Re: [Clamav-users] Solaris 9 and clamd

2007-04-11 Thread Dennis Peterson
[EMAIL PROTECTED] wrote: > Hi > > Has anybody else noticed this. > > When running clamd with the ScanArchive config option set to yes, after a > couple of minutes of running cpu usage will look like this: > > last pid: 2470; load averages: 6.43, 4.06, 2.71 >

Re: [Clamav-users] error stops clamd

2007-04-11 Thread Dennis Peterson
jacusy wrote: > Alexander Grüner schrieb: >> Hello :-) >> >> Same here since 12:45h MESZ. >> >> After some tests this helped me to get all working again: >> >> sudo killall freshclam >> sudo rcclamd restart >> sudo rc restart >> >> And do NOT forget to comment you freshclam Updtes in cron out. >> >

Re: [Clamav-users] What's broken?

2007-04-11 Thread Dennis Peterson
Luca Gibelli wrote: > Hello Dennis, > >> Has the ClamAV backbone died? > > no, only some mirrors[*]. Most of our users are still running 0.8x and that > causes big spikes of traffic when we release a new main.cvd . > > [snip] >> Trying host db.us.clamav.net (66.111.55.10)... >> nonblock_connect:

Re: [Clamav-users] error stops clamd

2007-04-11 Thread Dennis Peterson
John Rudd wrote: > Dennis Peterson wrote: > >> You need to have better monitoring and notification, and a mail system >> that delivers mail even if there is a fatal error in the AV tool. This >> is hardly a ClamAV problem. > > Depends on what your goals are.

Re: [Clamav-users] Solaris 9 and clamd

2007-04-11 Thread Dennis Peterson
[EMAIL PROTECTED] wrote: >> I corrected this problem on my servers by removing the MSRBL databases >> from the system. CPU usage immediately dropped to normal values. >> >> dp >> ___ > > Thanks. But I don't beleive I make use of MSRBL. Don't see anything

Re: [Clamav-users] error stops clamd

2007-04-11 Thread Dennis Peterson
Luigi Iotti wrote: >> >> Notification is a part of the solution IMHO. If clamd recognizes that >> it's not able to load the new ones because the update process is still >> occurring, then it should continue running *AND* notify the sysadmin >> that it's running in what should be considered a degr

Re: [Clamav-users] *.cvd again!

2007-04-12 Thread Dennis Peterson
Tomasz Kojm wrote: > > for 3rd party databases this can be managed with a simple script, no need for > adding a keyring manager to ClamAV > I swear it was just 8 weeks ago or so when we last had this discussion and all manner of fine ideas and scripts came out of it. Me thinks some folks need

Re: [Clamav-users] *.cvd again!

2007-04-12 Thread Dennis Peterson
Chuck Swiger wrote: > On Apr 12, 2007, at 5:02 PM, Dennis Peterson wrote: >> Tomasz Kojm <[EMAIL PROTECTED]> wrote: >>> for 3rd party databases this can be managed with a simple script, >>> no need for >>> adding a keyring manager to ClamAV >> I

Re: [Clamav-users] Bug in 0.90.2

2007-04-12 Thread Dennis Peterson
René Berber wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA256 > > Hi, > > While building clamav-0.90.2 I saw these messages: > > unrar/unrar.c: In function `cli_unrar_extract_next_prepare': > unrar/unrar.c:1549: warning: integer constant is too large for "long" type > unrar/unrar.c:1550

Re: [Clamav-users] how to set cron to run freshclam

2007-04-13 Thread Dennis Peterson
Roger M wrote: > On Fri, 2007-04-13 at 13:26 +0200, Pascal Duchatelle wrote: >> Hello, >> I am not that much experienced with linux. >> I would like to have freshclam doing updates by itself. Until now I did >> the update manually. >> The clamav-update file in my /etc/cron.d directory is as follow:

Re: [Clamav-users] how to set cron to run freshclam

2007-04-13 Thread Dennis Peterson
Dennis Peterson wrote: > > > if [ -z "$1" ]; then >/usr/bin/bash -c 'sleep $[ RANDOM % 1800 ]' > fi > > This creates a random number between 1 and 900 that becomes the number > of seconds the code sleeps before jumping into the fray. Damn

Re: [Clamav-users] *.cvd again!

2007-04-13 Thread Dennis Peterson
Freddie Cash wrote: > On Thursday 12 April 2007 06:53 pm, Dennis Peterson wrote: >> And just an fyi, be cautious of the MSRBL-Images file. Rechecking it >> while I was typing this shows that with it in place it will cause the >> clamd cpu to rise to 90% and stay there. At 11M

Re: [Clamav-users] *.cvd again!

