Hello All,
I want to write a script/program which checks for clam virus updates
every 10 minutes and updates the respective files. Can anybody provide
me some information on sites that host clam av definitions and also
tell me which is the most efficient and reliable site Thanks in
advance.
Rega
Rajanikanth P wanted us to know:
>I want to write a script/program which checks for clam virus updates
man freshclam
--
Regards... Todd
We should not be building surveillance technology into standards.
Law enforcement was not supposed to be easy. Where it is easy,
it's call
On Fri, 20 Aug 2004 02:15:51 +0530, Rajanikanth P <[EMAIL PROTECTED]>
wrote:
>Hello All,
>
>I want to write a script/program which checks for clam virus updates
>every 10 minutes and updates the respective files. Can anybody provide
>me some information on sites that host clam av definitions and a
Every 10 minutes is much to often. There was a thread about this issue
just a while ago. The consensus was 1 to 4 hours and not exactly on the
hour. If everybody ran freshclam every 10 minutes, the server would
croak.
Phil
On Aug 19, 2004, at 5:21 PM, Steven Stern wrote:
On Fri, 20 Aug 2004 02:
Steven Stern wanted us to know:
>sudo crontab -e
>add at the end
>*/10 * * * * /path/to/freshclam --quiet
NO! Once an hour is reasonable, but not 6 times an hour!
--
Regards... Todd
We should not be building surveillance technology into standards.
Law enforcement was not suppos
On Thu, 19 Aug 2004 16:41:04 -0700, Todd Lyons <[EMAIL PROTECTED]> wrote:
>Steven Stern wanted us to know:
>
>NO! Once an hour is reasonable, but not 6 times an hour!
I was showing the OP how, not condoning his schedule.
I run freshclam on th 17th minute every 4 hours.
--
Steve
-
Phil Ershler wrote:
Every 10 minutes is much to often. There was a thread about this issue
just a while ago. The consensus was 1 to 4 hours and not exactly on
the hour. If everybody ran freshclam every 10 minutes, the server
would croak.
Phil
For the shake of reducing the 'unprotection window',
Julio Canto wrote:
Phil Ershler wrote:
Every 10 minutes is much to often. There was a thread about this
issue just a while ago. The consensus was 1 to 4 hours and not
exactly on the hour. If everybody ran freshclam every 10 minutes, the
server would croak.
Phil
For the shake of reducing the 'u
Fajar A. Nugraha wrote:
Yes. There's nothing that prevent you running freshclam (or whatever
your updater will be) every minute or so.
However, with the default check time of one hour (default for RPM
packages, that is), mirrors already
uses lots of bandwitdh (over 100 GB a month each), so please
Is it possible to use HEAD to reduce load?
-Nigel
--
Nigel Horne. Arranger, Composer, Typesetter.
NJH Music, Barnsley, UK. ICQ#20252325
[EMAIL PROTECTED] http://www.bandsman.co.uk
---
SF.Net email is sponsored by Shop4tech.com-Lowest price o
Nigel Horne wrote:
Is it possible to use HEAD to reduce load?
I believe it already uses RANGE, so traffic wise the load is greatly
reduced.
However, if every user decides to set checks every minutes the
bottleneck will be in
maximum connection. This will not happen if version checks is done vi
Julio Canto wrote:
Fajar A. Nugraha wrote:
Yes. There's nothing that prevent you running freshclam (or whatever
your updater will be) every minute or so.
However, with the default check time of one hour (default for RPM
packages, that is), mirrors already
uses lots of bandwitdh (over 100 GB a mon
At 02:13 AM 8/20/2004, Fajar A. Nugraha wrote:
Nigel Horne wrote:
Is it possible to use HEAD to reduce load?
I believe it already uses RANGE, so traffic wise the load is greatly reduced.
Wouldn't it be more efficient to use Etags and/or If-Modified-Since and let
the server issue a "304 Not Modifie
sudo crontab -e
add at the end
*/10 * * * * /path/to/freshclam --quiet
NO! Once an hour is reasonable, but not 6 times an hour!
I agree, I think a better way is to add a file to the /etc/cron.d
directory with the contents of the file:
# m h dom mon dow user command
11 */2 * * * clamav /path/to/fr
Hello D.J. Fan,
But i have a problem here. Assume that clam updates are published at
6:10 Pm. I check for new updates at 6:05 so the next time i gonna
check is at 7:05 it just means that after 55 mins i got the updates.
And within this 55 minutes thousands and thousands of say ..a worm
which is in
But i have a problem here. Assume that clam updates are published at
6:10 Pm. I check for new updates at 6:05 so the next time i gonna
check is at 7:05 it just means that after 55 mins i got the updates.
