On 7 April 2019 17:25:56 Arnaud Jacques <webmas...@securiteinfo.com> wrote:
... and one day I created a *huge* ign2 file and it crashed clamd. Ign2
files may not be appropriate to ignore tons of signatures.
From memory.. daily.info (inside the daily.cvd) contains the database names
included.
If all phishtank sigs were moved into phishtank.ldb etc. and that name was
placed into the daily.info as a separate entry..
Freshclam could exclude that database loading during the loading of
databases.. If it matched an exclude pishtank.ldb command in
freshclam.conf. Or maybe create a dataset.ign3 file which contains
database names not to load at all.
Bigger picture would be move all android sigs into android.ldb etc and you
could exclude those if needed to release memory and resources... All
Windows sigs into a separate dataset etc.
The default would be to load all datasets.. but doing something like this
would give endusers a choice without using ign2 entries for millions of
sigs and without wasting time loading them into memory.
Both would need changes to freshclam and sigs.
Cheers,
Steve
Twitter: @sanesecurity
_______________________________________________
clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users
Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq
http://www.clamav.net/contact.html#ml
