Mailing List Archive: How often can I run cvdupdate?

How often can I run cvdupdate?

May 25, 2022, 7:36 AM

Post #1 of 3 (322 views)

We're starting to run clamav on more local hosts and were starting to
see rate limiting messages. So I've setup a local private mirror with
cvdupdate in each of our offices. However now I'm starting to see
warnings like:

Received signal: wake up
ClamAV update process started at Wed May 25 07:26:29 2022
daily database available for update (local version: 26551, remote
version: 26552)
WARNING: downloadFile: file not found: https://MIRROR/daily-26552.cdiff
WARNING: downloadPatch: Can't download daily-26552.cdiff from
https://MIRROR/daily-26552.cdiff
WARNING: downloadFile: file not found: https://MIRROR/daily-26552.cdiff
WARNING: downloadPatch: Can't download daily-26552.cdiff from
https://MIRROR/daily-26552.cdiff
WARNING: downloadFile: file not found: https://MIRROR/daily-26552.cdiff
WARNING: downloadPatch: Can't download daily-26552.cdiff from
https://MIRROR/daily-26552.cdiff
The database server doesn't have the latest patch for the daily database
(version 26552). The server will likely have updated if you check again
in a few hours.
main.cvd database is up-to-date (version: 62, sigs: 6647427, f-level:
90, builder: sigmgr)
bytecode.cvd database is up-to-date (version: 333, sigs: 92, f-level:
63, builder: awillia2)

which then get reported by logwatch.

The mirror updated a bit later:

2022-05-25 08:15:21 AM - INFO: Downloaded daily-26552.cdiff
2022-05-25 08:16:22 AM - INFO: Downloaded daily.cvd. Version: 26552

I'm running cvdupdate at the recommended 4 hour interval. Can I run it
more often? Although I suppose there always may be an interval between
when a client might see the new version and the mirror downloads it, so
I may just have to exclude these types of warnings from logwatch.

--
Orion Poplawski
he/him/his - surely the least important thing about me
IT Systems Manager 720-772-5637
NWRA, Boulder/CoRA Office FAX: 303-415-9702
3380 Mitchell Lane orion@nwra.com
Boulder, CO 80301 https://www.nwra.com/

Re: How often can I run cvdupdate? [ In reply to ]

clamav-users at lists

May 25, 2022, 9:13 AM

Post #2 of 3 (322 views)

Permalink

Hi there,

On Wed, 25 May 2022, Orion Poplawski via clamav-users wrote:

> We're starting to run clamav on more local hosts and were starting to see
> rate limiting messages. So I've setup a local private mirror with cvdupdate
> ... I'm starting to see warnings like:
>
> Received signal: wake up
> ClamAV update process started at Wed May 25 07:26:29 2022
> daily database available for update (local version: 26551, remote version:
> 26552)
> WARNING: downloadFile: file not found: https://MIRROR/daily-26552.cdiff
> WARNING: downloadPatch: Can't download daily-26552.cdiff from https://MIRROR/daily-26552.cdiff

If it were my choice I'd probably use freshclam rather than cvdupdate,
partly because the docs [1] somewhat discourage use of cvdupdate, partly
because Pypi is a can of worms I wouldn't then have to worry about,

> I'm running cvdupdate at the recommended 4 hour interval. Can I run it more
> often?

The Pypi site uses 4 hours as an example, but I'm not sure that's
exactly a recommendation. Over at docs.clamav.net [1] it says

[quote]

Now run this as often as you need, or at least once a day to download/update the databases:

cvd update

[/quote]

Since it's just using DNS requests to check for updates it's very
lightweight. I feel sure you can make the queries as often as you
think is reasonable, but do bear in mind that updates to the official
signature database aren't especially frequent - a couple of times a
day or thereabouts at most I think.

> ... I may just have to exclude these types of warnings from logwatch.

I don't think I'd hide them. I'd just ignore them when I saw them,
but at least they'd usefully tell me that something was happening.
Of course it depends on how many you'd get. :/

[1] https://docs.clamav.net/appendix/CvdPrivateMirror.html?highlight=cvdupdate#private-local-mirrors

--

73,
Ged.
_______________________________________________

clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users

Help us build a comprehensive ClamAV guide:
https://github.com/Cisco-Talos/clamav-documentation

https://docs.clamav.net/#mailing-lists-and-chat

Re: How often can I run cvdupdate? [ In reply to ]

clamav-users at lists

May 25, 2022, 11:55 AM

Post #3 of 3 (322 views)

Permalink

Almost always once a day, currently between 9:00 and 9:30 am GMT. I scanned back and the last time there was a twice a day was 23 Dec 2021 and very few no update days.

-Al-

> On May 25, 2022, at 9:13 AM, G.W. Haywood via clamav-users <clamav-users@lists.clamav.net> wrote:
>
> Since it's just using DNS requests to check for updates it's very
> lightweight. I feel sure you can make the queries as often as you
> think is reasonable, but do bear in mind that updates to the official
> signature database aren't especially frequent - a couple of times a
> day or thereabouts at most I think.

Mailing List Archive

Attached Files:

Attached Files: