Hi list, I have installed ClamAV from rpmforge and followed the excellent CentOS how to on installing amavisd - all has appeared to just work as advertised - thanks to all those involved in getting these instructions together. Come time to upgrade to 5.3 and ClamAV 0.95 (logwatch has been encouraging me to do the ClamAV upgrade for a week or two) All appeared to work fine. However I now notice the following in my logwatch
--------------------- amavis Begin ------------------------
102 messages checked and passed. 3 messages with bad headers were found.
---------------------- amavis End -------------------------
--------------------- clam-update Begin ------------------------
Last ClamAV update process started at Wed Apr 8 04:02:26 2009
Last Status: main.cvd is up to date (version: 50, sigs: 500667, f-level: 38, builder: sven) Downloading daily-9211.cdiff [100%] Downloading daily-9212.cdiff [100%] daily.cld updated (version: 9212, sigs: 38627, f-level: 41, builder: guitar) Database updated (539294 signatures) from db.us.clamav.net (IP: 207.57.106.31) Clamd successfully notified about the update.
---------------------- clam-update End -------------------------
--------------------- Clamav Begin ------------------------
**Unmatched Entries** Database correctly reloaded (1039377 signatures)
---------------------- Clamav End -------------------------
My question is the number of signatures reported by the clam-update has never equaled the number reported in ClamAV database reload - they alway differed by around 792 or so. But after the upgrade to 0.95 and CentOS 5.3 it now reports nearly twice as many signatures! Whats up? Do I have two databases? Where do I find these? Interested in understanding this a little better. Thanks