when I have a look at the repositories located on my ePO 4.0 and my SuperAgents, I notice that the avv*.dat files are much smaller than in the local VSE 8.7 instances.
For instance, for DAT 6055:
- if I extract the files from ..\Repository\Current\VSCANDAT1000\DAT\0000\avvdat-6055.zip , I get this:
avvclean.dat : 487,929 bytes
avvnames.dat : 388,497 bytes
avvscan.dat : 73,742,118 bytes
- when I check the local VSE 8.7 definition files in C:\Program Files\Common Files\McAfee\Engine\ , I get :
avvclean.dat : 5,039,589 bytes
avvnames.dat : 2,116,053 bytes
avvscan.dat : 102,408,493 bytes
Any idea where this size difference comes from ?
Avv dats are stored on the McAfee source servers and in the repository in a proprietary compressed format to reduce space and save bandwidth.
The Engine can work either way and decompress the Avvdats on the fly if needed, but it is faster to initialise the engine if we have them decompressed in advance.
Once the Avvdats are on the local machine there is no longer much advantage in storing the Avvdats compressed, so the update task decompresses them automatically and the resulting files you see on the client are consequently bigger.
Hence the difference between client and repository.
Ok, thus a given dat file (for instance avvscan.dat) can contain either compressed or uncompressed data, although the extension remains ".dat".
I though it could have been the local VirusScan instance that recreates new .dat files from "previous .dat files + latest .gem files" , without performing any pruning and inducing an increase of size.
Thanks for your answers !