ClamAV Tips for Advanced Users Only

Discussions relating to ClamXav

Moderator: Mark

ClamAV Tips for Advanced Users Only

Postby alvarnell » Thu 06 Sep 2018 1:19 am

Little, if any of this applies to current ClamXAV users, but if you have taken measures to use the ClamAV scan engine and it's definitions directly, this information may apply. Note that ClamXAV 2.9+ no longer uses the ClamAV mirror network and ClamXAV 3 doesn't use freshclam to update definitions.:

Want to improve your ClamAV experience? Here are some common mistakes we see with FreshClam

Posted: 05 Sep 2018 11:49 AM PDT
At Cisco Talos, we regularly get questions on how to get the most out of ClamAV. Therefore, we wanted to point out some common mistakes that users make in hopes that we can make using ClamAV easier, and more effective, for everyone.

Downloading the signatures

We want to emphasize the importance of using FreshClam to download the signatures instead of Wget, Python, or similar scripting libraries. A lot of folks from the community are attempting to download the daily, bytecode, and the main CVDs using scripting tools. While we understand the desire to do so, FreshClam has been engineered to take advantage of the fact that our publishing system provides "diff" files, or only what has changed since the last update.

This provides faster updates to the world, reduces our overhead on the server side, and lowers our overall bandwidth. This problem was not made apparent until we consolidated the mirror infrastructure to our CDN (Cloudflare). We are now able to observe download problems across our infrastructure.

For example, we have roughly 20 individual IPs that are attempting to download the whole main.cvd, daily.cvd, and bytecode.cvd files roughly, eight times a minute. Imagine what would happen if we were able to get users to stop doing that and use FreshClam. We are currently pushing about 54TB a day in updates to our users — you have to wonder how much that would drop if everyone was using FreshClam.

ClamAV supported versions

We took a look at the top 10 "User-Agents" that are downloading updates.
Code: Select all
ClamAV/0.100.1 (OS: linux-gnu, ARCH: x86_64, CPU: x86_64)
ClamAV/0.99.4 (OS: linux-gnu, ARCH: x86_64, CPU: x86_64)
ClamAV/0.99.2 (OS: linux-gnu, ARCH: x86_64, CPU: x86_64)
ClamAV/0.98.7 (OS: linux-gnu, ARCH: x86_64, CPU: x86_64)
ClamAV/0.100.0 (OS: linux-gnu, ARCH: x86_64, CPU: x86_64)
ClamWin/0.99.1 (OS: win32, ARCH: i386, CPU: i386)
ClamWin/0.99.4 (OS: win32, ARCH: i386, CPU: i386)
ClamAV/0.99.3 (OS: linux-gnu, ARCH: x86_64, CPU: x86_64)
Wget/1.12 (linux-gnu)
ClamAV/0.96-exp (OS: linux-gnu, ARCH: i386, CPU: i686)

Since we already covered Wget and tools like that, let's move on to older versions of ClamAV.

As you can see, the top two versions are the most recent versions and essentially, the last major version back. These are Ubuntu/Debian users. We work very closely with the package maintainer for those distributions, and we can see the shift in versions when they update.

Let's shift our focus to No. 10 in the list above. ClamAV/0.96-exp, an experimental version of ClamAV back in the 0.96 days, before CVD diff'ing was released. Obviously, this is an errant cronjob (someone attempting to run FreshClam once a minute). Again, we are asking users to please update to a new version of ClamAV, which will, in turn, update your version of FreshClam (to support diff'ing).

We took the logs, removed Wget, curl and other scripting tools, only focusing on actual FreshClam installations, only focusing on versions of ClamAV. Basically, asking our logs, "How many different versions of ClamAV are there out there?"

297

After ClamAV is installed, then what? How do I update the database?

You will want to edit freshclam.conf.example by commenting out the "example" text with a pound symbol (#).

Once that is done, run a 'freshclam' via command line and the database should update.

We also want to remind people that we do monitor IRC, so if you need help — give us a shout.

Community members and staff idle the channel and try to help to the best of our abilities.

IRC information

Service: irc.freenode.net
Channel: #clamav

How do you submit bugs to ClamAV?

Please visit https://bugzilla.clamav.net/.

If you are having Mirror issues

If you are running into an issue when using FreshClam to download the signatures, it could be the mirror.dat file. Try deleting this file, and then running FreshClam again.

In the "configure" file of FreshClam, you can set your mirror as 'database.clamav.net' instead of using a country code (db.xy.clamav.net). In a future version of ClamAV, we will improve/remove the mentions of country based mirrors. Use database.clamav.net as the central point for your downloads.

If you want to contribute to documentation

Our documentation is also open-source. Feel free to edit it as need be, and submit the changes to our Git repository.
-Al-
--
iMac(21.5-inch, Mid 2011) 2.8GHz Intel Core i7/OS X 10.10.5, 10.11.6, 10.12.6 & 10.13.6/ClamXAV v3.0.9 (7713)/0.100.2_01
iMac(Retina 5K, 27-inch, 2017) 4.2GHz Intel Core i7/macOS 10.12.6, 10.13.6 & 10.14.3/ClamXAV v3.0.9 (7713)/0.100.2_01
alvarnell
Site Admin
 
Posts: 5507
Joined: Thu 04 Sep 2008 1:18 am
Location: Mountain View, CA, USA

Return to ClamXav

Who is online

Users browsing this forum: No registered users

cron