I was wanting to implement AV scanning with clamd. Having seen a perl script to do this. I figured a solution using lua would provide better performance, and shouldn’t be too hard to write. Some googling revealed Josh Zlatin had already done this J

http://www.purehacking.com/blogs/josh-zlatin/virus-detection-in-modsecurity

 

I had to make a small tweak to the script, as I couldn’t get the rex pcre library installed on my rhel servers (replaced rex.match with string.find), tested it and sat back feeling happy until I noticed CRS comes with a C program: runAV-clamd, doing essentially the same thing.

 

Now I’m wondering which would provide the best performance (lua or C), and if there are any other considerations. Any advice would be much appreciated.

 

Thanks,

Paul