2007-04-13 Thread Dennis Peterson
> > On Friday 13 April 2007 09:25 am, Dennis Peterson wrote: > > Freddie Cash wrote: > Heh, lucky you. =A0:) > > Out of the 4199 messages blocked as "infected" so far this month, 289 of = > > them were marked as MSRBL-Images/* by amavisd-new and clamav. =

Re: [Clamav-users] how to set cron to run freshclam

2007-04-15 Thread Dennis Peterson
Pascal Duchatelle wrote: > Le Fri, 13 Apr 2007 08:26:42 -0700, > Dennis Peterson <[EMAIL PROTECTED]> a écrit : > >> Roger M wrote: >>> On Fri, 2007-04-13 at 13:26 +0200, Pascal Duchatelle wrote: >>>> Hello, >>>> I am not that much experienced

Re: [Clamav-users] clamav-0.90.2 crashes - solved

2007-04-17 Thread Dennis Peterson
Bill Maidment wrote: > Guys > A couple of days ago I reported clamav crashing on my 64 bit machine. > It turns out that the fc5/fc6 rpms for xen kernels 2.6.20 are *all* broken. > Backtracking to the 2.6.19-1.2911 kernel solved it. > Sorry for the noise. So it sounds like a problem with the rpm, n

Re: [Clamav-users] RPM 0.90.2 FC4

2007-04-18 Thread Dennis Peterson
Steven Stern wrote: > Robert Niepel wrote: >> Hello, >> >> an anyone tell me where i can get RPM?s for Fedora Core 4? >> Or has anyone have an hotwo to build those rpm from tar.gz? >> >> > > download the unpack the tar.gz file > In the directory, > > ./configure > make > make install

Re: [Clamav-users] RPM 0.90.2 FC4

2007-04-19 Thread Dennis Peterson
Steven Stern wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > Dennis Peterson wrote: >> Steven Stern wrote: >> >>> Robert Niepel wrote: >>>> Hello, >>>> >>>> an anyone tell me where i can get RPM?s for Fedora Co

Re: [Clamav-users] Install clamav on CentOS 4.4

2007-04-20 Thread Dennis Peterson
Ralph Angenendt wrote: > [EMAIL PROTECTED] wrote: > >> I have installed it just fine using the source from the ClamAV site. >> It works quite well. I use the OpenSSL version that comes default in >> ClamAV. My only ./configure switches that are used are: >> --disable-zlib-check and --enable-expe

Re: [Clamav-users] clamav-0.90.2 on Solaris10 box.

2007-04-20 Thread Dennis Peterson
Dj Helmes wrote: > I just upgraded Clamav from clamav-0.88.7 to clamav-0.90.2. on my > Solaris10 box. > I received no issues during the build / make or the install. > When I started my mailRelay I started receiving the following. Has > anyone else experienced this? > > Apr 20 07:27:11 smtp1 mime

Re: [Clamav-users] OT: Sanesecurity Sigs: Important News

2007-05-05 Thread Dennis Peterson
Steve Basford wrote: > Due to me nearly running out of bandwidth last month (17gb out of a 20gb > host package), some urgent changes were needed to the signature hosting, > otherwise I'd start getting charged for the extra bandwidth :( > > So, to keep this short, here's a to-do list ;) > > *** On

Re: [Clamav-users] OT: Sanesecurity Sigs: Important News

2007-05-08 Thread Dennis Peterson
Noel Jones wrote: > At 03:17 AM 5/8/2007, Alexander Grüner wrote: >> Ralf, >> >> I wrote a small script by myself - very simpel. It seems to work now for >> months. >> >> #!/bin/sh >> cd /tmp >> # Unofficial Phising rules for ClamAV >> wget -nd -m http://ftp.tiscali.nl/sanesecurity/phish.ndb.gz >>

Re: [Clamav-users] OT: Sanesecurity Sigs: Important News

2007-05-08 Thread Dennis Peterson
Dennis Peterson wrote: > > A kinder, gentler usage of wget would include -N to prevent getting the > same file over and over thereby burning off Steve's bandwidth. Just be > sure to preserve the name and time stamp of the gz files when you ungzip > them. Use: &

Re: [Clamav-users] OT: Sanesecurity: new urls?

2007-05-08 Thread Dennis Peterson
Steve Basford wrote: > > Christopher X. Candreva wrote: >> If the script could be on the file name instead of the directory name it >> would be better. >> >> > Hmm... would this work for you script? > > http://www.sanesecurity.com/clamav/phishsigs/index.php > http://www.sanesecurity.com/clama

Re: [Clamav-users] unreponsive under solaris - 0.90.2

2007-05-15 Thread Dennis Peterson
Tom Bombadil wrote: > I see old posts describing similar problem, but since I see no > workaround, here it goes: > > > Clamav seems to work alright when load is low, but when the load > increases, it becomes unresponsive, and I get tons of these errors: > > Tue May 15 04:35:40 2007 -> ERROR: Sca

Re: [Clamav-users] unreponsive under solaris - 0.90.2

2007-05-16 Thread Dennis Peterson
G.W. Haywood wrote: > Hi there, > > On Wed, 16 May 2007 Dennis Peterson wrote: > >> ... I also don't scan (or accept) most file formats declared unsafe >> by Microsoft. > > How do you determine this? From Microsoft's web page: http://support.microsof

