[clamav-users] clamac + amavis database reload

[G.W. Haywood]

Hi there,

On Wed, 10 Nov 2021, Philipp Ewald wrote:

> if the databases from clamav has changed clam-av is reloading by himself. I 
> have configured to check every 5 min.

*What* is it that you have configured to check every 5 min?  There are
two main periodic checks, the check by freshclam that the copy of the
database on your local storage medium is up to date, and the check by
clamd that it has an up to date copy of the local database in memory.
The clamd daemon does *not* check the status of the local database on
disc against the remote database maintained by the ClamAV team.  It is
the freshclam utility which does that.

> Does amavis need to be reloaded too?

I don't know - please explain how you have configured Amavis and
ClamAV to work with each other.  If Amavis is using the clamd daemon
over a socket, then you probably don't need to reload Amavis but you
will need to make sure that clamd reloads its database when it detects
that a database change has taken place.  It can do that itself, or you
can configure freshclam to notify it when an update happens.  It's all
in the documentation.

> i have the feeling

Your feeling is not much use to us.  Is there something concrete which
gives you this feeling and which you can show to us?

> that new "learned" virus will not be detect by amavis + clamav.

ClamAV has no way of creating "learned" signaturees.  It uses only the
data in its database, which you must arrange to be provided to it and
to be kept up to date - for example by running freshclam.

> after some time amavis detect this virus without doing anything.

Please be more precise.

> Does this behavior changed in the last month?

The behaviour of ClamAV has not changed except perhaps for faults
which may have been fixed.  These will be listed in the release notes.
I cannot speak for the behaviour of Amavis, you probably need to talk
to the Amavis people about that.

-- 

73,
Ged.