[clamav-users] ClamAV mirrors have gotten worse!

[Joel Esler (jesler)]

Any particular reason that you are using a local mirror?  I mean, if not strictly necessary, just point it at our mirrors and call it a day.

I've talked to a couple people off list in the last few days that were experiencing errors or delays, and 100% of them were using local proxies or mirrors.

One was because the proxy didn't know how to address "HTTP/1.0" (Instead of "HTTP/1.1").

So it could be the smallest of issues, eliminate any issues that are not strictly relevant.

--
Joel Esler
Manager, Communities Division
Cisco Talos Intelligence Group
http://www.talosintelligence.com

> On Nov 19, 2018, at 9:25 PM, Paul Kosinski <clamav-users at iment.com> wrote:
> 
> Our Internet-facing ClamAV sits on our gateway/firewall and serves as
> our local mirror. It accesses the Internet via the NIC whose IP address
> is 10.11.14.160. (We used to have two NICs connected to the Internet,
> but now only have one, so this is historical only.) 
> 
> The msg "Using ip '10.11.14.160' for fetching" is produced by the
> freshclam binary itself and derives from our freshclam.conf entry:
> 
>  # Use aaa.bbb.ccc.ddd as client address for downloading databases.
>  # Useful for multi-homed systems. 
>  # Default: Use OS'es default outgoing IP address. 
>  LocalIPAddress 10.11.14.160
> 
> No matter, are we so unlucky -- only 1 out of 3M -- in having the sync
> errors reappear? Or are we simply one of far fewer users who log (and
> actually examine) their entire freshclam output?
> 
> P.S. I have very recently updated our clamavs to 0.100.2. I wonder if
> that will improve things in this regard.
> 
> 
> 
> On Thu, 15 Nov 2018 19:40:43 +0000
> "Joel Esler (jesler)" <jesler at cisco.com> wrote:
> 
>> Judging by the 60+TB of traffic we are transferring a day, it's
>> working for at least 3M+ users.
>> 
>>> On Nov 15, 2018, at 1:34 PM, Dennis Peterson <dennispe at inetnw.com>
>>> wrote:
>>> 
>>> On 11/13/18 12:04 PM, Paul Kosinski wrote:
>>>> "Why are you looking at October reports?"
>>>> 
>>>> It was the first one. And it also shows that the problem began
>>>> *before* 0.100.1 was deemed OUTDATED.
>>>> 
>>>> So, here's one from this morning.
>>>> 
>>>> I also have 4 from yesterday, 3 from Sunday Nov 11 etc. Posting
>>>> them all would be a bit tedious.
>>> 
>>> What does this line mean - that is, what is fetching from that IP?
>>> Local mirror?
>>> 
>>> Using ip '10.11.14.160' for fetching.
>>> 
>>> And we're having a completely different experience here with
>>> reliability over the same time span:
>>> 
>>> Mirror #1
>>> IP: 104.16.189.138
>>> Successes: 19
>>> Failures: 0
>>> Last access: Thu Nov 15 07:01:02 2018
>>> Ignore: No
>>> -------------------------------------
>>> Mirror #2
>>> IP: 104.16.186.138
>>> Successes: 19
>>> Failures: 0
>>> Last access: Wed Nov 14 23:01:03 2018
>>> Ignore: No
>>> -------------------------------------
>>> Mirror #3
>>> IP: 104.16.185.138
>>> Successes: 18
>>> Failures: 0
>>> Last access: Mon Nov 12 21:05:32 2018
>>> Ignore: No
>>> -------------------------------------
>>> Mirror #4
>>> IP: 104.16.187.138
>>> Successes: 18
>>> Failures: 0
>>> Last access: Sun Nov 11 01:07:46 2018
>>> Ignore: No
>>> -------------------------------------
>>> Mirror #5
>>> IP: 104.16.188.138
>>> Successes: 19
>>> Failures: 0
>>> Last access: Mon Nov 12 14:03:05 2018
>>> Ignore: No
> _______________________________________________
> clamav-users mailing list
> clamav-users at lists.clamav.net
> http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
> 
> 
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
> 
> http://www.clamav.net/contact.html#ml