Re: [Clamav-users] unreponsive under solaris - 0.90.2

2007-05-17 Thread Dennis Peterson
G.W. Haywood wrote: > Hello again, > > On Wed, 17 May 2007 Dennis Peterson wrote: > >>>> ... I also don't scan (or accept) most file formats declared unsafe >>>> by Microsoft. >>> How do you determine this? >> From Microsoft's web pag

Re: [Clamav-users] problem installing .90 on UltraSparc

2007-05-17 Thread Dennis Peterson
.rp wrote: > trying to install clamav on mail servers and running into the > following error: > > make all-recursive > make[1]: Entering directory `/usr/src/clamav-0.90.1' > Making all in libclamav > make[2]: Entering directory `/usr/src/clamav-0.90.1/libclamav' > source='matcher-ac.c' object='m

Re: [Clamav-users] Upgrade to 0.90.2

2007-05-17 Thread Dennis Peterson
Aaron Schubert wrote: > Thanks I'll give it a try. > You should also be aware the configuration files have changed significantly since 0.88 was released. And don't forget to stop the old version before starting the new version. dp ___ Help us build a

Re: [Clamav-users] Clamd use up 99.9 % cpu

2007-05-20 Thread Dennis Peterson
Thomas Spuhler wrote: > Hello: I just joined the list and found this thread in the archive. > It seems, I have a very similar problem. Clamscan is using up to 100% cpu and > memory lately and sometimes cannot even keep up with the e-mail flood. > It happened twice in about a month. I deleted all s

Re: [Clamav-users] MSRBL-Images.hdb same size since 25 May

2007-05-28 Thread Dennis Peterson
Chris wrote: > I tried leaving a message on the MSRBL web site, however, in order to send my > message I'm asked: > > Captcha: > Enter the text from the image on the left > > except there isn't any and therefore the message can't be sent. What I'm > trying to ask is that on the 25th there

Re: [Clamav-users] ClamAV 0.91rc1 config. change

2007-05-30 Thread Dennis Peterson
Luca Gibelli wrote: > Dear ClamAV users, > > Starting from 0.91rc1, the default value for LocalSocket in clamd.conf > has been changed from /tmp/clamd to /tmp/clamd.socket to avoid confusion. > > You must update the configuration of all programs that connect to clamd > through unix socket to poi

Re: [Clamav-users] daily.wmd trouble with 0.91rc1

2007-06-01 Thread Dennis Peterson
Noel Jones wrote: > At 09:56 PM 6/1/2007, Christopher X. Candreva wrote: >> On Fri, 1 Jun 2007, Noel Jones wrote: >> >>> I seem to be having trouble with clamscan 0.91rc1 choking with the current >>> daily.wmd file. It was working fine until the most recent db update. >> I don't have this problem,

Re: [Clamav-users] daily.wmd trouble with 0.91rc1

2007-06-02 Thread Dennis Peterson
Noel Jones wrote: > At 11:39 PM 6/1/2007, Dennis Peterson wrote: >> Noel Jones wrote: >> I'm running Solaris 10 x86 here and cannot duplicate your error. I moved >> the daily.wdb file to /tmp and clamd died. I restarted it with svcadm >> and it started and ran fil

Re: [Clamav-users] Stream connection timeouts while reading database

2007-06-04 Thread Dennis Peterson
Robert Blayzor wrote: > René Berber wrote: >> The timeout is caused by clamd taking 100% of the CPU for those 30 seconds, >> if >> you cannot increase the value then perhaps using 0.91rc1 is a better option >> (reloading databases is 10x faster, yep back to the 3 sec mark). > > > That's fine. A

Re: [Clamav-users] Duplicate signatures?

2007-06-04 Thread Dennis Peterson
Török Edvin wrote: > On 6/4/07, Fajar A. Nugraha <[EMAIL PROTECTED]> wrote: >> # ls -sR1 /var/clamav.bad >> 9145 main.cvd >>0 main.inc > > You have both a main.inc, and a main.cvd. Thus those signatures are > loaded twice. > This problem has been discussed on this list a while ago, look in the

Re: [Clamav-users] Duplicate signatures?

2007-06-05 Thread Dennis Peterson
Fajar A. Nugraha wrote: > Dennis Peterson wrote: >> How does one get a main.inc directory? I thought it was having >> ScriptedUpdates yes in the conf file and experimental code enabled at >> build time but that doesn't do it. >> >> > > I believe

Re: [Clamav-users] Freeze after reading db ?

2007-06-05 Thread Dennis Peterson
Marco Simioni wrote: > Hi, > i'm using Clamav inside the Zimbra Collaboration Suite on ubuntu 6. > Clamav version 0.90.2, on ubuntu 6.06.1 server. This behaviour > happened with 0.90.3 too. > > I see that amavisd cannot connect to Clamav > > Any idea? Run clamconf and put the results here. dp

Re: [Clamav-users] Freeze after reading db ?

