[sanesecurity] Re: clamd stability & fetch-sanesecurity-sigs

  • From: Ryan Moore <ryan.moore@xxxxxxxxxxx>
  • To: sanesecurity@xxxxxxxxxxxxx
  • Date: Mon, 26 Jan 2009 18:40:06 -0500

-------- Original Message  --------
Subject: [sanesecurity] Re: clamd stability & fetch-sanesecurity-sigs
From: Steve Basford <steveb_clamav@xxxxxxxxxxxxxxxx>
To: sanesecurity@xxxxxxxxxxxxx
Date: Mon 26 Jan 2009 05:50:36 PM EST


Interesting...

Ok, seeing as you can reproduce... could you try this test.

remove all the sanesecurity signatures...just to rule them out....

create a test database called testsig.ndb and paste in this (watch the line wrap):

Sanesecurity-Eicar-Test-Signature:0:0:58354f2150254041505b345c505a58353428505e2937434329377d2445494341522d5354414e444152442d414e544956495255532d544553542d46494c452124482b482a

keep repeating the above paste... does clamd crash?

The above signature is copied directly from official main.ndb file...

Cheers,

Steve
Sanesecurity


It figures I can't reproduce it now, however we're seeing about half the mail load as when I was tinkering with it earlier, so I'm guessing that has an affect on the situation. I'll give it a go tomorrow during mid-day when our mail load is higher to see if I can get it to crash. I'm guessing it isn't kosher to have clamd scan a big mail directory and issue a few db reloads in the middle of the scan.

Ryan Moore
----------
Perigee.net Corporation
704-849-8355 (sales)
704-849-8017 (tech)
www.perigee.net






Other related posts: