[clamav-users] Still over 1/3 signature update sync errors

Joel Esler (jesler) jesler at cisco.com
Tue Jul 31 14:51:46 EDT 2018


Thanks Paul, this is super useful.

> On Jul 31, 2018, at 1:47 PM, Paul Kosinski <clamav-users at iment.com> wrote:
> 
> There are still over 1/3 signature update sync errors with the new
> ClamAV mirrors.
> 
> You may remember that I previously added code to our ClamAV update
> protocol to verify that the actually available daily.cvd etc. matched
> the version number reported by the DNS TXT record. (This is done by
> using curl to retrieve a short prefix of the daily.cvd etc. files.)
> 
> Some days ago I also added code to summarize any synchronization
> problems. This code logs how much, if any, delay obtains between the
> DNS TXT record reporting a new version and curl agreeing that the new
> version is actually available from a mirror. This protocol operates
> every 15 minutes (giving rise to a rounding error of up to 15 minutes).
> 
> Recent results are as follows:
> 
> 2018-07-26 05:18:02  No delay
> 2018-07-26 13:18:02  No delay
> 2018-07-26 13:33:01  No delay
> 2018-07-26 13:48:01  No delay
> 2018-07-26 14:03:01  No delay
> 2018-07-26 14:18:02  No delay
> 2018-07-26 21:33:02  00:45:00 delay
> 2018-07-27 05:03:02  No delay
> 2018-07-27 13:18:02  No delay
> 2018-07-27 13:18:02  No delay
> 2018-07-27 21:34:05  No delay
> 2018-07-27 21:34:05  No delay
> 2018-07-28 05:48:02  00:30:01 delay
> 2018-07-28 13:18:02  No delay
> 2018-07-28 21:18:02  00:30:01 delay
> 2018-07-29 05:33:01  00:29:59 delay
> 2018-07-29 14:18:02  01:30:00 delay
> 2018-07-29 21:18:02  00:30:00 delay
> 2018-07-30 04:48:02  No delay
> 2018-07-30 13:33:01  00:44:59 delay
> 2018-07-30 21:48:02  01:00:00 delay
> 2018-07-31 05:18:02  No delay
> 2018-07-31 13:33:02  No delay
> 
> Note: The ClamAV update protocol uses the URL "database.clamav.net",
> which in turn resolves to 1 of 5 IP addresses, which in turn route to
> one of many geographically separated systems. Thus, the delays may not
> correspond to problems with particular paths and/or mirror instances.
> 
> 
> P.S. I can provide a more detailed freshclam log for this if desired.
> _______________________________________________
> clamav-users mailing list
> clamav-users at lists.clamav.net
> http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
> 
> 
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
> 
> http://www.clamav.net/contact.html#ml




More information about the clamav-users mailing list