Tomasz Kojm wrote: > > Freshclam also submits information about detections with 3rd party signatures. >
We only have one host in our environment that does freshclam (or any of the other virus signature update mechanisms). It verifies the validity of the data (makes sure nothing will die as a result, etc.), and then pushes the new data out into a shared data space for the other hosts to pick up. This is done both for our own internal safety/sanity check AND to ensure all of our production hosts get the same data at the same time. It also means that no matter how many production hosts we have, we only impact each signature site with one database refresh per update cycle. The host in question doesn't get much (if any) traffic, except when we're running tests. So, even then, it only gets synthetic traffic, not real traffic. Meanwhile, the hosts that get real traffic don't run freshclam at all. Nor do we want those hosts to ever run freshclam (at least, we don't want them to ever run freshclam for the purpose of receiving new virus signatures). Do you have any thoughts about how we can get the stats to you, so that you can use them, without bypassing our mechanism for ensuring consistent and safe updating of our virus signatures? _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://www.clamav.net/support/ml
