From: "Massimo S." <ecs-isp@2rosenthals.com>
Reply-To: ml@ecomstation.it
Subject: Re: [eCS-ISP] clamscan issue - directories with a lot of files
To: eCS ISP Mailing List <ecs-isp@2rosenthals.com>
References: <list-11205781@2rosenthals.com> <list-11205848@2rosenthals.com>
 <list-11206060@2rosenthals.com>
Organization: Massimo S.
Message-ID: <3e93b67a-a359-d2c2-8ebc-e81e21f6530d@ecomstation.it>
Date: Tue, 5 Nov 2024 12:26:22 +0100
User-Agent: Mozilla/5.0 (OS/2; U; Warp 4.5; it-IT; rv:1.7.13) Gecko/20060424
 Thunderbird/1.0.8 Mnenhy/0.7.4.0
MIME-Version: 1.0
In-Reply-To: <list-11206060@2rosenthals.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: it-IT
Content-Transfer-Encoding: 7bit

there is also a GUI around

https://remydodin.levillage.org/en/realisations.php?item=5902&id=realisations

updated on July 2020

maybe the software has been abandoned (i don't know exacly) since clamav 0.98
stopped working with new signatures database

massimo

Il 05/11/2024 02:48, Doug Bissett ha scritto:
> On 2024-11-04, at 13:55:28, Steven Levine wrote:
>>
>> In <list-11205781@2rosenthals.com>, on 11/04/24
>>    at 10:36 PM, "Massimo S." <ecs-isp@2rosenthals.com> said:
>>
>> Hi Massimo,
>>
>>> i run this command for each domain
>>
>> Can I conclude you pasted a partially wrong command line?  When you are
>> running for a domain, you will need to use --recurse.
>>
>>> and i also run it "divided" on some single recipient directories for the
>>> small ones eg.
>>> X:\weasel\MailRoot\mydomain.com\mail1
>>> X:\weasel\MailRoot\mydomain.com\mail2
>>> etc..
>>
>> For the large mailstores, you may have to use --include and --exclude to
>> subdivide the directory contents into smaller chunks.
>>
>> Another option you have is to limit clamscan to checking only the recently
>> modified files.  Use your favorite file manager to build a list of the
>> recenly modified files and run clamscan with the --file-list=FILE switch
>> option.
>>
>> Given what we know about clamscan's memory usage and your mailstores, I
>> probably would use the --file-list option for all runs.  With 4OS2 and
>> some easily accessible utilities, this is easy.  To check all files
>> changed in the last 5 days, it's
>>
>> dir /[d-5,%_DATE] /a:-d /f /s maildir... >5days.lst
>> clamscan ... --file-lst=5days.lst
>>
>> where ... are your current switch options, excluding --recurse of course.
>>
>> If the resulting list is still too large for clamscan to handle without
>> errors, we can use split to break the list into smaller lists that
>> clamscan can handle.  For 200 lines per file, it's
>>
>> split -l200 5days.lst
>>
>> The resulting split files will be named xaa, aab etc.  We can adjust 200
>> upward until clamscan start to fail due to memory issues.  Then it's
>>
>>   for %XX in ( x* ) clamscan ... --file-list=%XX
>>
>> To use the above technique to check all files, we use
>>
>> dir /a:-d /f /s maildir... >allfiles.lst
>>
>>> Y: and Z: are both ramdisk filesystems
>>> but also i believe this is not important
>>
>> I agree.  This does not appear to be related to your problems.
>>
>> Steven
> 
> I have been following this, and would like to make some comments:
> 
> First, I used Clamscan, some years ago. to scan my mail store (in PMMail). It was a memory hog, and was causing a lot more problems than any virus ever did. So I quit using it.
> 
> Not feeling good about that, I did some experimenting. I came to the conclusion that OS/2 is not vulnerable to viruses, so the only way a file would be infected, was before it arrived on my system. The solution was to scan every (e-mail) file, as it arrived (PMMail can run programs as files arrive - I am pretty sure that weasel can too). I seem to recall using ClamDscan for some reason (probably so it was already loaded, and didn't have to restart for every run - reducing fragmentation problems). Now, I was scanning ONE file at a time, which did not solve all of the problems, but it was much better. Once the file is stored in OS/2, the chances that it will be infected are very close to zero. There is no point in scanning them again, unless you want to do them, one at a time, as they exit your system. Users should have appropriate protection against malware anyway. Then, I decided that I was the only user, so there was no point in scanning files, at all. So I quit using C
> lamscan. In the five, or so, years that I did use Clamscan, it never did find a bad file (other than one that I had for testing).
> 
> Another approach, that worked, was to use a windows (Linux?) virus scanner, to scan the files over the LAN. I never bothered to actually implement that, but it does work.
> 
> Hope this gives you some ideas...
>