Re: [clamav-users] ClamAV performance overhead on RHEL & Solaris

2018-03-16 Thread Al Varnell
Our hosts have asked us to be civil and friendly in our discussions here. If you can't uphold such principles, then perhaps you should look elsewhere for answer. As has already been stated, you really haven't given us much to go on. There are lots of configuration options and hardware factors

Re: [clamav-users] ClamAV performance overhead on RHEL & Solaris

2018-03-16 Thread Yuri
Ok, let's start from the beginning. Have you come here with a specific problem that requires a solution or do you just want to talk about it? 17.03.2018 07:21, Yuri пишет: > To make any useful advice, we're have to know something info about: > > - Task you want to solve > > - Your expectations

Re: [clamav-users] ClamAV performance overhead on RHEL & Solaris

2018-03-16 Thread Yuri
To make any useful advice, we're have to know something info about: - Task you want to solve - Your expectations - Your requirements - Your possibilities Without this abstract questions about abstract overhead (and you must understand it as Performance Engeneer you said) from you seems

Re: [clamav-users] ClamAV performance overhead on RHEL & Solaris

2018-03-16 Thread Len Sanschargrin
I'm not sure why you are trying to characterize performance overhead as "issues". Every process running on a server has some resource requirements. I am. Performance engineer and my focus is in getting the most out of every infrastructure server. Hence my question about overhead. In this case

Re: [clamav-users] ClamAV performance overhead on RHEL & Solaris

2018-03-16 Thread Yuri
If I complain about overhead/performance issue, I should: -Specify hardware/infrastructure details -Usage of system (some specific) - Root case (For example "I test 4 Gb-size ISO images and I has CPU overhead") WIthout this it is only blah-blah-blah. For example: In my case, I have 2 socket

Re: [clamav-users] ClamAV performance overhead on RHEL & Solaris

2018-03-16 Thread Yuri
So, what? Real-life experience is useless without full infrastructure/configuration comparison. So, you not focused on real performance issues in this context, just bla-bla-bla. What overhead? On what tasks? On what infrastructure/hardware? What else I miss? 17.03.2018 02:48, Len Sanschargrin

Re: [clamav-users] ClamAV performance overhead on RHEL & Solaris

2018-03-16 Thread SCOTT PACKARD
No numbers. I'm pretty sure Larry's EULA prevents you (and me) from publishing numbers. Regards, Scott > -Original Message- > From: clamav-users [mailto:clamav-users-boun...@lists.clamav.net] On Behalf > Of Len Sanschargrin > Sent: Friday, March 16, 2018 1:35 PM > To: 'ClamAV users

Re: [clamav-users] ClamAV performance overhead on RHEL & Solaris

2018-03-16 Thread Thomas McCourt (tmccourt)
Hello, For what it is worth, the two most used packages for ClamAV per the survey by customers are Ubuntu and Debian. I have had no issue running ClamAV on RHEL or Solaris. I hope that in the near future, the ClamAV team will be able to focus on performance improvements, better monitoring of

Re: [clamav-users] ClamAV performance overhead on RHEL & Solaris

2018-03-16 Thread Len Sanschargrin
The need is not about issues, or comparisons, it's about real-life experiences with the product and the overhead observed. Of course we'll do our own testing but the earlier we know, the better. We also know some features will cost more in terms of overhead than others, so I'm looking for real

Re: [clamav-users] ClamAV performance overhead on RHEL & Solaris

2018-03-16 Thread Yuri
What are you looking for? Performance complains? There is not. https://i.imgur.com/3Likl14.png ClamAV runs on this server and it's ok. Built from sources. 17.03.2018 02:34, Len Sanschargrin пишет: > Any relative numbers you can share? > > Thanks very much, Len Sanschargrin > > > -Original

Re: [clamav-users] ClamAV performance overhead on RHEL & Solaris

2018-03-16 Thread Yuri
Just get GCC 5.5 from https://opencsw.org OpenCSW is free and easy to use on Solaris. 17.03.2018 02:33, Yuri пишет: > Unixpackages is paid service and I don't think it is good. > > On Solaris better to build ClamAV from sources. This is trivial. > > It's works perfectly last four years on my

Re: [clamav-users] ClamAV performance overhead on RHEL & Solaris

2018-03-16 Thread Len Sanschargrin
Any relative numbers you can share? Thanks very much, Len Sanschargrin -Original Message- From: clamav-users [mailto:clamav-users-boun...@lists.clamav.net] On Behalf Of SCOTT PACKARD Sent: Friday, March 16, 2018 3:47 PM To: ClamAV users ML Subject: Re: [clamav-users] ClamAV performance

Re: [clamav-users] ClamAV performance overhead on RHEL & Solaris

2018-03-16 Thread Yuri
Unixpackages is paid service and I don't think it is good. On Solaris better to build ClamAV from sources. This is trivial. It's works perfectly last four years on my Solaris servers. 17.03.2018 01:47, SCOTT PACKARD пишет: > It plays on RHEL and Solaris a lot better than Symantec. > You should

Re: [clamav-users] ClamAV performance overhead on RHEL & Solaris

2018-03-16 Thread SCOTT PACKARD
It plays on RHEL and Solaris a lot better than Symantec. You should get your Solaris builds from www.unixpackages.com. Regards, Scott > -Original Message- > From: clamav-users [mailto:clamav-users-boun...@lists.clamav.net] On Behalf > Of Len Sanschargrin > Sent: Friday, March 16, 2018

[clamav-users] ClamAV performance overhead on RHEL & Solaris

2018-03-16 Thread Len Sanschargrin
Hello, I have customer who is preparing to implement ClamAV on RHEL and Solaris. As the Performance engineer, I'm looking for any testing or stats on potential overhead can be associated with running ClamAV. Even just anecdotal observations can help us to set expectations and of course any

[clamav-users] Anyone uses US-CERT's yara rules?

2018-03-16 Thread Alessandro Vesely
US-CERT alerts often contain a "consolidated rule set for malware associated with" the relevant activity. See e.g.: https://www.us-cert.gov/ncas/alerts/TA18-074A Yara rules are listed, so that they can be copied and pasted into a file to be saved in /var/lib/clamav in order for clamscan to use

Re: [clamav-users] Limitation or bug in ClamAV's processing of Yara rules?

2018-03-16 Thread Kris Deugau
Mark Fortescue wrote: Hi I know nothing about YARA but you could try escaping the hash in case it is being treated as a comment line. e.g  \#a > 1 The comment metasymbol for Yara rules is "//", but I tried this anyway as a long shot: $ clamscan -d foo.yar LibClamAV Error: yyerror():

Re: [clamav-users] Question about the clamdscan

2018-03-16 Thread Al Varnell
I believe the developers are hard at work planning for the future this week, so they can probably can give you better answers than I later on. I suspect some of this may be platform specific, so my answers are based on my macOS experience. clamd scans every file that clamdscan tells it to, so