"Ah, so when you have things like the 14/15 minute delay, the delay may not be that long?"
Yes, sampling every 15 minutes *could* mean that a nominal 15 min delay is in fact only a fraction of a second, but assuming that delays are uniformly distributed, the mean and median would be 7.5 minutes. And of course there have been lots of delays over 15 minutes nominal. Notes: 1. We only sample every 15 minutes since we didn't want to risk being banned for excessive HTTP traffic -- long delays would result in lots of (short) curls. 2. Freshclam et al run on our gateway machine, which is NTP stratum 2, so the reported delays are not due to local clock errors. 3. Other machines on our LAN get updates from the gateway machine, using strictly local curls without even using DNS TXT. (External bandwidth is not needed.) 4. The most recent delay reports are rather worse than previous ones: 2018-09-07 14:33:01 01:29:59 delay 2018-09-07 21:48:01 00:45:00 delay 2018-09-08 05:48:02 00:44:59 delay 2018-09-08 13:18:01 00:15:00 delay 2018-09-08 21:48:02 00:30:00 delay 2018-09-09 05:03:02 No delay 2018-09-09 13:18:01 00:14:59 delay 2018-09-09 21:48:01 00:45:00 delay 2018-09-10 05:03:02 No delay 2018-09-10 14:18:01 00:59:59 delay 2018-09-10 21:33:02 00:30:00 delay 2018-09-11 05:48:01 00:44:59 delay 2018-09-11 14:03:01 00:59:59 delay 2018-09-11 21:18:01 00:15:00 delay 2018-09-12 05:33:02 00:15:00 delay 2018-09-12 13:48:02 00:45:01 delay 2018-09-12 22:18:02 No delay 2018-09-13 06:03:02 01:00:00 delay ------------------- On Thu, 13 Sep 2018 14:00:36 +0000 "Joel Esler (jesler)" <[email protected]> wrote: > Ah, so when you have things like the 14/15 minute delay, the delay > may not be that long? > > > On Sep 13, 2018, at 2:16 AM, Paul Kosinski <[email protected]> > > wrote: > > > > "What is the interval that you run this?" > > > > Every 15 minutes by cron, specifically: > > > > OCBG='/opt/clamav/bin/getfreshclam' > > > > 3 * * * * root test -x $OCBG && /usr/bin/sudo -u clamav > > $OCBG && /usr/bin/killall -HUP havp80c && /usr/bin/killall -HUP > > havp80d 18 * * * * root test -x $OCBG && /usr/bin/sudo -u > > clamav $OCBG && /usr/bin/killall -HUP havp80c > > && /usr/bin/killall -HUP havp80d 33 * * * * root test -x > > $OCBG && /usr/bin/sudo -u clamav $OCBG && /usr/bin/killall -HUP > > havp80c && /usr/bin/killall -HUP havp80d 48 * * * * root > > test -x $OCBG && /usr/bin/sudo -u clamav $OCBG > > && /usr/bin/killall -HUP havp80c && /usr/bin/killall -HUP havp80d > > > > > > (Original post mentioned the interval in passing in the text.) > > > >>> Attached is the code we use to update ClamAV: 'getfreshclam' is > >>> run by cron under userid clamav (same as clamd) every so often > >>> (currently every 15 mins) to determine if there are any relevant > > > > ---------- > > > > On Wed, 12 Sep 2018 20:59:45 +0000 > > "Joel Esler (jesler)" <[email protected]> wrote: > > > >> What is the interval that you run this? > >> > >>> On Sep 12, 2018, at 4:53 PM, Paul Kosinski > >>> <[email protected]> wrote: > >>> > >>> Joel (and any other interested parties), > >>> > >>> Attached is the code we use to update ClamAV: 'getfreshclam' is > >>> run by cron under userid clamav (same as clamd) every so often > >>> (currently every 15 mins) to determine if there are any relevant > >>> cvd files to update (currently daily.cvd, bytecode.cvd and > >>> main.cvd). > >>> > >>> Only if something is *really* there -- as determined by *both* the > >>> DNS TXT record and quick 'curl' of the head of the cvd file -- is > >>> 'freshclam' invoked to do the actual work. This ensures that > >>> running the test pretty often doesn't put a big load on the > >>> servers. > >>> > >>> Notes to help understanding the code: > >>> > >>> 'testclam-external' does the DNS TXT and curl test. > >>> > >>> 'report-delays' logs the delays (or non- delays) found. > >>> > >>> We keep various recent versions of ClamAV in /opt/clamav.d, both > >>> for testing, and in case we have to backtrack. Thus, /opt/clamav > >>> is a symlink to the current version, as in: > >>> > >>> /opt/clamav -> /opt/clamav.d/clamav.0.100.1 > >>> > >>> > >>> Enjoy! > >>> Paul Kosinski _______________________________________________ clamav-users mailing list [email protected] http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
