On 23 May 2023 21:59:22 Paul Netpresto <paul@netpresto.co.uk> wrote:

Hello

What should the behaviour of a running clamd be when it comes across a 
malformed database during a signature-reload.

Clamd.conf has setting "ConcurrentDatabaseReload no"

Regards Paul


Hi Paul, 

Is there is a malformed database freshclam will ignore it and shouldn't update. 

If it's a manually updated database, clamd will report the error in logs.

That options means.... 

Enable non-blocking (multi-threaded/concurrent) database reloads. This feature will temporarily load a second scanning engine while scanning continues using the first engine. Once loaded, the new engine takes over. The old engine is removed as soon as all scans using the old engine have completed. This feature requires more RAM, so this option is provided in case users are willing to block scans during reload in exchange for lower RAM requirements.
Default: yes

Cheers, 

Steve
Sanesecurity.com
3rdparty ClamAV signatures


_______________________________________________

Manage your clamav-users mailing list subscription / unsubscribe:
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/Cisco-Talos/clamav-documentation

https://docs.clamav.net/#mailing-lists-and-chat


Cheers,

Steve
Twitter: @sanesecurity