Login | Register For Free | Help
Search for: (Advanced)

Mailing List Archive: ClamAV: users

freshclam checks database every time

  

 
ClamAV users RSS feed   Index | Next | Previous | View Threaded


andreas.schulze at datev

Apr 10, 2013, 6:05 AM

Post #1 of 11 (365 views)
Permalink
freshclam checks database every time
Hello,

I configured freshclam to not lookup the dns for existance of a new patternversion. Instead freshclam contacts the
clamav-server and fire up HTTP Head queries. That way I could let run freshclam once a minute.
Because I run a clamav-mirror in my local network, that's not a problem.

But I noticed that freshclam needs 3..4 seconds to finish also in the case whare no updates are available.

# echo 'DatabaseMirror clamav.datev.de' > /tmp/freshclam.conf
# (/usr/bin/freshclam --config-file=/tmp/freshclam.conf --verbose --debug --no-dns; echo $?) 2>&1 | tai64n | tai64nlocal
2013-04-10 14:49:25.241597500 Current working dir is /var/lib/clamav
2013-04-10 14:49:25.241655500 Max retries == 3
2013-04-10 14:49:25.241840500 ClamAV update process started at Wed Apr 10 14:49:25 2013
2013-04-10 14:49:25.241841500 Using IPv6 aware code
2013-04-10 14:49:25.241935500 If-Modified-Since: Tue, 11 Oct 2011 14:34:20 GMT
2013-04-10 14:49:25.244810500 Connected to clamav.datev.de (IP: 193.27.49.165).
2013-04-10 14:49:25.244812500 Trying to retrieve CVD header of http://clamav.datev.de/main.cvd
2013-04-10 14:49:25.246660500 OK
2013-04-10 14:49:25.246665500 main.cvd is up to date (version: 54, sigs: 1044387, f-level: 60, builder: sven)
2013-04-10 14:49:25.246758500 If-Modified-Since: Wed, 10 Apr 2013 02:36:19 GMT
2013-04-10 14:49:25.246759500 Reading CVD header (daily.cvd): Connected to clamav.datev.de (IP: 193.27.49.165).
2013-04-10 14:49:25.248873500 Trying to retrieve CVD header of http://clamav.datev.de/daily.cvd
2013-04-10 14:49:25.250376500 OK
2013-04-10 14:49:25.250380500 daily.cvd is up to date (version: 16985, sigs: 1079403, f-level: 63, builder: guitar)
2013-04-10 14:49:25.250449500 If-Modified-Since: Wed, 13 Feb 2013 15:29:15 GMT
2013-04-10 14:49:25.250449500 Reading CVD header (bytecode.cvd): Connected to clamav.datev.de (IP: 193.27.49.165).
2013-04-10 14:49:25.252128500 Trying to retrieve CVD header of http://clamav.datev.de/bytecode.cvd
2013-04-10 14:49:25.253427500 OK
2013-04-10 14:49:25.253432500 bytecode.cvd is up to date (version: 214, sigs: 41, f-level: 63, builder: neo)
2013-04-10 14:49:25.253533500 LibClamAV debug: Initialized 0.97.7 engine
2013-04-10 14:49:25.253533500 LibClamAV debug: in cli_cvdload()
2013-04-10 14:49:25.253744500 LibClamAV debug: MD5(.tar.gz) = ff0c9c4e86dee9e705840537bd13ee71
2013-04-10 14:49:25.254423500 LibClamAV debug: cli_versig: Decoded signature: ff0c9c4e86dee9e705840537bd13ee71
2013-04-10 14:49:25.254424500 LibClamAV debug: cli_versig: Digital signature is correct.
2013-04-10 14:49:25.254435500 LibClamAV debug: in cli_tgzload()
2013-04-10 14:49:25.259901500 LibClamAV debug: bytecode.info loaded
2013-04-10 14:49:25.259913500 LibClamAV debug: in cli_tgzload()
2013-04-10 14:49:25.264665500 LibClamAV debug: Cleaning up phishcheck
2013-04-10 14:49:25.264666500 LibClamAV debug: Phishcheck cleaned up
2013-04-10 14:49:25.264699500 LibClamAV debug: Initialized 0.97.7 engine
2013-04-10 14:49:25.264699500 LibClamAV debug: in cli_cvdload()
2013-04-10 14:49:25.339354500 LibClamAV debug: MD5(.tar.gz) = ef015484e18b983ddf08425e2dad6a3f
2013-04-10 14:49:25.339964500 LibClamAV debug: cli_versig: Decoded signature: ef015484e18b983ddf08425e2dad6a3f
2013-04-10 14:49:25.339964500 LibClamAV debug: cli_versig: Digital signature is correct.
2013-04-10 14:49:25.339975500 LibClamAV debug: in cli_tgzload()
2013-04-10 14:49:25.345214500 LibClamAV debug: main.info loaded
2013-04-10 14:49:25.345219500 LibClamAV debug: in cli_tgzload()
2013-04-10 14:49:26.804849500 LibClamAV debug: Cleaning up phishcheck
2013-04-10 14:49:26.804850500 LibClamAV debug: Phishcheck cleaned up
2013-04-10 14:49:26.804873500 LibClamAV debug: Initialized 0.97.7 engine
2013-04-10 14:49:26.804874500 LibClamAV debug: in cli_cvdload()
2013-04-10 14:49:26.869060500 LibClamAV debug: MD5(.tar.gz) = da5da571c1a0369904550994d15dcc99
2013-04-10 14:49:26.869653500 LibClamAV debug: cli_versig: Decoded signature: da5da571c1a0369904550994d15dcc99
2013-04-10 14:49:26.869654500 LibClamAV debug: cli_versig: Digital signature is correct.
2013-04-10 14:49:26.869658500 LibClamAV debug: in cli_tgzload()
2013-04-10 14:49:26.875003500 LibClamAV debug: daily.info loaded
2013-04-10 14:49:26.875004500 LibClamAV debug: in cli_tgzload()
2013-04-10 14:49:28.147514500 LibClamAV debug: Cleaning up phishcheck
2013-04-10 14:49:28.147515500 LibClamAV debug: Phishcheck cleaned up
2013-04-10 14:49:28.147994500 0

