Avast vs ClamAV

[KatyComputer]

We have Avast & ClamAV installed on the PME 7.1-2. When looking at "This years' statistics" (/#pmgVirusCharts), I am only seeing messages snared by Avast.

Is this normal? My concern is that I have something misconfigured on the ClamAV side, and that it's not catching messages missed by Avast.




2021:

 

[Stoiko Ivanov]

I am only seeing messages snared by Avast.

Is this normal?

I would assume so:
* pmg-smtp-filter first checks the mail with avast (if configured), and only if this does not yield a result goes on to check it with clamav - so if both would detect it it would still show up as avast
* from my (limited) experience avast seems to catch more files than clamav

* your 2021 statistics seems like having only clamav hits from UNOFFICIAL lists (Sanesecurity - and Porcupine) - so one thing that could be is that you either disabled those in your setup (or that your subscription for them ran out)

I hope this helps!

 

[KatyComputer]

Thanks - something seems off, it seems like ClamAV should have more to say:

ls -altrh /var/log/clamav

 

[Stoiko Ivanov]

I wouldn't worry too much about that - clamav logs to syslog in the default config - I'd assume that the empty files are a result of the maintainers not removing the logrotation config (and never proving the `notifempty` part)

You can test if it works by ...
disabling avast and sending yourself a mail with EICAR inside

I hope this helps!