2007-06-05 Thread Dennis Peterson
Marco Simioni wrote: >> Run clamconf and put the results here. >> > > The clamd is started with the option "--config-file > /opt/zimbra/conf/clamd.conf" so i started the clamconf with the option > "--config-dir /opt/zimbra/conf/". > > Here is the output: > > TCPAddr not set > TCPSocket = 3310

Re: [Clamav-users] Freeze after reading db ?

2007-06-05 Thread Dennis Peterson
Marco Simioni wrote: >>> TCPAddr not set >>> TCPSocket = 3310 >> I think I'd start here. It appears you have not updated your config file >> correctly. >> > > Very strange, because it is a fresh zimbra install into a fresh > ubuntu, i usually don't have to modify ANY config file. > Also, the comme

Re: [Clamav-users] Re(2): Temporary file name

2007-06-12 Thread Dennis Peterson
SYPECom-AV-Dev wrote: >> Not needed. It would be too easy for virus writers to just change the name >> and/or some property to trick defenses, so anti virus software doesn't care >> about that. > > Ok, from what you are saying, ClamAV should therefore be as effective to scan > a file named 1

Re: [Clamav-users] clamscan extremly slow

2007-06-16 Thread Dennis Peterson
Thomas Spuhler wrote: > I posted on another list as well, but thought this may gets more attention > from the developers: > Clamscan is extremely slow and CPU hungry. clamscan a pdf file of about 1.2 > MB > and it takes about 1 minute. Same file with a commercial scanner takes 2 sec. > This wasn

Re: [Clamav-users] clamscan extremly slow

2007-06-18 Thread Dennis Peterson
Peter Boosten wrote: > > Eric Rostetter wrote: >> 1) Yes, it is slow. >> 2) Yes, it wasn't always like this (and hence you could down-grade to an >> older >> version if you needed). >> 3) Newer versions are faster (see below). >> 4) Yes, it still can be used for a mail server (I know, as I'm

Re: [Clamav-users] clamscan extremly slow

2007-06-18 Thread Dennis Peterson
jef moskot wrote: > On Mon, 18 Jun 2007, Dennis Peterson wrote: >> Clamscan is a terrible tool to use in real time with email. > > I would recommend it for low volume servers with cycles to burn, given > that the other option is a daemon that can potentially fail. Neither i

Re: [Clamav-users] clamscan extremly slow

2007-06-18 Thread Dennis Peterson
Eric Rostetter wrote: > Quoting "Christopher X. Candreva" <[EMAIL PROTECTED]>: > >> On Mon, 18 Jun 2007, Eric Rostetter wrote: >> >>> Anyway, my point is, your millage may vary. Don't try to impose your views >>> on everyone else. >> Whoa here. Did you chime and and give a good way to use clamsca

Re: [Clamav-users] clamscan extremly slow

2007-06-18 Thread Dennis Peterson
Chuck Swiger wrote: > On Jun 18, 2007, at 12:19 PM, jef moskot wrote: >> On Mon, 18 Jun 2007, Dennis Peterson wrote: >>> Clamscan is a terrible tool to use in real time with email. >> I would recommend it for low volume servers with cycles to burn, given >> that the

Re: [Clamav-users] clamscan extremly slow

2007-06-18 Thread Dennis Peterson
Eric Rostetter wrote: > Quoting Dennis Peterson <[EMAIL PROTECTED]>: > >>> Not exactly. But I did say that I am using it in production. Now, if it >>> is a good way or not, that is a subjective matter. >> Not exactly - it is measurable. And it is really bad.

Re: [Clamav-users] clamdscan extremely fast

2007-06-26 Thread Dennis Peterson
guenther wrote: > On Sun, 2007-06-24 at 20:56 -0400, Paul Kosinski wrote: >> When I originally started using clamav, clamscan could handle my low >> (SOHO) volume of email quite well, but recently, it started taking >> over 20 secs to scan a short email, > [...] >> So I decided to try clamdscan, ag

Re: [Clamav-users] clamav needs 3 minutes to start

2007-06-27 Thread Dennis Peterson
Schramm e.K. [ Deutschland ] wrote: >> That means 3:13 for 256049 signatures. > > [...] log file > >> That means 0:24 for 130435 signatues. >> ^^ >> >> This is with ClamAV 0.90.3/3541/Wed Jun 27 14:44:24 2007 >> >> Why do you have so much more signatures? >> > > I have no

Re: [Clamav-users] [Fwd: [ClamAV] Clamd High Memory usage]

2007-06-30 Thread Dennis Peterson
[EMAIL PROTECTED] wrote: > > Correction: Clamd is using about 85MB of RAM. One if my installations is using 71MB (Solaris 8, Sparc) and the other is using 48M (Solaris 10, Intel). Both have been running for months. These are pretty normal values. dp ___

