Re: [clamav-users] Squid + ClamAV

2020-04-07 Thread Joel Esler (jesler) via clamav-users
> On Apr 7, 2020, at 10:24 AM, Henrik K wrote: > > On Tue, Apr 07, 2020 at 11:27:50AM +0100, G.W. Haywood via clamav-users wrote: >> >> I certainly don't subscribe to the view expressed in this thread (if >> that's the view that was expressed, and I'm not simply misrepresenting >> it) that thi

Re: [clamav-users] Squid + ClamAV

2020-04-07 Thread Henrik K
On Tue, Apr 07, 2020 at 11:27:50AM +0100, G.W. Haywood via clamav-users wrote: > > I certainly don't subscribe to the view expressed in this thread (if > that's the view that was expressed, and I'm not simply misrepresenting > it) that this has all been done before. Some of it has, sure, but it >

Re: [clamav-users] Squid + ClamAV

2020-04-07 Thread G.W. Haywood via clamav-users
Hi there, On Tue, 7 Apr 2020, Andrea Venturoli via clamav-users wrote: On 2020-04-01 17:36, G.W. Haywood via clamav-users wrote: ... I imagine you'll want to set up instrumentation to attempt to measure the performance of the individual signatures - or at least of the separate databases You

Re: [clamav-users] Squid + ClamAV

2020-04-07 Thread Andrea Venturoli via clamav-users
On 2020-04-01 17:36, G.W. Haywood via clamav-users wrote: My approach would probably be to start with very little in the signature database(s) and gradually add things which might prove useful, at the same time excluding anything which might be expected to be nearly useless in this application,

Re: [clamav-users] Squid + ClamAV

2020-04-06 Thread Reio Remma via clamav-users
On 06/04/2020 15:53, Andrea Venturoli via clamav-users wrote: On 2020-04-02 08:14, Andrea Venturoli wrote: P.S. I'm investigatint your other message about the reload patch. Patch is working. However almost nothing has changed: from the logs I see DB reloads twice/three times per day... hard

Re: [clamav-users] Squid + ClamAV

2020-04-06 Thread Andrea Venturoli via clamav-users
On 2020-04-02 08:14, Andrea Venturoli wrote: P.S. I'm investigatint your other message about the reload patch. Patch is working. However almost nothing has changed: from the logs I see DB reloads twice/three times per day... hard to hit if you try :) and in the meanwhile I still see slowness

Re: [clamav-users] Squid + ClamAV

2020-04-01 Thread Henrik K
On Thu, Apr 02, 2020 at 08:14:21AM +0200, Andrea Venturoli via clamav-users wrote: > On 2020-04-01 19:38, Henrik K wrote: > > >> But pretty much all > >> websites are SSL encrypted these days, so there's nothing to scan > >> unless you do nasty man-in-the-middle decryption. Everyone has virus >

Re: [clamav-users] Squid + ClamAV

2020-04-01 Thread Andrea Venturoli via clamav-users
On 2020-04-01 19:38, Henrik K wrote: >> But pretty much all >> websites are SSL encrypted these days, so there's nothing to scan >> unless you do nasty man-in-the-middle decryption. Everyone has virus >> scanners on their PC, browsers have all sorts of proctection etc. >> The days of proxy scann

Re: [clamav-users] Squid + ClamAV

2020-04-01 Thread Paul Kosinski via clamav-users
I've been using HAVP with libclamav for years now, and have liked it. Now, of course, the prevalence of HTTPS limits the utility of something like HAVP. (I sometimes wonder what the *net* improvement in security is when HTTPS is used, given that one is now almost totally dependent on how secure the

Re: [clamav-users] Squid + ClamAV

2020-04-01 Thread Henrik K
On Wed, Apr 01, 2020 at 04:36:15PM +0100, G.W. Haywood via clamav-users wrote: > Hi there, > > On Wed, 1 Apr 2020, Andrea Venturoli via clamav-users wrote: > > >I'm trying the combination Squid + C-ICAP + SquidClamAV + ClamAV, and I'm > >seeing terrible performance. > >... > >Perhaps someone here

Re: [clamav-users] Squid + ClamAV

2020-04-01 Thread Henrik K
On Wed, Apr 01, 2020 at 03:47:09PM +0200, Andrea Venturoli via clamav-users wrote: > > The whole thing is working, but page loading times varies a lot: sometimes > they'll load as fast as without virus scanning, but often (the same pages) > will take several seconds to display (with ClamAV eating

Re: [clamav-users] Squid + ClamAV

2020-04-01 Thread G.W. Haywood via clamav-users
Hi there, On Wed, 1 Apr 2020, Andrea Venturoli via clamav-users wrote: I'm trying the combination Squid + C-ICAP + SquidClamAV + ClamAV, and I'm seeing terrible performance. ... Perhaps someone here is using the same thing or knows how to better tweak the engine. I'm not surprised that the p

Re: [clamav-users] Squid + ClamAV

2020-04-01 Thread Andrea Venturoli via clamav-users
On 2020-04-01 16:08, Vladislav Kurz via clamav-users wrote: Hello, Thanks for your answer. Are you running clamav as daemon? Sure. Is c-icap using the daemon socket (as if runing clamdscan)? AFAIK it does. I've got this in its config: # Path to the clamd socket, use clamd_local if

Re: [clamav-users] Squid + ClamAV

2020-04-01 Thread Vladislav Kurz via clamav-users
Dne středa 1. dubna 2020 15:47:09 CEST, Andrea Venturoli via clamav-users napsal(a): > Hello. > > I'm trying the combination Squid + C-ICAP + SquidClamAV + ClamAV, and > I'm seeing terrible performance. > It seems there's no SquidClamAV specific mailing list and asking on > generic Squid list did