At Cisco Talos, we regularly get questions on how to get the most out of ClamAV. Therefore, we wanted to point out some common mistakes that users make in hopes that we can make using ClamAV easier, and more effective, for everyone.
This provides faster updates to the world, reduces our overhead on the server side, and lowers our overall bandwidth. This problem was not made apparent until we consolidated the mirror infrastructure to our CDN (Cloudflare). We are now able to observe download problems across our infrastructure.
For example, we have roughly 20 individual IPs that are attempting to download the whole main.cvd, daily.cvd, and bytecode.cvd files roughly, eight times a minute. Imagine what would happen if we were able to get users to stop doing that and use FreshClam. We are currently pushing about 54TB a day in updates to our users — you have to wonder how much that would drop if everyone was using FreshClam.
As you can see, the top two versions are the most recent versions and essentially, the last major version back. These are Ubuntu/Debian users. We work very closely with the package maintainer for those distributions, and we can see the shift in versions when they update.
Let's shift our focus to No. 10 in the list above. ClamAV/0.96-exp, an experimental version of ClamAV back in the 0.96 days, before CVD diff'ing was released. Obviously, this is an errant cronjob (someone attempting to run FreshClam once a minute). Again, we are asking users to please update to a new version of ClamAV, which will, in turn, update your version of FreshClam (to support diff'ing).
We took the logs, removed Wget, curl and other scripting tools, only focusing on actual FreshClam installations, only focusing on versions of ClamAV. Basically, asking our logs, "How many different versions of ClamAV are there out there?"
Once that is done, run a 'freshclam' via command line and the database should update.
We also want to remind people that we do monitor IRC, so if you need help — give us a shout.
Community members and staff idle the channel and try to help to the best of our abilities.
Channel: #clamav
In the "configure" file of FreshClam, you can set your mirror as 'database.clamav.net' instead of using a country code (db.xy.clamav.net). In a future version of ClamAV, we will improve/remove the mentions of country based mirrors. Use database.clamav.net as the central point for your downloads.
Downloading the signatures
We want to emphasize the importance of using FreshClam to download the signatures instead of Wget, Python, or similar scripting libraries. A lot of folks from the community are attempting to download the daily, bytecode, and the main CVDs using scripting tools. While we understand the desire to do so, FreshClam has been engineered to take advantage of the fact that our publishing system provides "diff" files, or only what has changed since the last update.This provides faster updates to the world, reduces our overhead on the server side, and lowers our overall bandwidth. This problem was not made apparent until we consolidated the mirror infrastructure to our CDN (Cloudflare). We are now able to observe download problems across our infrastructure.
For example, we have roughly 20 individual IPs that are attempting to download the whole main.cvd, daily.cvd, and bytecode.cvd files roughly, eight times a minute. Imagine what would happen if we were able to get users to stop doing that and use FreshClam. We are currently pushing about 54TB a day in updates to our users — you have to wonder how much that would drop if everyone was using FreshClam.
ClamAV supported versions
We took a look at the top 10 "User-Agents" that are downloading updates.Since we already covered Wget and tools like that, let's move on to older versions of ClamAV.ClamAV/0.100.1 (OS: linux-gnu, ARCH: x86_64, CPU: x86_64)ClamAV/0.99.4 (OS: linux-gnu, ARCH: x86_64, CPU: x86_64)ClamAV/0.99.2 (OS: linux-gnu, ARCH: x86_64, CPU: x86_64)ClamAV/0.98.7 (OS: linux-gnu, ARCH: x86_64, CPU: x86_64)ClamAV/0.100.0 (OS: linux-gnu, ARCH: x86_64, CPU: x86_64)ClamWin/0.99.1 (OS: win32, ARCH: i386, CPU: i386)ClamWin/0.99.4 (OS: win32, ARCH: i386, CPU: i386)ClamAV/0.99.3 (OS: linux-gnu, ARCH: x86_64, CPU: x86_64)Wget/1.12 (linux-gnu)ClamAV/0.96-exp (OS: linux-gnu, ARCH: i386, CPU: i686)
As you can see, the top two versions are the most recent versions and essentially, the last major version back. These are Ubuntu/Debian users. We work very closely with the package maintainer for those distributions, and we can see the shift in versions when they update.
Let's shift our focus to No. 10 in the list above. ClamAV/0.96-exp, an experimental version of ClamAV back in the 0.96 days, before CVD diff'ing was released. Obviously, this is an errant cronjob (someone attempting to run FreshClam once a minute). Again, we are asking users to please update to a new version of ClamAV, which will, in turn, update your version of FreshClam (to support diff'ing).
We took the logs, removed Wget, curl and other scripting tools, only focusing on actual FreshClam installations, only focusing on versions of ClamAV. Basically, asking our logs, "How many different versions of ClamAV are there out there?"
297
After ClamAV is installed, then what? How do I update the database?
You will want to edit freshclam.conf.example by commenting out the "example" text with a pound symbol (#).Once that is done, run a 'freshclam' via command line and the database should update.
We also want to remind people that we do monitor IRC, so if you need help — give us a shout.
Community members and staff idle the channel and try to help to the best of our abilities.
IRC information
Service: irc.freenode.netChannel: #clamav
How do you submit bugs to ClamAV?
Please visit https://bugzilla.clamav.net/.If you are having Mirror issues
If you are running into an issue when using FreshClam to download the signatures, it could be the mirror.dat file. Try deleting this file, and then running FreshClam again.In the "configure" file of FreshClam, you can set your mirror as 'database.clamav.net' instead of using a country code (db.xy.clamav.net). In a future version of ClamAV, we will improve/remove the mentions of country based mirrors. Use database.clamav.net as the central point for your downloads.