Re: [Clamav-users] Everything gets marked as a virus

2007-07-04 Thread Dennis Peterson
David Boltz wrote: > I'm using MailScanner / SpamAssassin / Sendmail /ClamAV .09.3 > > This weekend my MailScanner started acting up. I?ve gone through > everything that I could think of and I ran into a lot of brick walls > along the way. In the end I?ve got the problem narrowed down to > clama

Re: [Clamav-users] CPU & clamscan

2007-07-05 Thread Dennis Peterson
Thomas Spuhler wrote: > On Wednesday 04 July 2007 23:38, Alexandros G. Fragkiadakis wrote: >> use clamdscan instead > > Why continuing with this answer. Clamdscan takes 50% of the time of clamscan > and that still much to slow. > Here's five reasons - there's more: 1. If I could do something

Re: [Clamav-users] CPU & clamscan

2007-07-05 Thread Dennis Peterson
Dennis Peterson wrote: > Thomas Spuhler wrote: >> On Wednesday 04 July 2007 23:38, Alexandros G. Fragkiadakis wrote: > >>> use clamdscan instead >> Why continuing with this answer. Clamdscan takes 50% of the time of clamscan >> and that still much to slow. >

Re: [Clamav-users] need help

2007-07-09 Thread Dennis Peterson
Ralf Hildebrandt wrote: > * Chuck Swiger <[EMAIL PROTECTED]>: >> On Jul 9, 2007, at 12:17 PM, Ralf Hildebrandt wrote: Amavisd-new supports clamdscan just fine. >>> Actually, it uses it's own code, which resembles clamdscan. >> You're right-- perhaps I should have said, "it supports accessing

Re: [Clamav-users] need help

2007-07-10 Thread Dennis Peterson
Ralf Hildebrandt wrote: > * Dennis Peterson <[EMAIL PROTECTED]>: > >>> amd thus it's subject to the same limitations (e.g. amavisd-new must >>> have right to access the clamd socket). This is the numver one problem >>> of the amavisd-new / clamd combo.

Re: [Clamav-users] clam-milter and freshclam headache, help

2007-07-10 Thread Dennis Peterson
Efren Bravo wrote: > Hi, > > A few days ago I've been running Sendmail with clamav 0.88 and since I > change to 0.90.3, I've been fighting with clam-milter and freshclam. > > The freshclam dies when it tries to update the clam database and it isn't > able to reach the servers on the other hand

Re: [Clamav-users] clamd suddenly starts dying

2007-08-02 Thread Dennis Peterson
[EMAIL PROTECTED] wrote: > Hi List, > > Since yesterday afternoon, the clamd daemon on 2 of our 3 mailrelays has > suddenly stopped working. the process just seems to quit, nothing in the > logfiles, I can start it up but after approx. 4 or 5 minutes, the process > quits again. > > This is on

Re: [Clamav-users] New user--can't get signatures

2007-08-06 Thread Dennis Peterson
Rob MacGregor wrote: > On 8/6/07, Richard <[EMAIL PROTECTED]> wrote: >> Shouldn't that be "sudo su -"? ;) > > Hey, at least I typo'd with another vowel :-P > Still too many letters. Try "sudo -s". dp ___ Help us build a comprehensive ClamAV guide: vis

Re: [Clamav-users] clamav cannot update daily.cvd

2007-08-08 Thread Dennis Peterson
David F. Skoll wrote: > doughairfield wrote: > >> I read the bug report. So what does disabling scripted updates actually >> change? > > It means freshclam only tries to download one file (daily.cvd) instead > of lots of small .cdiff files. Because it only makes one download attempt, > it's les

Re: [Clamav-users] clamav cannot update daily.cvd

2007-08-08 Thread Dennis Peterson
David F. Skoll wrote: > Dennis Peterson wrote: > >> Presumably the state of the mirrors is maintained between runs somewhere >> (mirrors.dat). Is it not possible to alter that table with a utility or >> null the table? > > Sure it is; just delete /mirrors.dat. Ho

Re: [Clamav-users] Missed Virus

2007-08-08 Thread Dennis Peterson
Jason Bennett wrote: > Hi everyone, > > We're using ClamAV on our mail gateway which is in front of our exchange > server. It's been running great for a long time and stops thousands of virus > per day for us. Lately however our McAfee which is installed on exchange > itself is picking up thi

Re: [Clamav-users] clamscan crashes server

2007-08-10 Thread Dennis Peterson
Marshall Dudley wrote: > I was running clamscan, and the var partition of the drive filled up. > This partition had 300 Meg free on it, and clamscan created a huge > number of files like mixedtextportion05GJ4k in the > /tmp/clamav-ec6d3e4e4e253eaf directory and filled it up. To make > matters

[Clamav-users] Oddness

2007-08-10 Thread Dennis Peterson
Several times yesterday clamd stopped. My daemon watching script restarted it immediately, but I could not find a reason for the failures. This was happening on multiple servers so was all the more puzzling. Add to that the fact that one other server never had the problem, but it is a fallback

Re: [Clamav-users] Anything major going on with the

2007-08-13 Thread Dennis Peterson
rm *" it reported that the file >> list was too long, so I had to delete them a few at a time. > > On Fri, Aug 10, 2007 at 10:19:27PM -0700, Dennis Peterson said: >> Try: >> rm *[a-m];rm *[n-z];rm *[0-9] > > On Sat, Aug 11, 2007 at 11:09:20AM +0100, G.W. Haywo

Re: [Clamav-users] latest worry-free version on solaris sparc?

