This is new behavior, as far as I know. We’ve not seen this sort of thing before. I’m noticing (via OSSEC) that our ClamAV deployments are updating themselves every 3 hours. This is far in excess of the cron we set up to run Freshclam. Any idea what could be causing this?