Sanesecurity signatures are no longer being updated or distributed

[shuttlebox]

On Tue, Dec 16, 2008 at 10:05 PM, Steve Basford
<steveb_clamav at sanesecurity.com> wrote:
> In other words, if people downloaded the sigs every hour, each ip should
> only have 24 hits....as you can see, the above ips are WAY over that.
> Checking the log in detail... it's seems people are setting the download
> scripts to download every second.... all adding up to: 45,554 hits an hour,
> add the fact that 45,554 hits would run a php script... guess that's why the
> cpu usage was so high on a shared server and then got suspended.

Can't you keep a rolling log for the last hour and if a connecting ip
is already present in the log you block them for 24h?

-- 
/peter