Quick question, when does /usr/bin/clamav_updater.sh get run by ASL (if indeed at all)?

Reason I ask is that I just had a client who was emailing someone actually on the spear.ndb list, a real person who for whatever reason was listed. Turns out the spear.ndb on this server was very out of date, 2010 to be precise.

Should I set my servers to run /usr/bin/clamav_updater.sh on a regular basis manually? Or should it be happening elsewhere anyway?

Cheers

George

Thanks for the question. ASL does not use it or run, but we do include the script in case you want to use the third party signatures it will download for you. Because the thirdparty signatures it downloads vary in quality and false positives we do not turn this on by default. We used to have that enabled many years ago in ASL, but disabled it I want to say 2 years ago because of the aforementioned concerns about the quality and false positive rates in some of the third party signatures.

With that said, those signatures have gotten much better, but still are not at the level where we feel comfortable turning them on by default. In general though, you may find that they work well for you, and the script to update them is included in ASL if you wish to use them.

My personal two cents, its safe for most folks to run that updater. YMMV, but like I said the quality of those signatures has gotten better, and a lot of people swear by them.

Mike thanks for the detail on this. It makes sense now, a couple of servers didn't have any of the extra definitions on them at all, being newer I guess.

My experience with these definitions echoes the feedback you have already received, mainly that they provide good coverage against phishing, spam and the like but occasionally there are false positives, as was my experience yesterday. No harm done but would be good not to have to worry about these updating themselves. I think I'll set them to update once a week, would certainly rather they remove stuff (around 4k messsages in the last 6 months from one server alone).

Cheers

George