[Clamav-devel] [Clamav-announce] ClamAV® blog: ClamAV 0.103.2 security patch release

[Micah Snyder (micasnyd)]

Benny,

Can I trouble you to provide a snippet of your update log with verbose mode enabled?  It may help identify the issue. 

One possibility is that your FreshClam is doing database version check over HTTP instead of DNS. If it is using HTTP to do the version check, that will quickly put you on cooldown, even if it is using the cdiff/scripted update. Because of the new rate limiting, freshclam must do the version check over DNS.  

I saw your configuration diff and I based on that I don't really think this is the issue, but... it could be.
Of course, it could also be something else. The log will help.

Regards,
Micah

> -----Original Message-----
> From: clamav-devel <clamav-devel-bounces at lists.clamav.net> On Behalf Of
> Benny Pedersen
> Sent: Saturday, May 1, 2021 2:23 PM
> To: clamav-devel at lists.clamav.net
> Subject: Re: [Clamav-devel] [Clamav-announce] ClamAV® blog: ClamAV 0.103.2
> security patch release
> 
> On 2021-05-01 23:04, Joel Esler (jesler) wrote:
> > We’re not considering BitTorrent.
> >
> > As Gary said, you’re obviously violating the rate limits.
> >
> > If you’re not using 103.2, you should upgrade to that.
> >
> > If you want to give me your public IP, I can look at the logs and tell
> > you what you’re doing wrong.
> 
> 
> stop
> 
> i just did not have freshclamd running, how can this violate anyting ?
> 
> to reproduce problem
> 
> stop freshclamd in 7 days,
> 
> after 7 days daily updates missing files
> 
> freshclamd try then tu get the daily.cvd, after that freshclamd on get cool down
> 
> fix this problem
> 
> what ever the problem is
> _______________________________________________
> 
> clamav-devel mailing list
> clamav-devel at lists.clamav.net
> https://lists.clamav.net/mailman/listinfo/clamav-devel
> 
> Please submit your patches to our Github: https://github.com/Cisco-
> Talos/clamav-devel/pulls
> 
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
> 
> http://www.clamav.net/contact.html#ml