I tried to disable the freshclam-Option "TestDatabases" but that is only relevant if there is really an update available.
And *then* it's OK the check the new database. But why is the database loaded every time freshclam is called ????

I let run "top" while freshclam runs: this is the output:
# top -u clamav -d 1
top - 14:58:01 up 43 days, 6:13, 19 users, load average: 0.00, 0.00, 0.00
Tasks: 283 total, 2 running, 281 sleeping, 0 stopped, 0 zombie
top - 15:00:42 up 43 days, 6:16, 19 users, load average: 0.00, 0.00, 0.00
Tasks: 282 total, 2 running, 280 sleeping, 0 stopped, 0 zombie
Cpu0 : 1.0%us, 2.9%sy, 0.0%ni, 96.1%id, 0.0%wa, 0.0%hi, 0.0%si, 0.0%st
Cpu1 : 0.0%us, 0.0%sy, 0.0%ni,100.0%id, 0.0%wa, 0.0%hi, 0.0%si, 0.0%st
Cpu2 : 0.0%us, 0.0%sy, 0.0%ni,100.0%id, 0.0%wa, 0.0%hi, 0.0%si, 0.0%st
Cpu3 : 0.0%us, 0.0%sy, 0.0%ni, 98.0%id, 2.0%wa, 0.0%hi, 0.0%si, 0.0%st
Cpu4 : 0.9%us, 0.9%sy, 0.0%ni, 98.1%id, 0.0%wa, 0.0%hi, 0.0%si, 0.0%st
Cpu5 :100.0%us, 0.0%sy, 0.0%ni, 0.0%id, 0.0%wa, 0.0%hi, 0.0%si, 0.0%st
Cpu6 : 0.0%us, 0.0%sy, 0.0%ni,100.0%id, 0.0%wa, 0.0%hi, 0.0%si, 0.0%st
Cpu7 : 0.0%us, 0.0%sy, 0.0%ni,100.0%id, 0.0%wa, 0.0%hi, 0.0%si, 0.0%st
Mem: 8242704k total, 3989076k used, 4253628k free, 634104k buffers
Swap: 1951736k total, 0k used, 1951736k free, 2644668k cached

PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
4940 clamav 20 0 13212 3256 2588 R 100 0.0 0:01.35 freshclam
----

As you see freshclam uses 13 MB memory and 100% cpu ...

