Mailing List Archive

How to know the configuration
Hi,

Is there a way for clamscan and clamdscan to show the cofiguration they
are using?

I am having a different result if a scan the same file with clamscan and
clamdscan.

The error with clamdscan comes down to Heuristics.Limits.Exceeded FOUND
bit not really saying what size is exceedded nor what size clamscan is
using that is OK.

I want a way to make sure both clamscan and clamdscan are using the same
values.

TIA,

Olivier

--

_______________________________________________

clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml
Re: How to know the configuration [ In reply to ]
Hi there,

On Thu, 8 Oct 2020, Olivier via clamav-users wrote:

> Is there a way for clamscan and clamdscan to show the cofiguration they
> are using?

You haven't said what your system is nor how you installed ClamAV so I
can't tell you what to look for on your own system but there is plenty
of documentation for example at

https://www.clamav.net/documents/configuration

> I am having a different result if a scan the same file with clamscan and
> clamdscan.

That's not unlikely and it isn't a fault. They are different tools.

> The error with clamdscan comes down to Heuristics.Limits.Exceeded FOUND
> bit not really saying what size is exceedded nor what size clamscan is
> using that is OK.

It's explained in the documentation. You'll need to set aside some time
to spend with it because there's quite a lot of it. It's also worth your
while to look through the archives of this mailing list. For example you
could click on a few links at

https://marc.info/?l=clamav-users&r=1&w=2

then browse the subject lines to see what looks interesting.

> I want a way to make sure both clamscan and clamdscan are using the same
> values.

No, you want to understand what you're doing. The tools are different.
They are configured, and they do things, in very different ways. The
common, er, thread is that in the end they both use the same signature
database, but clamscan is a stand-alone tool which does everything on
its own, and clamdscan hands the bulk of the work to a daemon called
clamd. There is another tool called clamav-milter which does that too.

--

73,
Ged.

_______________________________________________

clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml
Re: How to know the configuration [ In reply to ]
Hi,

thanks for your quick answer.

Obtained running:

> clamscan -r ~/.cache --detect-pua=yes -o

Attached required report.

Thanks a lot.

M.


On 08/10/20 10:07, G.W. Haywood via clamav-users wrote:
> Hi there,
>
> On Thu, 8 Oct 2020, Olivier via clamav-users wrote:
>
>> Is there a way for clamscan and clamdscan to show the cofiguration they
>> are using?
>
> You haven't said what your system is nor how you installed ClamAV so I
> can't tell you what to look for on your own system but there is plenty
> of documentation for example at
>
> https://www.clamav.net/documents/configuration
>
>> I am having a different result if a scan the same file with clamscan and
>> clamdscan.
>
> That's not unlikely and it isn't a fault.  They are different tools.
>
>> The error with clamdscan comes down to Heuristics.Limits.Exceeded FOUND
>> bit not really saying what size is exceedded nor what size clamscan is
>> using that is OK.
>
> It's explained in the documentation.  You'll need to set aside some time
> to spend with it because there's quite a lot of it.  It's also worth your
> while to look through the archives of this mailing list.  For example you
> could click on a few links at
>
> https://marc.info/?l=clamav-users&r=1&w=2
>
> then browse the subject lines to see what looks interesting.
>
>> I want a way to make sure both clamscan and clamdscan are using the same
>> values.
>
> No, you want to understand what you're doing.  The tools are different.
> They are configured, and they do things, in very different ways. The
> common, er, thread is that in the end they both use the same signature
> database, but clamscan is a stand-alone tool which does everything on
> its own, and clamdscan hands the bulk of the work to a daemon called
> clamd.  There is another tool called clamav-milter which does that too.
>