On Mon, 9 Apr 2007 23:02:22 +0300 "Török Edvin" <[EMAIL PROTECTED]> wrote:
> On 4/9/07, Brian Morrison <[EMAIL PROTECTED]> wrote: > > On Thu, 5 Apr 2007 19:56:44 +0100 > > Brian Morrison <[EMAIL PROTECTED]> wrote: > > > > > Since updating to 0.9x I have noticed that from time to time after a > > > cdiff update via freshclam, clamd reports a much smaller value for the > > > number of signatures than freshclam. Some number of updates later > > > the two then match again. > > > > Hmm, no response at all. > > > > Are you sure freshclam and clamd are configured the same database directory? Yes, absolutely certain, you can see the freshclam -> clamd notification message, and the subsequent clamd database reload message, in my original post. As for the .conf files, relevant parts of each are here: [EMAIL PROTECTED] etc]# grep DatabaseDirectory /host/ickx/root/etc/*clam*.conf /host/ickx/root/etc/clamd.conf:DatabaseDirectory /var/lib/clamav /host/ickx/root/etc/freshclam.conf:DatabaseDirectory /var/lib/clamav [EMAIL PROTECTED] etc]# [EMAIL PROTECTED] etc]# grep Notify /host/ickx/root/etc/*clam*.conf /host/ickx/root/etc/freshclam.conf:NotifyClamd /etc/clamd.conf [EMAIL PROTECTED] etc]# > It can happen that certain signatures are ignored on db load, but > 105451 vs 90875 is too big of a difference. I'll agree it is rather excessive. I'm trying to understand what's happening.... > Are you sure you didn't change the configuration of clamd meanwhile? No, the two parts of the freshclam/clamd system and configuration are updated together when I build and install my rpms. I have not touched the configuration files since 0.90.1 was installed when I ensured that all the settings are changed to my liking. FWIW I just noticed that freshclam.conf had a group owner root instead of clamav, I've just changed it but still no change in the messages I see in the syslog output. > > Does this situation occur often? Sometimes several times a day, other days not at all, just depends on the changes in the latest database update(s). -- Brian Morrison bdm at fenrir dot org dot uk "Arguing with an engineer is like wrestling with a pig in the mud; after a while you realize you are muddy and the pig is enjoying it." GnuPG key ID DE32E5C5 - http://wwwkeys.uk.pgp.net/pgpnet/wwwkeys.html _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://lurker.clamav.net/list/clamav-users.html