I looked in the source but did not found a relevant place to disable that behaviour.
A patches or a pointer into the source would be nice :-)

Thanks
Andreas

--
Andreas Schulze
Internetdienste | P252

DATEV eG
90329 Nürnberg | Telefon +49 911 319-0 | Telefax +49 911 319-3196
E-Mail info @datev.de | Internet www.datev.de
Sitz: 90429 Nürnberg, Paumgartnerstr. 6-14 | Registergericht Nürnberg, GenReg Nr.70
Vorstand
Prof. Dieter Kempf (Vorsitzender)
Dipl.-Kfm. Wolfgang Stegmann (stellvertretender Vorsitzender)
Dipl.-Kfm. Michael Leistenschneider
Dipl.-Kfm. Dr. Robert Mayr
Jörg Rabe v. Pappenheim
Dipl.-Vw. Eckhard Schwarzer
Vorsitzender des Aufsichtsrates: Reinhard Verholen
_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://www.clamav.net/support/ml


alvarnell at mac

Apr 10, 2013, 8:39 AM

Post #2 of 11 (346 views)
Permalink
Re: freshclam checks database every time [In reply to]
On 4/10/13 6:05 AM, "Andreas Schulze" wrote:

> I configured freshclam to not lookup the dns for existance of a new
> patternversion. Instead freshclam contacts the
> clamav-server and fire up HTTP Head queries. That way I could let run
> freshclam once a minute.
>
I thought the limit was four times an hour. Is that only for mirror
servers?


-Al-

--
Al Varnell
Mountain View, CA



_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://www.clamav.net/support/ml


andreas.schulze at datev

Apr 11, 2013, 6:20 AM

Post #3 of 11 (348 views)
Permalink
Re: freshclam checks database every time [In reply to]
Am 10.04.2013 17:39, schrieb Al Varnell:
> I thought the limit was four times an hour. Is that only for mirror servers?
cat /etc/cron.d/clamav
* * * * * root freshclam

:-)
_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://www.clamav.net/support/ml


greg at donor

Apr 11, 2013, 6:50 AM

Post #4 of 11 (346 views)
Permalink
Re: freshclam checks database every time [In reply to]
On Thu, 2013-04-11 at 15:20 +0200, Andreas Schulze wrote:
> Am 10.04.2013 17:39, schrieb Al Varnell:
> > I thought the limit was four times an hour. Is that only for mirror servers?
> cat /etc/cron.d/clamav
> * * * * * root freshclam
>
> :-)

Is that checking your *OWN* mirror? If not, you are being throttled.
--
greg folkert - systems administration and support
web: donor.com
email: greg [at] donor
phone: 877-751-3300 x416
direct: 616-328-6449 (direct dial and fax)
"Faith has to do with things that are not seen and hope with things that
are not at hand."
-- Thomas Aquinas

_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://www.clamav.net/support/ml


andreas.schulze at datev

Apr 12, 2013, 10:58 AM

Post #5 of 11 (337 views)
Permalink
Re: freshclam checks database every time [In reply to]
Am 11.04.2013 15:50, schrieb Greg Folkert:
> Is that checking your *OWN* mirror? If not, you are being throttled.
sure, I ask my own server of course.

But back to my main problem. clamscan wastes 3 seconts time loading the
complete engine every time it is called.
Notice the timestamps!