And within this 55 minutes thousands and thousands of say ..a worm
which is in wild arrives to
Rajanikanth P wrote the following on 08/21/2004 12:31 AM :
Hello D.J. Fan,
But i have a problem here. Assume that clam updates are published at
6:10 Pm. I check for new updates at 6:05 so the next time i gonna
check is at 7:05 it just means that after 55 mins i got the updates.
And within this 55 m
> Do you realize that no antivirus can provide a signature until :
> - someone has witnessed an infection (or infection attempt),
> - reported it to the virus db maintainers,
> - the signature has been engineered
> - tested (no obvious false positives),
> - then finally publicly released ?
>
> No m
Rajanikanth P wrote:
> Hello D.J. Fan,
>
> But i have a problem here. Assume that clam updates are published at
> 6:10 Pm. I check for new updates at 6:05 so the next time i gonna
> check is at 7:05 it just means that after 55 mins i got the updates.
> And within this 55 minutes thousands and thou
Matthew van Eerde wrote:
> Rajanikanth P wrote:
> > Hello D.J. Fan,
> >
> > But i have a problem here. Assume that clam updates are published at
> > 6:10 Pm. I check for new updates at 6:05 so the next time i gonna
> > check is at 7:05 it just means that after 55 mins i got the updates.
> > And wi
At 03:31 PM 8/20/2004, Rajanikanth P wrote:
But i have a problem here. Assume that clam updates are published at
6:10 Pm. I check for new updates at 6:05 so the next time i gonna
check is at 7:05 it just means that after 55 mins i got the updates.
And within this 55 minutes thousands and thousands
Rajanikanth P wanted us to know:
>Hello D.J. Fan,
>
>But i have a problem here. Assume that clam updates are published at
>6:10 Pm. I check for new updates at 6:05 so the next time i gonna
>check is at 7:05 it just means that after 55 mins i got the updates.
>And within this 55 minutes thousands a
[EMAIL PROTECTED] wanted us to know:
>What about companies that are purporting and actually selling appliances
>or applications that claim to stop viruses as they break out based on
>heauristics and/or pattern matching? Are they just blowing smoke?
No, they're just looking for deltas in establish
No matter how often you check for new sigs, you'll always have at least
several hours between a new worm hits the Net and a signature comes to your
local antivirus installation.
IMHO to the question : "What do I do ?" the most logical answer is :
"explain to your users what a new virus is and h
On Aug 20, 2004, at 7:21 PM, <[EMAIL PROTECTED]> wrote:
Rajanikanth P wrote:
Hello D.J. Fan,
But i have a problem here. Assume that clam updates are published at
6:10 Pm. I check for new updates at 6:05 so the next time i gonna
check is at 7:05 it just means that after 55 mins i got the updates.
An
Thanks Julio Canto. Thats what i have to do.
Hello D J Fan
I know that it takes 4 - 5 hrs for an AV company to get the sample
analyse it and create a signature for it then alert all its
subscribers...and then publish the updates..I know this..but what i
was trying to tell this group was atleast
Rajanikanth P wrote:
> Thanks Julio Canto. Thats what i have to do.
>
> Hello D J Fan
>
> I know that it takes 4 - 5 hrs for an AV company to get the sample
> analyse it and create a signature for it then alert all its
> subscribers...and then publish the updates..I know this..but what i
> was
On Mon, 23 Aug 2004 at 18:26:47 +0530, Rajanikanth P wrote:
>
> I know that it takes 4 - 5 hrs for an AV company to get the sample
> analyse it and create a signature for it then alert all its
> subscribers...and then publish the updates..I know this..but what i
> was trying to tell this group was
Rajanikanth P said:
> Thanks Julio Canto. Thats what i have to do.
>
> Hello D J Fan
>
> I know that it takes 4 - 5 hrs for an AV company to get the sample
> analyse it and create a signature for it then alert all its
> subscribers...and then publish the updates..I know this..but what i
> was tryin
seems to work fine for us
tony
- Original Message -
From: "Dennis Peterson" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Monday, August 23, 2004 4:35 PM
Subject: Re: [Clamav-users] Downloading clam virus definition files
automatically
> Rajanikanth P sai
Quoting Dennis Peterson <[EMAIL PROTECTED]>:
Rajanikanth P said:
Thanks Julio Canto. Thats what i have to do.
Hello D J Fan
I know that it takes 4 - 5 hrs for an AV company to get the sample
analyse it and create a signature for it then alert all its
subscribers...and then publish the updates..I kn
> Imagine how quickly we could destroy this fine free service if we
> all did what you suggest. It sounds to me like you want more than
> you are paying for.
