We used to check once every 90 minutes (16 per day). Plus, we run a local proxy/mirror so the updates can be served to other machines on our LAN without extra load on the ClamAV servers.
That was before the new mirroring scheme. Now we're checking several times per hour in the (vain?) hope of getting something. And to make it much worse, many of the cvd downloads are out of sync, and thus useless. P.S. I could probably open a port (of our choosing) in our firewall to receive some kind of notification and have *that* trigger a freshclam run on our internal mirror. But I seriously doubt many users could. On Tue, 3 Jul 2018 16:39:00 +0000 "Joel Esler (jesler)" <jes...@cisco.com> wrote: > > > On Jul 2, 2018, at 1:17 PM, Reindl Harald > <h.rei...@thelounge.net<mailto:h.rei...@thelounge.net>> wrote: > > on a typical setup freshclam is running once or twice *daily* while a > webserver these days can spit out the same small static txt file many > thousands of times per seond with zero load > > That is not the results we are seeing. There are a LARGE amount of > people that check for updates once or twice a day, yes. However, we > have hundreds of thousands of people that check for updates hundreds > of times a day. We haven't started concentrating on these people yet > (our biggest offender is one IP that checks 100,000+ times a day), > but clearly that's excessive. We publish approx 5-6 times a day. > So, let's say you check 50 times a day.... Clearly, that's enough. > > -- > Joel Esler > Sr. Manager > Open Source, Design, Web, and Education > Talos Group > http://www.talosintelligence.com _______________________________________________ clamav-users mailing list clamav-users@lists.clamav.net http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
