switching clamavmodule -> clamd

[Rick Cooper]

 > -----Original Message-----
 > From: mailscanner-bounces at lists.mailscanner.info 
 > [mailto:mailscanner-bounces at lists.mailscanner.info] On 
 > Behalf Of Bryan Guest
 > Sent: Wednesday, July 25, 2007 4:47 PM
 > To: mailscanner at lists.mailscanner.info
 > Subject: switching clamavmodule -> clamd
 > 
 > Hello:
 > 
 > I am looking for a performance gain by switching from 
 > clamavmodule to clamd. 
 > I have been following the guide in the wiki (
 > http://wiki.mailscanner.info/doku.php?id=documentation:anti_v
 > irus:clamav:switch_to_rpm_clamd) 
 > and I would like to ask a couple of questions.
 > 
[...]
 > 
 > 4) What if clamd dies?
 > 
 > If clamd should fail, will Mailscanner continue to process 
 > mail? Should some 
 > monitor program such as supervise be put into place to 
 > automagically restart 
 > clamd?
 > 

You should monitor any important (is there another kind?) daemon, so
absolutly. That said it's been a very long time since I had an issue with
clamd dying, but I still monitor it.

 > 5) Will switching to clamd help with botched clamav database updates?
 > 
 > We have been trying to run the 0.9x versions of ClamAV and 
 > have been bitten 
 > twice by damaged or failed database updates when a major 
 > release occurs. 
 > Does switching to clamd have any affect on this situation?

This I cannot say for sure. FreshClam tests the downloaded updates and
doesn't install corrupted dbs, however if you were bitten by the MailScanner
monitor of clam db changes just make sure you use the newer, recommended MS
clamdb monitor value. When the last major problem occurred with the damaged
clamdb I got an email from freshclam stating there was a problem but looking
at the update logs the broken db was never actually installed. BTW:

Look at the following options in freshclam.conf:

OnErrorExecute and OnOutdatedExecute

I have a script they call with either (error or olddb) that sends me an
email notification of a problem and the nature of the problem.

Rick


--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.