Mailing List Archive

smaller db ?
Hello,

I notice that clamav DB size is growing really fast, there is 500K records
more than in last november,
I guess it's good point for the security level of clamav.

I'm personnaly using clamav on small memory devices, more records means
more RAM and it becomes
complicated to use clamav on such devices. I know that lot of people
consider that memory is cheap today
but for embedded devices it's not the case !

Do you plan to provide a shorter DB ? Maybe a reduced DB with viruses
into-the-wild (wildlist.org) should be a good option.

By the way, the daily.cvd (800K entries) size is closed to the main.cvd
(1000K entries), do you plan to generate a new main.cvd ?

Best Regards
Dour
_______________________________________________
http://lurker.clamav.net/list/clamav-devel.html
Please submit your patches to our Bugzilla: http://bugs.clamav.net
Re: smaller db ? [ In reply to ]
I have similar problems too. When I started to use clamav, it was enough to
rlimit (resource limit) memory for process running libclamav to 200 MB,
now 700 MB is not enough and I need to set it to 1 GB, which looks to be
very large.

Can merging daily to main lower memory usage?

SAL

On Mon, Feb 25, 2013 at 03:50:50PM +0100, Dour Fest wrote:
> Hello,
>
> I notice that clamav DB size is growing really fast, there is 500K records
> more than in last november,
> I guess it's good point for the security level of clamav.
>
> I'm personnaly using clamav on small memory devices, more records means
> more RAM and it becomes
> complicated to use clamav on such devices. I know that lot of people
> consider that memory is cheap today
> but for embedded devices it's not the case !
>
> Do you plan to provide a shorter DB ? Maybe a reduced DB with viruses
> into-the-wild (wildlist.org) should be a good option.
>
> By the way, the daily.cvd (800K entries) size is closed to the main.cvd
> (1000K entries), do you plan to generate a new main.cvd ?
>
> Best Regards
> Dour
> _______________________________________________
> http://lurker.clamav.net/list/clamav-devel.html
> Please submit your patches to our Bugzilla: http://bugs.clamav.net
_______________________________________________
http://lurker.clamav.net/list/clamav-devel.html
Please submit your patches to our Bugzilla: http://bugs.clamav.net
Re: smaller db ? [ In reply to ]
We're looking at memory consumption as part of our development work post
0.98 release. We'll look into your other suggestions, but there are not
currently projects on the table to minimize the db size.

For main.cvd, we're looking at when the right time is for merging daily.cvd
into main. This merge will not impact memory utilization.

Matt


On Mon, Feb 25, 2013 at 10:23 AM, Ján ONDREJ (SAL) <ondrejj@salstar.sk>wrote:

> I have similar problems too. When I started to use clamav, it was enough to
> rlimit (resource limit) memory for process running libclamav to 200 MB,
> now 700 MB is not enough and I need to set it to 1 GB, which looks to be
> very large.
>
> Can merging daily to main lower memory usage?
>
> SAL
>
> On Mon, Feb 25, 2013 at 03:50:50PM +0100, Dour Fest wrote:
> > Hello,
> >
> > I notice that clamav DB size is growing really fast, there is 500K
> records
> > more than in last november,
> > I guess it's good point for the security level of clamav.
> >
> > I'm personnaly using clamav on small memory devices, more records means
> > more RAM and it becomes
> > complicated to use clamav on such devices. I know that lot of people
> > consider that memory is cheap today
> > but for embedded devices it's not the case !
> >
> > Do you plan to provide a shorter DB ? Maybe a reduced DB with viruses
> > into-the-wild (wildlist.org) should be a good option.
> >
> > By the way, the daily.cvd (800K entries) size is closed to the main.cvd
> > (1000K entries), do you plan to generate a new main.cvd ?
> >
> > Best Regards
> > Dour
> > _______________________________________________
> > http://lurker.clamav.net/list/clamav-devel.html
> > Please submit your patches to our Bugzilla: http://bugs.clamav.net
> _______________________________________________
> http://lurker.clamav.net/list/clamav-devel.html
> Please submit your patches to our Bugzilla: http://bugs.clamav.net
>
_______________________________________________
http://lurker.clamav.net/list/clamav-devel.html
Please submit your patches to our Bugzilla: http://bugs.clamav.net
Re: smaller db ? [ In reply to ]
May be it will be good to split main.cvd into multiple databases and add
ability to exclude some databases from configuration and/or command line
options.