# echo 'DatabaseMirror clamav.datev.de'> /tmp/freshclam.conf
# (/usr/bin/freshclam --config-file=/tmp/freshclam.conf --verbose --debug --no-dns; echo $?) 2>&1 | tai64n | tai64nlocal
2013-04-10 14:49:25.241597500 Current working dir is /var/lib/clamav
2013-04-10 14:49:25.241655500 Max retries == 3
2013-04-10 14:49:25.241840500 ClamAV update process started at Wed Apr 10 14:49:25 2013
2013-04-10 14:49:25.241841500 Using IPv6 aware code
2013-04-10 14:49:25.241935500 If-Modified-Since: Tue, 11 Oct 2011 14:34:20 GMT
2013-04-10 14:49:25.244810500 Connected to clamav.datev.de (IP: 193.27.49.165).
2013-04-10 14:49:25.244812500 Trying to retrieve CVD header ofhttp://clamav.datev.de/main.cvd
2013-04-10 14:49:25.246660500 OK
2013-04-10 14:49:25.246665500 main.cvd is up to date (version: 54, sigs: 1044387, f-level: 60, builder: sven)
2013-04-10 14:49:25.246758500 If-Modified-Since: Wed, 10 Apr 2013 02:36:19 GMT
2013-04-10 14:49:25.246759500 Reading CVD header (daily.cvd): Connected to clamav.datev.de (IP: 193.27.49.165).
2013-04-10 14:49:25.248873500 Trying to retrieve CVD header ofhttp://clamav.datev.de/daily.cvd
2013-04-10 14:49:25.250376500 OK
2013-04-10 14:49:25.250380500 daily.cvd is up to date (version: 16985, sigs: 1079403, f-level: 63, builder: guitar)
2013-04-10 14:49:25.250449500 If-Modified-Since: Wed, 13 Feb 2013 15:29:15 GMT
2013-04-10 14:49:25.250449500 Reading CVD header (bytecode.cvd): Connected to clamav.datev.de (IP: 193.27.49.165).
2013-04-10 14:49:25.252128500 Trying to retrieve CVD header ofhttp://clamav.datev.de/bytecode.cvd
2013-04-10 14:49:25.253427500 OK
2013-04-10 14:49:25.253432500 bytecode.cvd is up to date (version: 214, sigs: 41, f-level: 63, builder: neo)
2013-04-10 14:49:25.253533500 LibClamAV debug: Initialized 0.97.7 engine
2013-04-10 14:49:25.253533500 LibClamAV debug: in cli_cvdload()
2013-04-10 14:49:25.253744500 LibClamAV debug: MD5(.tar.gz) = ff0c9c4e86dee9e705840537bd13ee71
2013-04-10 14:49:25.254423500 LibClamAV debug: cli_versig: Decoded signature: ff0c9c4e86dee9e705840537bd13ee71
2013-04-10 14:49:25.254424500 LibClamAV debug: cli_versig: Digital signature is correct.
2013-04-10 14:49:25.254435500 LibClamAV debug: in cli_tgzload()
2013-04-10 14:49:25.259901500 LibClamAV debug: bytecode.info loaded
2013-04-10 14:49:25.259913500 LibClamAV debug: in cli_tgzload()
2013-04-10 14:49:25.264665500 LibClamAV debug: Cleaning up phishcheck
2013-04-10 14:49:25.264666500 LibClamAV debug: Phishcheck cleaned up
2013-04-10 14:49:25.264699500 LibClamAV debug: Initialized 0.97.7 engine
2013-04-10 14:49:25.264699500 LibClamAV debug: in cli_cvdload()
2013-04-10 14:49:25.339354500 LibClamAV debug: MD5(.tar.gz) = ef015484e18b983ddf08425e2dad6a3f
2013-04-10 14:49:25.339964500 LibClamAV debug: cli_versig: Decoded signature: ef015484e18b983ddf08425e2dad6a3f
2013-04-10 14:49:25.339964500 LibClamAV debug: cli_versig: Digital signature is correct.
2013-04-10 14:49:25.339975500 LibClamAV debug: in cli_tgzload()
2013-04-10 14:49:25.345214500 LibClamAV debug: main.info loaded
2013-04-10 14:49:25.345219500 LibClamAV debug: in cli_tgzload()
2013-04-10 14:49:26.804849500 LibClamAV debug: Cleaning up phishcheck
2013-04-10 14:49:26.804850500 LibClamAV debug: Phishcheck cleaned up
2013-04-10 14:49:26.804873500 LibClamAV debug: Initialized 0.97.7 engine
2013-04-10 14:49:26.804874500 LibClamAV debug: in cli_cvdload()
2013-04-10 14:49:26.869060500 LibClamAV debug: MD5(.tar.gz) = da5da571c1a0369904550994d15dcc99
2013-04-10 14:49:26.869653500 LibClamAV debug: cli_versig: Decoded signature: da5da571c1a0369904550994d15dcc99
2013-04-10 14:49:26.869654500 LibClamAV debug: cli_versig: Digital signature is correct.
2013-04-10 14:49:26.869658500 LibClamAV debug: in cli_tgzload()
2013-04-10 14:49:26.875003500 LibClamAV debug: daily.info loaded
2013-04-10 14:49:26.875004500 LibClamAV debug: in cli_tgzload()
2013-04-10 14:49:28.147514500 LibClamAV debug: Cleaning up phishcheck
2013-04-10 14:49:28.147515500 LibClamAV debug: Phishcheck cleaned up
2013-04-10 14:49:28.147994500 0

Andreas
_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://www.clamav.net/support/ml


cswiger at mac

Apr 12, 2013, 11:19 AM

Post #6 of 11 (336 views)
Permalink
Re: freshclam checks database every time [In reply to]
Hi--

On Apr 12, 2013, at 10:58 AM, Andreas Schulze wrote:
> But back to my main problem. clamscan wastes 3 secon[d]s time loading the complete engine every time it is called.
> Notice the timestamps!

