Menu
▾
▴
RE: [Assp-user] Do you want a tuned AV database? (was AV scanning causes 100% CPU)
|
From: Sullivan, G. <GSullivan@DavidClark.com> - 2004-06-30 17:49:42
|
Agreed... Glenn Sullivan, MCSE+I MCDBA David Clark Company Inc.=20 -----Original Message----- From: ass...@li... [mailto:ass...@li...] On Behalf Of Steve B Sent: Wednesday, June 30, 2004 1:38 PM To: ass...@li... Subject: Re: [Assp-user] Do you want a tuned AV database? (was AV scanning causes 100% CPU) I would rather have the whole lot just in case. In any event my linux box has seen no noticeable increase with scanning on. At 17:59 30/06/2004, you wrote: >I expect a higher cpu load with virus scanning enabled. Virus scanning=20 >is non-trivial. :-) This would be particularly true if you have a large >message load and / or not an exceptionally fast cpu / sufficient memory. > >One of the confining factors is that the ClamAV database contains=20 >signatures for every virus known -- the vast majority of which aren't=20 >found in the wild in email. I've wondered about maintaining a subset of >the ClamAV database which only contains the newest signatures and those >which have been found in the wild. I expect this would be a much=20 >smaller file and would provide much better performance with no=20 >practical loss of detection. (The only exception is when a virus which=20 >hasn't been seen in the wild for some time re-appears >en-mass.) The main disadvantage is that I have to work out the=20 >server-side code to maintain this collection, and it will certainly be=20 >less reliable than ClamAV's distribution system. (Note how Sourceforge=20 >outages cause problems with the greylist from time to time.) > >So the big question is this: > >If I made a email-tuned ClamAV distribution available how many people=20 >would download that instead of ClamAV's full database if it made your=20 >ASSP go faster and with less ram (but not faster or less ram than with=20 >AV disabled?) > >John > >----- Original Message ----- >From: "Theo Aukerman" <tau...@lo...> >To: <ass...@li...> >Sent: Wednesday, June 30, 2004 9:42 AM >Subject: RE: [Assp-user] AV scanning causes 100% CPU > > >I saw this behavior as well, and disabled virus scanning for about a=20 >week. > >Then I realized that the server running ASSP had antivirus software on=20 >it that would scan files as they were created, and quarantine the files. > >After disabling the filesystem protection for the ASSP folder, I=20 >re-activated the virus scanning, and have had no problems since. > >BTW: I also downloaded the virus scan databases. I don't know which=20 >action solved the problem, but I'm happy now. > >Theo > >-----Original Message----- >From: ass...@li... >[mailto:ass...@li...] On Behalf Of Ty=20 >Christensen >Sent: Tuesday, June 29, 2004 10:27 AM >To: ass...@li... >Subject: [Assp-user] AV scanning causes 100% CPU > >I installed ASSP .12 on a Win2k server in front of Exchange 2000. It's >running fine, with the exception of the AV scanning. If scanning is=20 >enabled, the perl process that's running ASSP goes to 100% CPU and=20 >stays there infinitely. If scanning is disabled, CPU usage returns to=20 >what I normally see for ASSP. > >Any ideas as to why that happens? > >Ty Christensen >MCP, MCSP, MCSB >Master Mind Productions >www.mastermindpro.com <http://www.mastermindpro.com/> >(425) 378-7724 > > >------------------------------------------------------- >This SF.Net email sponsored by Black Hat Briefings & Training. >Attend Black Hat Briefings & Training, Las Vegas July 24-29 - digital=20 >self defense, top technical experts, no vendor pitches, unmatched=20 >networking opportunities. Visit www.blackhat.com=20 >_______________________________________________ >Assp-user mailing list >Ass...@li... >https://lists.sourceforge.net/lists/listinfo/assp-user > > > > >------------------------------------------------------- >This SF.Net email sponsored by Black Hat Briefings & Training. >Attend Black Hat Briefings & Training, Las Vegas July 24-29 - digital=20 >self defense, top technical experts, no vendor pitches, unmatched=20 >networking opportunities. Visit www.blackhat.com=20 >_______________________________________________ >Assp-user mailing list >Ass...@li... >https://lists.sourceforge.net/lists/listinfo/assp-user > > > >------------------------------------------------------- >This SF.Net email sponsored by Black Hat Briefings & Training. >Attend Black Hat Briefings & Training, Las Vegas July 24-29 - digital=20 >self defense, top technical experts, no vendor pitches, unmatched=20 >networking opportunities. Visit www.blackhat.com=20 >_______________________________________________ >Assp-user mailing list >Ass...@li... >https://lists.sourceforge.net/lists/listinfo/assp-user Steve. http://www.bov.nu - Homepages. http://www.pokwe.org.uk - Support site for parents of children with epilepsy. ------------------------------------------------------- This SF.Net email sponsored by Black Hat Briefings & Training. Attend Black Hat Briefings & Training, Las Vegas July 24-29 - digital self defense, top technical experts, no vendor pitches, unmatched networking opportunities. Visit www.blackhat.com _______________________________________________ Assp-user mailing list Ass...@li... https://lists.sourceforge.net/lists/listinfo/assp-user |