micasnyd) via clamav-users
clamav.net" Cc: "Wilson, Chad - US" Subject: [clamav-users] Clamd instream scanning Knowledge needed please. When streaming files to clamd for scanning, does the daemon write the file or does it handle all in memory? We do not have the temp directory uncommented/specified, so IF it w

Re: [clamav-users] Clamd instream scanning

2019-04-04 Thread Al Varnell via clamav-users
Somebody with better technical knowledge than I will need to get you a complete answer, but my observations tell me that if the file requires decompressed or other type of pre-processing, then temporary files are written to disk, but scans are normally conducted in memory. Sent from my iPad -A

[clamav-users] Clamd instream scanning

2019-04-04 Thread Wilson, Chad - US via clamav-users
Knowledge needed please. When streaming files to clamd for scanning, does the daemon write the file or does it handle all in memory? We do not have the temp directory uncommented/specified, so IF it writes it first, where does it write to? If it writes first, then do we have the risk of anothe

Re: [clamav-users] clamd using up all cpu on certain hosts

2018-11-20 Thread Micah Snyder (micasnyd)
lukn, Sorry about all the trouble. I wish I knew more about what was happening. I hope it's not a legitimate bug slipping by. Let us know if you end up finding anything else. Regards, Micah On Nov 20, 2018, at 2:40 AM, lukn mailto:lukn...@gmail.com>> wrote: Hi Micah and Henrik I'm slowl

  1   2   3   4   5   6   7   8   9   10   >