The data available to me suggests that ClamAV has seen ~736 database updates since the beginning of the year, for an average update frequency of ~3.5 hours between updates.

ClamAV update process started at Tue Jan 1 01:07:36 2013
daily.cld updated (version: 16263, sigs: 465170, f-level: 63, builder: neo)
Database updated (1509597 signatures) from db.us.clamav.net (IP: 150.214.142.197)

...vs...

ClamAV update process started at Fri Apr 12 14:11:09 2013
daily.cld updated (version: 16999, sigs: 1092361, f-level: 63, builder: neo)
Database updated (2136789 signatures) from db.us.clamav.net (IP: 69.163.100.14)

Frankly, trying to update more often than once an hour is just a waste of resources.

Regards,
--
-Chuck

_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://www.clamav.net/support/ml


uhlar at fantomas

Apr 12, 2013, 11:27 AM

Post #7 of 11 (341 views)
Permalink
Re: freshclam checks database every time [In reply to]
On 12.04.13 19:58, Andreas Schulze wrote:
>But back to my main problem. clamscan wastes 3 seconts time loading
>the complete engine every time it is called.

loading virus databage to memory and parsing it is really CPU-intensive
process. That's why we recommend running clamd daemon and using clamdscan.

--
Matus UHLAR - fantomas, uhlar [at] fantomas ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
- Holmes, what kind of school did you study to be a detective?
- Elementary, Watson. -- Daffy Duck & Porky Pig
_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://www.clamav.net/support/ml


andreas.schulze at datev

Apr 24, 2013, 1:56 AM

Post #8 of 11 (292 views)
Permalink
Re: freshclam checks database every time [In reply to]
Am 12.04.2013 20:27 schrieb Matus UHLAR - fantomas:
> On 12.04.13 19:58, Andreas Schulze wrote:
> >But back to my main problem. clamscan wastes 3 seconts time
> >loading the complete engine every time it is called.
>
> loading virus databage to memory and parsing it is really CPU-intensive
> process. That's why we recommend running clamd daemon and using clamdscan.

Sorry, my fault: s/clamscan/freshclam/
for clamscan you are right.
But I mean the updater...

--
Andreas Schulze
Internetdienste | P252

DATEV eG
90329 Nürnberg | Telefon +49 911 319-0 | Telefax +49 911 319-3196
E-Mail info @datev.de | Internet www.datev.de
Sitz: 90429 Nürnberg, Paumgartnerstr. 6-14 | Registergericht Nürnberg, GenReg Nr.70
Vorstand
Prof. Dieter Kempf (Vorsitzender)
Dipl.-Kfm. Wolfgang Stegmann (stellvertretender Vorsitzender)
Dipl.-Kfm. Michael Leistenschneider
Dipl.-Kfm. Dr. Robert Mayr
Jörg Rabe v. Pappenheim
Dipl.-Vw. Eckhard Schwarzer
Vorsitzender des Aufsichtsrates: Reinhard Verholen
_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://www.clamav.net/support/ml


andreas.schulze at datev

Apr 24, 2013, 2:03 AM

Post #9 of 11 (291 views)
Permalink
Re: freshclam checks database every time [In reply to]
Am 12.04.2013 11:19 schrieb Chuck Swiger:
> The data available to me suggests that ClamAV has seen ~736 database updates since the beginning of the year, for an average update frequency of ~3.5 hours between updates.
that fine. I could update not once a minute but every three hours.
But in the worst case I use old pattern while new pattern are available since 3 hours.
Thats what I like to avoid. For that reason I update so often.

> Frankly, trying to update more often than once an hour is just a waste of resources.
Do you have better ideas to minimize the time between
- new pattern is available on $my_local_update_mirror
- new pattern is used on $my_local_clamd
??

