[Avcheck] Avcheck with Clam

[Dani Pardo]

On Wed, 12 Feb 2003, Marcio Merlone wrote:

>
> What IP? I dont have 213.97.41.205 nor 80.64. nor enplater.com on my
> black list... can u send me the hole message, please? Sorry.

  Oops.. I deleted it, it complained about the name, (or part of it,
uc.nombres.ttd.es). That domain is the ADSL range of IPs of our main phone
company in Spain. Probably some ADSL'er in Spain is sending out spam or
something.


> [root@bat access]# grep -B 2 "Database updated" \
> /var/log/clam-update.log|grep Checking
> Checking for a new database - started at Sat Feb  1 08:00:01 2003
> Checking for a new database - started at Tue Feb  4 08:00:01 2003
> Checking for a new database - started at Thu Feb  6 08:00:00 2003
> Checking for a new database - started at Sat Feb  8 08:00:00 2003
> Checking for a new database - started at Tue Feb 11 08:00:00 2003
> [root@bat access]#
>
> Those are the ones that got new .sig file after last monthly log
> rotation..
> My mailgraph is not yet accounting viruses so I dont have numbers, but
> Clamav is working very nice. I'd like to check avcheck instead of
> amavisd-new to try to unload the machine, wich is averaging 2 with peaks
> of 20 (5 min load average) and 60msg/min average with peaks of
> 570msg/min by now.
>

  Cool. I was also using amavis before.. but the load was too high (And I
just relay for our company, 50 users!). Avcheck performs great, the only
thing I can't get to work is the mail-warning that should go to the
recipend and the sender of the virus (just the sysadmin receives the
virus-warning).

-- 
Dani Pardo, dani@enplater.com
Enplater S.A