2007-08-16 Thread Dennis Peterson
rick pim wrote: > i have one gateway machine running clamav; it's a running solaris > 5.9 on sparc hardware. every couple of years i upgrade it to a > new box (well, since i use cast-off hardware for it, a new old > box, but you know what i mean) with up to date OS, sendmail, etc. > > right now i'

Re: [Clamav-users] Sourcefire acquires ClamAV

2007-08-17 Thread Dennis Peterson
Tomasz Kojm wrote: > Dear ClamAV users, > > On August 17, Sourcefire, the creators of Snort, acquired the ClamAV project. > The full announcement is available here: > > http://www.sourcefire.com/products/clamav/ > > We'd like to thank everyone in the ClamAV community for their dedication to > th

Re: [Clamav-users] Sourcefire acquires ClamAV

2007-08-17 Thread Dennis Peterson
David F. Skoll wrote: > Mike Guiterman wrote: > > [some things] > > Mike, would you care to comment on these remarks from Wayne Jackson, > CEO of Sourcefire? > >After a clean-up of the project's code base, Sourcefire will likely >create a new license for third party providers of the tech

Re: [Clamav-users] Unofficial malware signatures for Clamav

2007-08-18 Thread Dennis Peterson
Arnaud Jacques wrote: > Hello Clamav users, > > With more than 14 official signatures, Clamav's detection rate is > excellent. > However, because of many viruses, trojans, spywares, and other badwares on > the > Wild, SecuriteInfo.com has created its own signatures. > These signatures will

Re: [Clamav-users] clamd PDF Scanning Problem

2007-08-20 Thread Dennis Peterson
Roberto Ullfig wrote: > I had to disable PDF scanning on our servers. We were receiving 9 MB PDF > files and clamd started consuming 100% CPU and not completing the scan. > Anyone else have issues with PDF scanning? > One solution is to avoid scanning files that large. dp _

Re: [Clamav-users] clamav 0.91.2 is out. Don't use it.

2007-08-21 Thread Dennis Peterson
John Rudd wrote: > It has a dangerous (lack of) value for CL_SCAN_STDOPT. You're better > off not upgrading until they fix it. Is this a pet peeve, ravings of crack addled pomeranian, or real problem most of us will experience? Under what conditions would we expect dangerous failures? How will

Re: [Clamav-users] As soon as Sourcefire starts charging for viru... STOP it already

2007-08-29 Thread Dennis Peterson
Tilman Schmidt wrote: > Now that this dead horse has been beaten into pulp and is slowly seeping > into the gravel, can we please, pretty please leave that fruitless > discussion? > > Thank you very much for your understanding. Classic post, Herr Schmidt. Well done - you still have the fire. Suc

Re: [Clamav-users] Sourcefire acquires ClamAV

2007-08-30 Thread Dennis Peterson
Paul Kosinski wrote: > There is another aspect to the acquisition of ClamAV that seems not > to have been discussed. What happens to the people who made monetary > donations to the ClamAV project? (I am not in this group, as I never > quite got around to it.) I'm one of those who donated cash and

Re: [Clamav-users] Automatic reloading of signature files

2007-08-31 Thread Dennis Peterson
Gerard wrote: > On Friday August 31, 2007 at 09:24:03 (AM) Lyle Giese wrote: > > [snip] >> But I also see in /var/log/messages, clamd doing a selfcheck on the >> databases every 30 minutes. > > [snip] > > I have nothing in the message log; however, I don't have clamd > configured to use that log

Re: [Clamav-users] Automatic reloading of signature files

2007-08-31 Thread Dennis Peterson
Gerard wrote: > On Friday August 31, 2007 at 09:24:03 (AM) Lyle Giese wrote: > > [snip] >> But I also see in /var/log/messages, clamd doing a selfcheck on the >> databases every 30 minutes. > > [snip] > > I have nothing in the message log; however, I don't have clamd > configured to use that log

Re: [Clamav-users] Automatic reloading of signature files

2007-08-31 Thread Dennis Peterson
Gerard wrote: > On Friday August 31, 2007 at 12:05:58 (PM) Dennis Peterson wrote: > > [snip] > >> A proper script will send clamd a reload command on completion of >> downloading, testing, and distributing third party files. This can be as >> simple as sending k

Re: [Clamav-users] speeding up clamav

2007-09-09 Thread Dennis Peterson
Rick Cooper wrote: > > > > -Original Message- > > From: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED] On Behalf Of > > Chuck Swiger > > Sent: Sunday, September 09, 2007 10:42 AM > > To: ClamAV users ML > > Subject: Re: [Clamav-users] speeding up clamav > > > > Mohsen Pahlev

Re: [Clamav-users] speeding up clamav

2007-09-09 Thread Dennis Peterson
Res wrote: > On Sun, 9 Sep 2007, Dennis Peterson wrote: > >> F-PROT Antivirus for Solaris Mail Servers >> Number of Users Annual license fee >> 1-10US$ 130 >> 11-24 US$ 250 >> 25-49 US$ 399 >>

Re: [Clamav-users] MBL?