Thanks
Andreas

--
Andreas Schulze
Internetdienste | P252

DATEV eG
90329 Nürnberg | Telefon +49 911 319-0 | Telefax +49 911 319-3196
E-Mail info @datev.de | Internet www.datev.de
Sitz: 90429 Nürnberg, Paumgartnerstr. 6-14 | Registergericht Nürnberg, GenReg Nr.70
Vorstand
Prof. Dieter Kempf (Vorsitzender)
Dipl.-Kfm. Wolfgang Stegmann (stellvertretender Vorsitzender)
Dipl.-Kfm. Michael Leistenschneider
Dipl.-Kfm. Dr. Robert Mayr
Jörg Rabe v. Pappenheim
Dipl.-Vw. Eckhard Schwarzer
Vorsitzender des Aufsichtsrates: Reinhard Verholen
_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://www.clamav.net/support/ml


andreas.schulze at datev

Jun 21, 2013, 4:28 AM

Post #10 of 11 (165 views)
Permalink
Re: freshclam checks database every time [In reply to]
Am 10.04.2013 15:05 schrieb Andreas Schulze:

> symptom: freshclam needs 3..4 seconds to finish also in the case where *no* updates are available.
No comments on this topic anymore...
Thats worse because freshclam still steal cputime here :-(

To dive into the problem I describe the problem again: keep an eye on the timestamps!

# echo 'DatabaseMirror clamav.datev.de' > /tmp/freshclam.conf
# (/usr/bin/freshclam --config-file=/tmp/freshclam.conf --verbose --debug --no-dns; echo $?) 2>&1 | tai64n | tai64nlocal

2013-04-10 14:49:25.241597500 Current working dir is /var/lib/clamav
-> starting freshclam
...
2013-04-10 14:49:25.253432500 bytecode.cvd is up to date (version: 214, sigs: 41, f-level: 63, builder: neo)
-> after 12ms freshclam detects, that no updates are available

2013-04-10 14:49:25.253533500 LibClamAV debug: Initialized 0.97.7 engine
2013-04-10 14:49:25.253533500 LibClamAV debug: in cli_cvdload()
-> now freshclam load the entire db
...
2013-04-10 14:49:28.147515500 LibClamAV debug: Phishcheck cleaned up
-> and after ~3s freshclam finished

> PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
> 4940 clamav 20 0 13212 3256 2588 R 100 0.0 0:01.35 freshclam
-> 3 seconds of 100% cpu usage for nothing!

I agree if freshclam load a *new* db in case of a *new* pattern version
to verify the data are valid. But if no update was available, thats total unnecessary!

Is there any clamav developer who could point me into the code or explain the logic?

Thanks!
Any feedback is welcome:-)

> I looked in the source but did not found a relevant place to disable that behaviour.
> A patches or a pointer into the source would be nice :-)
Thats still my intention ...

--
Andreas Schulze
Internetdienste | P252

DATEV eG
90329 Nürnberg | Telefon +49 911 319-0 | Telefax +49 911 319-3196
E-Mail info @datev.de | Internet www.datev.de
Sitz: 90429 Nürnberg, Paumgartnerstr. 6-14 | Registergericht Nürnberg, GenReg Nr.70
Vorstand
Prof. Dieter Kempf (Vorsitzender)
Dipl.-Kfm. Wolfgang Stegmann (stellvertretender Vorsitzender)
Dipl.-Kfm. Michael Leistenschneider
Dipl.-Kfm. Dr. Robert Mayr
Jörg Rabe v. Pappenheim
Dipl.-Vw. Eckhard Schwarzer
Vorsitzender des Aufsichtsrates: Reinhard Verholen
_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://www.clamav.net/support/ml


swebb at sourcefire

Jun 21, 2013, 6:13 AM

Post #11 of 11 (164 views)
Permalink
Re: freshclam checks database every time [In reply to]
On Fri, Jun 21, 2013 at 7:28 AM, Andreas Schulze
<andreas.schulze [at] datev>wrote:

> I agree if freshclam load a *new* db in case of a *new* pattern version
> to verify the data are valid. But if no update was available, thats total
> unnecessary!
>
> Is there any clamav developer who could point me into the code or explain
> the logic?


Freshclam tests loading the databases, even if they haven't been updated,
to ensure that they haven't become corrupted (hard disk errors, manual
tampering, etc.). Since Freshclam is the tool that updates the databases,
this is the perfect place to test their integrity. If they fail to load,
Freshclam can download fresh copies.

Thanks,

Shawn
_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://www.clamav.net/support/ml

ClamAV users RSS feed   Index | Next | Previous | View Threaded
 
 


Interested in having your list archived? Contact Gossamer Threads
 
  Web Applications & Managed Hosting Powered by Gossamer Threads Inc.