> dp
Are you still sugesting that one HTTP Get request every 10 minutes would
crash all the signature mirrors of Clam all over the world? Ex
On Monday 23 August 2004 11:14 am, ahellary wrote:
> seems to work fine for us
I really hope the mirrors take note of your ip and just block people like
you..
It shows great ignorance when you really think this is how you need to run
your servers, or home computer..
Jeff
--
=
On Monday 23 August 2004 12:21 pm, Julio Canto wrote:
> Are you still sugesting that one HTTP Get request every 10 minutes would
> crash all the signature mirrors of Clam all over the world? Excuse me if
> you don't mean that, English is not my native tongue.
Obviously looking at the big picture
Julio Canto wanted us to know:
>> Imagine how quickly we could destroy this fine free service if we
>> all did what you suggest. It sounds to me like you want more than
>> you are paying for.
>Are you still sugesting that one HTTP Get request every 10 minutes would
>crash all the signature mirror
On Mon, 23 Aug 2004, Julio Canto wrote:
> > Imagine how quickly we could destroy this fine free service if we
> > all did what you suggest. It sounds to me like you want more than
> > you are paying for.
> > dp
>
> Are you still sugesting that one HTTP Get request every 10 minutes would
> cras
> If you really want updates instantly, there *is* a solution. Volunteer
> to run a mirror. All mirrors are given updates within 2 minutes.
>
> Damian Menscher
Joining this thread a little late - sorry...
Then we get back to the level of committment required to do that... With
things as they ar
Julio Canto said:
> > Imagine how quickly we could destroy this fine free service if we
> > all did what you suggest. It sounds to me like you want more than
> > you are paying for.
> > dp
>
> Are you still sugesting that one HTTP Get request every 10 minutes would
> crash all the signature mir
Dennis Peterson wrote:
I think if every user were to poll every mirror every 10 minutes as
suggested, they would all discover an update at about the same time and
all would then begin the download process. Everyone, everywhere, and
within minutes of each other. If, in addition, every user were to d
Julio Canto wrote:
Dennis Peterson wrote:
It would quickly stop being the quickest responding server as
you can well imagine, and the owner just may decide to withdraw it as a
mirror.
Yes, I got it now... I didn't really thought the Clam park of users
were so big.
Well, yeah :)
Thank you for th
Thank you for the explanation (looks like sometines it is difficult
to find a normal one without being called stupid or something).
Don't let this get you down though.
Granted, too frequent checks could give mirrors problems.
However, technically there is nothing that prevents you from writing
Julio Canto wrote:
(www.virustotal.com), and to keep av signatures fully updated is one
of the most important things to keep in mind. This is mostly because
we pretend to offer the 'best' of that engines, and because from time
to time we publish information of when was detected new viruses so
p
Julio Canto said:
>
> Well, the reason why I have that cheking rate is because I've ClamAV
> integrated in a multi-engine antivirus service called VirusTotal
> (www.virustotal.com), and to keep av signatures fully updated is one of
> the most important things to keep in mind. This is mostly because
Dennis Peterson wrote:
The ClamAV
vendor can offer a push of the AV patterns to paying customers with
special needs. That way you will receive the updates as quickly as do the
mirrors and the vendor recovers some of the cost of maintaining ClamAV.
Eh? Really? This is something new :)
Fajar A. Nugraha wrote:
Dennis Peterson wrote:
The ClamAV
vendor can offer a push of the AV patterns to paying customers with
special needs. That way you will receive the updates as quickly as do the
mirrors and the vendor recovers some of the cost of maintaining ClamAV.
Eh? Really? This is somethi
On Tue, 24 Aug 2004, Dennis Peterson wrote:
; Fajar A. Nugraha wrote:
; > Dennis Peterson wrote:
; >
; > > The ClamAV
; > > vendor can offer a push of the AV patterns to paying customers with
; > > special needs. That way you will receive the updates as quickly as do the
; > > mirrors and the ven
Andy Fiddaman wrote:
On Tue, 24 Aug 2004, Dennis Peterson wrote:
; > > The ClamAV
; > > vendor can offer a push of the AV patterns to paying customers with
; > > special needs. That way you will receive the updates as quickly as do the
; > > mirrors and the vendor recovers some of the cost of maint
Or, how about a subscription only (i.e. pay for) mirror which people can
query every five minutes if they like ?
This has the advantage that users who require this don't have to do anything
special (like set up an rsync server), just change the mirror they use and
the interval that freshclam runs.
On Wednesday 25 Aug 2004 12:09, Andy Fiddaman wrote:
> I'd be interested in running one of these if the database team would be
> willing to push updates out to a private mirror. (A percentage of the
> revenue generated would then be fed back into the ClamAV project!)