2007-09-11 Thread Dennis Peterson
Noel Jones wrote: > At 12:18 PM 9/11/2007, John Rudd wrote: > >> Did something happen to the MBL signature source? yesterday my >> automated script got all errors for the download content, and today it's >> complaining about it not existing. >> >> Is it as simple as the URL changing? or did it g

Re: [Clamav-users] Handling mail surges

2007-09-12 Thread Dennis Peterson
Paul Griffith wrote: > Greetings, > > Does any one have any suggestions for handling spam surges? We had a spam > mail surge and exim was getting connection timeout errors from the clamd > socket, for spamassassin we can increase the number of child processes to > handle more connections. >

Re: [Clamav-users] signature names

2007-09-12 Thread Dennis Peterson
Karsten Bräckelmann wrote: > On Wed, 2007-09-12 at 07:28 -0700, John Rudd wrote: >> (to the developers, not in answer to Burnie) >> >> See, the current name scheme needs to be fixed. And no one responded at >> all to my proposed scheme from a month or two ago. > > Coincidentally, my very first q

Re: [Clamav-users] signature names

2007-09-12 Thread Dennis Peterson
John Rudd wrote: > Dennis Peterson wrote: >> Karsten Bräckelmann wrote: >>> On Wed, 2007-09-12 at 07:28 -0700, John Rudd wrote: >>>> (to the developers, not in answer to Burnie) >>>> >>>> See, the current name scheme needs to be fixed. And no

[Clamav-users] Unix job in Seattle

2007-09-12 Thread Dennis Peterson
http://tinyurl.com/23stze Email is not a requirement - it's being outsourced. dp ___ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://lurker.clamav.net/list/clamav-users.html

Re: [Clamav-users] Missing Freshclam after upgrade to clamav-0.90.3-1.fc7

2007-09-13 Thread Dennis Peterson
Graeme Nichols wrote: > Hello, > > I upgraded to the above version of clamav (yum update clamav) which went > well and without error and rpm -qi clamav report that it is indeed > installed. > > Problem is that freshclam no longer exists, 'bash: freshclam: command not > found'. A complete filesyst

Re: [Clamav-users] Missing Freshclam after upgrade to clamav-0.90.3-1.fc7

2007-09-14 Thread Dennis Peterson
John Rudd wrote: > Graeme Nichols wrote: > >> Anyone any ideas please? > > Build and install from source? Works every time it's tried as the rpm creators have discovered. dp ___ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net

Re: [Clamav-users] Missing Freshclam after upgrade to clamav-0.90.3-1.fc7

2007-09-15 Thread Dennis Peterson
Graeme Nichols wrote: > Hi Dennis, > > On 15/09/2007, Dennis Peterson <[EMAIL PROTECTED]> wrote: >> John Rudd wrote: >>> Graeme Nichols wrote: >>> >>>> Anyone any ideas please? >>> Build and install from source? >> Works ever

Re: [Clamav-users] Missing Freshclam after upgrade to clamav-0.90.3-1.fc7

2007-09-15 Thread Dennis Peterson
Pavel Urban wrote: > > Seems like Fedora team decided to remove clamav from public > repositories. Dunno why. I'll try to report it as a bug. Freshclam used > to be a part of clamav-update, though. > Maybe they're not happy about the new ownership. dp

Re: [Clamav-users] Missing Freshclam after upgrade to clamav-0.90.3-1.fc7

2007-09-15 Thread Dennis Peterson
Graeme Nichols wrote: > Hello Dennis, > > Thank you. > > On 16/09/2007, Dennis Peterson <[EMAIL PROTECTED]> wrote: >> Graeme Nichols wrote: >>> Hi Dennis, >>> >>> On 15/09/2007, Dennis Peterson <[EMAIL PROTECTED]> wrote: >>>&

Re: [Clamav-users] Missing Freshclam after upgrade to clamav-0.90.3-1.fc7

2007-09-16 Thread Dennis Peterson
Graeme Nichols wrote: > Hello Bill, > > On 17/09/2007, Bill Randle <[EMAIL PROTECTED]> wrote: > >> I'm not sure why they did this, but I guess it helps reduce the number >> of programs required for a minimal install. Still, to update a server >> running clamd, you would need to update clamav, cl

Re: [Clamav-users] clamscan does not terminate on specific HTML file.