SAL

On Mon, Feb 25, 2013 at 10:56:53AM -0500, Matt Olney wrote:
> We're looking at memory consumption as part of our development work post
> 0.98 release. We'll look into your other suggestions, but there are not
> currently projects on the table to minimize the db size.
>
> For main.cvd, we're looking at when the right time is for merging daily.cvd
> into main. This merge will not impact memory utilization.
>
> Matt
>
>
> On Mon, Feb 25, 2013 at 10:23 AM, Ján ONDREJ (SAL) <ondrejj@salstar.sk>wrote:
>
> > I have similar problems too. When I started to use clamav, it was enough to
> > rlimit (resource limit) memory for process running libclamav to 200 MB,
> > now 700 MB is not enough and I need to set it to 1 GB, which looks to be
> > very large.
> >
> > Can merging daily to main lower memory usage?
> >
> > SAL
> >
> > On Mon, Feb 25, 2013 at 03:50:50PM +0100, Dour Fest wrote:
> > > Hello,
> > >
> > > I notice that clamav DB size is growing really fast, there is 500K
> > records
> > > more than in last november,
> > > I guess it's good point for the security level of clamav.
> > >
> > > I'm personnaly using clamav on small memory devices, more records means
> > > more RAM and it becomes
> > > complicated to use clamav on such devices. I know that lot of people
> > > consider that memory is cheap today
> > > but for embedded devices it's not the case !
> > >
> > > Do you plan to provide a shorter DB ? Maybe a reduced DB with viruses
> > > into-the-wild (wildlist.org) should be a good option.
> > >
> > > By the way, the daily.cvd (800K entries) size is closed to the main.cvd
> > > (1000K entries), do you plan to generate a new main.cvd ?
> > >
> > > Best Regards
> > > Dour
> > > _______________________________________________
> > > http://lurker.clamav.net/list/clamav-devel.html
> > > Please submit your patches to our Bugzilla: http://bugs.clamav.net
> > _______________________________________________
> > http://lurker.clamav.net/list/clamav-devel.html
> > Please submit your patches to our Bugzilla: http://bugs.clamav.net
> >
> _______________________________________________
> http://lurker.clamav.net/list/clamav-devel.html
> Please submit your patches to our Bugzilla: http://bugs.clamav.net
_______________________________________________
http://lurker.clamav.net/list/clamav-devel.html
Please submit your patches to our Bugzilla: http://bugs.clamav.net
Re: smaller db ? [ In reply to ]
It's hard to split main.cvd and find relevants signatures but we are lucky
clamav team is great and can already identify active malwares :
http://www.clamav.net/lang/en/download/cvd/malware-stats/

It's a good news that means clamav team can provide us a new cvd with
signatures against active malwares :o)

I have a dream last night, clamav was running easily on a Raspberry Pi A
... ;o)


2013/2/25 Ján ONDREJ (SAL) <ondrejj@salstar.sk>

> May be it will be good to split main.cvd into multiple databases and add
> ability to exclude some databases from configuration and/or command line
> options.
>
> SAL
>
> On Mon, Feb 25, 2013 at 10:56:53AM -0500, Matt Olney wrote:
> > We're looking at memory consumption as part of our development work post
> > 0.98 release. We'll look into your other suggestions, but there are not
> > currently projects on the table to minimize the db size.
> >
> > For main.cvd, we're looking at when the right time is for merging
> daily.cvd
> > into main. This merge will not impact memory utilization.
> >
> > Matt
> >
> >
> > On Mon, Feb 25, 2013 at 10:23 AM, Ján ONDREJ (SAL) <ondrejj@salstar.sk
> >wrote:
> >
> > > I have similar problems too. When I started to use clamav, it was
> enough to
> > > rlimit (resource limit) memory for process running libclamav to 200 MB,
> > > now 700 MB is not enough and I need to set it to 1 GB, which looks to
> be
> > > very large.
> > >
> > > Can merging daily to main lower memory usage?
> > >
> > > SAL
> > >
> > > On Mon, Feb 25, 2013 at 03:50:50PM +0100, Dour Fest wrote:
> > > > Hello,
> > > >
> > > > I notice that clamav DB size is growing really fast, there is 500K
> > > records
> > > > more than in last november,
> > > > I guess it's good point for the security level of clamav.
> > > >
> > > > I'm personnaly using clamav on small memory devices, more records
> means
> > > > more RAM and it becomes
> > > > complicated to use clamav on such devices. I know that lot of people
> > > > consider that memory is cheap today
> > > > but for embedded devices it's not the case !
> > > >
> > > > Do you plan to provide a shorter DB ? Maybe a reduced DB with viruses
> > > > into-the-wild (wildlist.org) should be a good option.
> > > >
> > > > By the way, the daily.cvd (800K entries) size is closed to the
> main.cvd
> > > > (1000K entries), do you plan to generate a new main.cvd ?
> > > >
> > > > Best Regards
> > > > Dour
> > > > _______________________________________________
> > > > http://lurker.clamav.net/list/clamav-devel.html
> > > > Please submit your patches to our Bugzilla: http://bugs.clamav.net
> > > _______________________________________________
> > > http://lurker.clamav.net/list/clamav-devel.html
> > > Please submit your patches to our Bugzilla: http://bugs.clamav.net
> > >
> > _______________________________________________
> > http://lurker.clamav.net/list/clamav-devel.html
> > Please submit your patches to our Bugzilla: http://bugs.clamav.net
> _______________________________________________
> http://lurker.clamav.net/list/clamav-devel.html
> Please submit your patches to our Bugzilla: http://bugs.clamav.net
>
_______________________________________________
http://lurker.clamav.net/list/clamav-devel.html
Please submit your patches to our Bugzilla: http://bugs.clamav.net
Re: smaller db ? [ In reply to ]
In embedded application, is the hard constraint efficiently addressable
writeable memory space, or simply available random accessable memory?
I am having a little trouble envisioning a fileserver design that would run
well on an embedded system that couldn't comfortably support extra memory
for sigs, wouldn't the code to implement a robust filesystem plus the
buffering needed for cache dominate?

I haven't set up ClamAV in a while.

Can't seem to quickly find signature database format from my phone. Does
the format not include category classification, like snort's? For some
security policies, I could easily see a subset of the database sufficing,
especially if you could occasionally check from a bigger system.
_______________________________________________
http://lurker.clamav.net/list/clamav-devel.html
Please submit your patches to our Bugzilla: http://bugs.clamav.net