Any reason why that percenta
> Any reason why that percentage should be less than 100?
>
Cost of bandwidth, cost of equipment, and cost of administrating the
purchase/access system?
---
SF.Net email is sponsored by Shop4tech.com-Lowest price on Blank Media
100pk Sonic DVD
On Wed, 25 Aug 2004, Shayne Lebrun wrote:
; > Any reason why that percentage should be less than 100?
; >
; Cost of bandwidth, cost of equipment, and cost of administrating the
; purchase/access system?
That about covers it. To be worth anything, the mirror farm would have to
be able to support
Julio Canto wrote:
Or, how about a subscription only (i.e. pay for) mirror which people can
query every five minutes if they like ?
This has the advantage that users who require this don't have to do
anything
special (like set up an rsync server), just change the mirror they use
and
the interval
Or, how about a subscription only (i.e. pay for) mirror which people can
query every five minutes if they like ?
Note that although you shouldn't, you CAN query any official mirror every
minute if you want :)
No mirror that I know of is able to prevent that. Yet.
iptables/netfilter :-)
So I would
> > Any reason why that percentage should be less than 100?
> >
> Cost of bandwidth, cost of equipment, and cost of administrating the
> purchase/access system?
Welcome to the area of open source...
---
SF.Net email is sponsored by Shop4tech.c
Shayne Lebrun wrote:
Any reason why that percentage should be less than 100?
Cost of bandwidth, cost of equipment, and cost of administrating the
purchase/access system?
And liability insurance.
dp
---
SF.Net email is sponsored by Shop4tech.com-Lo
Nigel Horne wrote:
On Wednesday 25 Aug 2004 12:09, Andy Fiddaman wrote:
I'd be interested in running one of these if the database team would be
willing to push updates out to a private mirror. (A percentage of the
revenue generated would then be fed back into the ClamAV project!)
Any reason why
Dennis Peterson wrote:
Shayne Lebrun wrote:
Any reason why that percentage should be less than 100?
Cost of bandwidth, cost of equipment, and cost of administrating the
purchase/access system?
And liability insurance.
Hmm ...
which makes me wonder.
Say ...
1) I host an official public mirror, which
> > > Any reason why that percentage should be less than 100?
> > >
> > Cost of bandwidth, cost of equipment, and cost of administrating the
> > purchase/access system?
>
> Welcome to the area of open source...
>
Open source is all well and good, but bandwidth still costs.
-
> > Cost of bandwidth, cost of equipment, and cost of administrating the
> > purchase/access system?
> >
>
> And liability insurance.
>
Aye, good point. Especially if you're going to be hoping to sell to
corporate clients.
---
SF.Net email is
On Thu, 26 Aug 2004, Fajar A. Nugraha wrote:
> 4) I setup atomated firewall system which automagically blocks
> non-paying users which connects to my server too often (perhaps in less
> 30 minutes interval).
>
> (4) might be a problem, since it might violate some requirements of
> becoming a publi
Fajar A. Nugraha wrote:
Dennis Peterson wrote:
Shayne Lebrun wrote:
Any reason why that percentage should be less than 100?
Cost of bandwidth, cost of equipment, and cost of administrating the
purchase/access system?
And liability insurance.
Hmm ...
which makes me wonder.
Say ...
1) I host an offic
All parties are willing and agreeable, and the vendor stands to make some
money. I can't imagine that would be a bad thing. I wouldn't underestimate
the importance of liability, tho.
Uhhh... but then what do you think someone providing such service would be
liable for then? Unable to download
B. van Ouwerkerk said:
>
>>
>>All parties are willing and agreeable, and the vendor stands to make some
>>money. I can't imagine that would be a bad thing. I wouldn't
>> underestimate
>>the importance of liability, tho.
>
> Uhhh... but then what do you think someone providing such service would be
> If you want to be able to sue someone then why don't you use a product
> like
> Symantec Corporate edition, or from any other large vendor?
I don't want to sue someone - I just like being protected against those
who do, and there are a lot of them out there.
That's why you pay so much for insura
> Uhhh... but then what do you think someone providing such service
> would be
> liable for then? Unable to download an update? Or not being
> updated as soon
> as an update arrives?
> Pretty hard one because you connection might be temporarily down, a
> temporarily routing problem might exist some
> I think such a provider would be liable for very little - but it is very
> expensive to establish that in court. Law suits are trivial to initiate
> and we are in a very litigous society. If you have 10,000 customers you
> can bet at least one of them will levy a suit against you for some
> perce
66 matches
Mail list logo
