Re: [sanesecurity] FP feedback from large sites

2011-09-10 Thread Karsten Bräckelmann
On Sat, 2011-09-10 at 15:18 -0500, Dave Funk wrote: > That is exactly what I do. I have two clamav instances using seperate > config files, library directories, listening on different sockets. > The first runs just the official ClamAV supplied sigs, the second all the > various 3rd party sigs (San

Re: [sanesecurity] FP feedback from large sites

2011-09-10 Thread Dave Funk
On Sat, 10 Sep 2011, Steffen Heil (Mailinglisten) wrote: Take INetMsg-SpamDomains-2m.ndb and jurlbla.ndb IF they both contain the same host name... then the INetMsg-SpamDomains-2m.ndb signature name WILL ALWAYS be given out ...because the database is loaded by the clamav engine first.. tha