2007-09-18 Thread Dennis Peterson
Andrew Watkins wrote: > Thanks for the information, but is there a simple way to configure > clamAV or do I have to edit all the files manually to replace regex.h > and add the libraries as mentioned previously on the list, since I can > find an option like --with-pcre. > > Andrew Build but do

Re: [Clamav-users] performance on solaris

2007-09-19 Thread Dennis Peterson
rick pim wrote: > Trog writes: > > You've taken note of the recent postings on trouble with the standard > > Solaris regex library? And how to switch to using PCRE, which solves the > > problem. > > i have. i got this box mostly finished back in early august and then > took off on holidays befo

Re: [Clamav-users] performance on solaris

2007-09-19 Thread Dennis Peterson
Andrew Watkins wrote: > Rick, > > I guess your best bet is to switch off the PhishingScanURLs, if you > don't like the idea of using new code at this stage. > > I am still testing the PCRE on a test server, and I still have my main > server running a crontab script which kills clamscan every no

Re: [Clamav-users] logrotation not working

2007-09-19 Thread Dennis Peterson
micah wrote: > I have a logrotate.d/clamav-daemon setup to rotate my clamav logs as > shown below: > > Whereas before the logrotation the log contained a lot more clamav > information, including what viruses were caught. > > Is there a better way to rotate the log? > Are you sending clamd a

Re: [Clamav-users] logrotation not working

2007-09-19 Thread Dennis Peterson
micah wrote: > On Wed, 19 Sep 2007 18:37:13 +, micah wrote: > >> The logrotate.d/clamav does this: >> >> 1. Moves clamav.log to clamav.log.1 >> 2. runs: /etc/init.d/clamav-daemon reload-log, which is effectively a >> kill -1 (ie. HUP). >> >> I've got the following associated config lines in cl

Re: [Clamav-users] Reloading config files?

2007-09-20 Thread Dennis Peterson
micah wrote: > > You will note that i've tried -HUP, -USR1 and -USR2. > > I still do appreciate your replies, > micah I got out the source code for a quick read and didn't see anywhere in there where signals would force reloading the config file. Given that it can result in inconsistent resul

Re: [Clamav-users] Reloading config files?

2007-09-20 Thread Dennis Peterson
micah wrote: > On Thu, 20 Sep 2007 12:59:04 -0700, Dennis Peterson wrote: > >> micah wrote: >> >> >>> You will note that i've tried -HUP, -USR1 and -USR2. >>> >>> I still do appreciate your replies, >>> micah >> I got out the

Re: [Clamav-users] Unix job in Seattle

2007-09-20 Thread Dennis Peterson
Dennis Peterson wrote: > http://tinyurl.com/23stze > > Email is not a requirement - it's being outsourced. There's probably going to be another opening posted within days. It's a great location to work in. http://tinyurl.com/29zu3w dp ___

Re: [Clamav-users] Backup clamd server

2007-09-21 Thread Dennis Peterson
Maciej Kedzierski wrote: > Hello, > > How can I set up a backup clamd server that my clamav-milter use this > server when a primary clamd server is died? > Is it possible? It is possible, but since you have an available machine it may be a better idea to simply run both at the same time. In my e

Re: [Clamav-users] Default clamscan tmp dir & custom uid/gid set during configure

2007-09-22 Thread Dennis Peterson
Bill Landry wrote: > Thus my original questions, where is the default temporary director used > by clamscan, and how does one determine what uid/gid clamav was possibly > configured to use after-the-fact? Also, does anyone have any other > suggestions on possible ways to overcome this issue by so

Re: [Clamav-users] Default clamscan tmp dir & custom uid/gid set during configure

2007-09-22 Thread Dennis Peterson
Bill Landry wrote: > > Thoughts anyone...? > > I would also still like to know if there is a way to determine the > uid/gid set during ./configure after clamav has been installed at the > original build directory deleted. > > Thanks, > > Bill Unless you are running clamscan as root the owner

Re: [Clamav-users] Default clamscan tmp dir & custom uid/gid set during configure

2007-09-22 Thread Dennis Peterson
Bill Landry wrote: > Dennis Peterson wrote the following on 9/22/2007 12:40 PM -0800: >> Bill Landry wrote: >> >> >>> Thoughts anyone...? >>> >>> I would also still like to know if there is a way to determine the >>> uid/gid set

Re: [Clamav-users] Default clamscan tmp dir & custom uid/gid set during configure

2007-09-22 Thread Dennis Peterson
Bill Landry wrote: > Tomasz Kojm wrote the following on 9/22/2007 2:29 PM -0800: >> On Sat, 22 Sep 2007 13:31:20 -0700 >> Bill Landry <[EMAIL PROTECTED]> wrote: >> >> >>> And yes, I did try: >>> >>> clamscan --debug --leave-temps -d /var/tmp/rsync/MSRBL-Images.hdb - < >>> /dev/null >>> >>> and s

<    1   2   3   4   5   6   7   8   9   10   >