[clamav-users] Scan very slow

[Steve Basford]

On 7 April 2019 17:25:56 Arnaud Jacques <webmaster at securiteinfo.com> wrote:

>
>
> ... and one day I created a *huge* ign2 file and it crashed clamd. Ign2
> files may not be appropriate to ignore tons of signatures.

>From memory.. daily.info (inside the daily.cvd) contains the database names 
included.

If all phishtank sigs were moved into phishtank.ldb etc. and that name was 
placed into the daily.info as a separate entry..

Freshclam could exclude that database loading during the loading of 
databases.. If it matched an exclude pishtank.ldb command in 
freshclam.conf.  Or maybe create a dataset.ign3 file which contains 
database names not to load at all.


Bigger picture would be move all android sigs into android.ldb etc and you 
could exclude those if needed to release memory and resources... All 
Windows sigs into a separate dataset etc.


The default would be to load all datasets.. but doing something like this 
would give endusers a choice without using ign2 entries for millions of 
sigs and without wasting time loading them into memory.

Both would need changes to freshclam and sigs.


Cheers,


Steve
Twitter: @sanesecurity
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.clamav.net/pipermail/clamav-users/attachments/20190407/c95bace0/attachment.htm>