Clamav has changed the way that it stores it signatures. It used to be in files main.cvd and daily.cvd. Now they are stored under the directories main.inc and daily.inc. The ebuild is setting up these new directories but is is also installing the old main.cvd file. The problem with this is if you don't manually delete this file clamav will load the signatures twice and use twice the memeory. Reproducible: Always Steps to Reproduce: 1.emerge clamav 2.start clamav 3. Actual Results: clamd.log file: Database correctly reloaded (241860 signatures) Expected Results: clamd.log file: Database correctly reloaded (137360 signatures)
I read this is the clamav mailing list: The first time the virus database is loaded (or when replacing a corrupted database) the .cvd is used. When subsequent scripted updates are applied, the .cvd is unpacked into an .inc directory and the updates are applied therein. Versions prior to 0.90 always used the .cvd because they didn't support scripted updates and the .inc directory structure. So it looks like the file main.cvd is supposed to be there. I still don't think there intention was to be loading both but that's the way it works. Anyway looks like this is more a problem for the clamav developers. Harley.
It looks like this is a problem when you update clamav or reinstall it. When first installing clamav every thing works correctly the new main.inc and daily.inc directories are created and the daily.cvd and main.cvd files are deleted. The problem is when you update or reinstall the main.inc and daily.inc directories are already there. And for some reason it doesn't ever delete the main.cvd file.
Seems to work in the latest version of clamav. Eventually any way.
