On Friday 13 April 2007 09:25 am, Dennis Peterson wrote: > Freddie Cash wrote: > > On Thursday 12 April 2007 06:53 pm, Dennis Peterson wrote: > >> And just an fyi, be cautious of the MSRBL-Images file. Rechecking it > >> while I was typing this shows that with it in place it will cause > >> the clamd cpu to rise to 90% and stay there. At 11M it may be too > >> big to be practical. > > > > I think that really depends on your CPU. Running 4 parallel checks > > of the MSRBL-Images.hdb file (9 MB on my system since our provider > > has blocked rsync for the past couple weeks) only drops the CPUs' > > idle % by 15 (85% idle). > > > > Of course, our main mail server is a dual-Opteron @ 2 GHz with 4 GB > > of RAM. YMMV. :) > > I'm running dual proc Sun Sparc systems, and the cpu usage from clamd > appears to be an unhealthy kind of cpu usage. It sits at 95%, and > running truss does not return anything - just an empty screen. I can't > tell what it's doing, but it is definitely using the processors. > Removing the MSRBL-Images file eliminates the problem. So - what is the > cost? I checked the logs and found only 5 files found out of 10,000 > found by SaneSecurity. I think I won't miss the MSRBL contribution.
Let's re-do this using the correct parameters for grep and the right name for the signatures. Heh, lucky you. :) Out of the 4199 messages blocked as "infected" so far this month, 289 of them were marked as MSRBL-Images/* by amavisd-new and clamav. If we took out the MSRBL-Images database, we'd hear about it quite quickly from our users. Between that and the FuzzyOCR plugin for SpamAssassin, we've pretty much eliminated image spam. Looking at March's stats, 1493 out of 10840 "infected" messages were blocked by the MSRBL-Images database. As with much in life, it all depends. :) -- Freddie Cash, LPIC-2 CCNT CCLP Network Support Technician School District 73 (250) 377-HELP [377-4357] [EMAIL PROTECTED] _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://lurker.clamav.net/list/clamav-users.html
