On Mon, Jul 09, 2012 at 11:29:08AM -0400, Bowie Bailey wrote: > On 7/9/2012 5:42 AM, Benny Pedersen wrote: > > Den 2012-07-09 08:06, Henrik K skrev: > > > >> I just ditch main.cld which seems pointless, I think it saved > >> something like > >> 40-50MB. If there are actually ever any new "viruses", daily.cld > >> should > >> catch them. With this and most 3rd party sigs, clamd is only 80MB > >> RSS. > > so you think that virus that are very old are moved from main into > > daily if seen daily ? > > > > if thats the case i can save some mem aswell :=) > > > > freshclam will just try to keep atleast main and daily :( > > I'm not sure this is safe. The viruses in main.cld may be older than > the ones in daily.cld, but that doesn't mean they aren't still out > there. In answer to your question, I would very much doubt that virus > definitions are every moved from main back to daily. Since you are > expected to have the main.cld database, which already contains the > definition, it would be a waste of bandwidth to force everyone to > download it again in daily.cld. > > You should ask on the ClamAV list for a definitive answer.
It's been months since last main generation. 30750647 Mar 23 13:15 main.cvd Since I couldn't care less about any "viruses" which are pretty much non-existent today, I have no problem of doing this. I mainly use ClamAV for all the 3rd party sigs. MTA rules and SpamAssassin catches anything resembling a virus here anyway, but keeping daily sigs is fine as backup. And yes you need a custom download directory for freshclam to keep all the sigs and move daily.cld manually to the "real" directory.
