[clamav-users] Virus def download results in 403 Forbidden

[Mark Pizzolato - Clamav-Win32]

I've never seen any problem with freshclam's memory footprint.  

On my Windows box, freshclam runs taking up all of 2.6MB.  

Clamd, on the other hand sucks down 1.4GB.

There is no need to run clamd for the situation you are dealing with.

On Friday, March 5, 2021 at 10:45 AM, Joel Esler wrote:
> My current suggestion is setup Freshclam to do the initial update.
> 
> Directly downloading the raw cld files is no longer scalable.
> 
> > On Mar 5, 2021, at 1:29 PM, Ritch Parker <ritch at mixxum.com> wrote:
> >
> > I originally tried to setup Freshclam but found that, like the scan, it
> consumes a large amount of memory.  I have an instance large enough to run
> the scans, but it is on an internal subnet without external access… but
> downloading files takes almost no memory, so to save some cost I just setup
> a small instance on the public subnet to download the daily file… doing a once
> every four hour check, then move the file to the larger instance.  Was going
> to update further to do a head request, but then it stopped working :(
> ...Really was just looking for an update solution that could be run with a very
> small amount of memory and resources and this seemed to be the best fit.
> >
> >
> >> On Mar 5, 2021, at 10:20 AM, Joel Esler (jesler) via clamav-users <clamav-
> users at lists.clamav.net> wrote:
> >>
> >> Are you using Freshclam to download the updates?
> >>
> >>> On Mar 5, 2021, at 12:58 PM, Ritch Parker <ritch at mixxum.com> wrote:
> >>>
> >>> Hello,
> >>>
> >>> Yesterday, for some reason, all my AWS VMs receive a 403 Forbidden
> response from clamav when attempting to pull the latest cvd files.  I’ve tried
> from two different instances, from a lambda, and then from my local
> machine. All result in the same response:
> >>>
> >>> $ wget http://database.clamav.net/daily.cvd
> >>> --2021-03-05 09:47:46--  http://database.clamav.net/daily.cvd
> >>> Resolving database.clamav.net (database.clamav.net)...
> >>> 104.16.218.84, 104.16.219.84 Connecting to database.clamav.net
> (database.clamav.net)|104.16.218.84|:80... connected.
> >>> HTTP request sent, awaiting response... 403 Forbidden
> >>> 2021-03-05 09:47:48 ERROR 403: Forbidden.
> >>>
> >>> Not sure how I can resolve this.  Is this temporary?  I been checking once
> every 4 hours and no change.
> >>>
> >>> Thanks
> >>>
> >>> _______________________________________________
> >>>
> >>> clamav-users mailing list
> >>> clamav-users at lists.clamav.net
> >>> https://lists.clamav.net/mailman/listinfo/clamav-users
> >>>
> >>>
> >>> Help us build a comprehensive ClamAV guide:
> >>> https://github.com/vrtadmin/clamav-faq
> >>>
> >>> http://www.clamav.net/contact.html#ml
> >>
> >>
> >> _______________________________________________
> >>
> >> clamav-users mailing list
> >> clamav-users at lists.clamav.net
> >> https://lists.clamav.net/mailman/listinfo/clamav-users
> >>
> >>
> >> Help us build a comprehensive ClamAV guide:
> >> https://github.com/vrtadmin/clamav-faq
> >>
> >> http://www.clamav.net/contact.html#ml
> >
> 
> 
> _______________________________________________
> 
> clamav-users mailing list
> clamav-users at lists.clamav.net
> https://lists.clamav.net/mailman/listinfo/clamav-users
> 
> 
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
> 
> http://www.clamav.net/contact.html#ml