Mailing List Archive

Hi there,

On Sat, 7 Dec 2019, ratatouille via clamav-users wrote:

> Since the recent update of clamav I have the following problem when freshclam
> automatically tries to update the db.
>
> Dec 7 11:20:43 bitmachine1 freshclam[783]: Unexpected error when attempting to update database: daily
> Dec 7 11:20:43 bitmachine1 freshclam[783]: fc_update_databases: fc_update_database failed: Failed to read/write file to database directory (10)
> Dec 7 11:20:43 bitmachine1 freshclam[783]: Database update process failed: Failed to read/write file to database directory (10)
>
> # ls -al
> drwxr-xr-x 2 vscan vscan 4096 7. Dez 12:44 .
> drwxr-xr-x 6 root root 4096 22. Jan 2019 ..
> -rw-r--r-- 1 vscan vscan 1458176 19. Sep 19:58 bytecode.cld
> -rw-r----- 1 vscan vscan 167019008 7. Dez 12:44 daily.cld
> -rw-r--r-- 1 vscan vscan 307403264 25. Nov 22:31 main.cld
> -rw------- 1 vscan vscan 896 25. Nov 21:08 mirrors.dat
>
> # ps aux |grep clam
> vscan 783 0.0 0.0 91040 232 ? Ss Nov28 0:00 /usr/local/bin/freshclam -d
> vscan 2091 0.0 39.3 1055172 808732 ? Ssl Nov28 2:18 /usr/local/sbin/clamd
>
> It fails to create the tmp-folder. No problem when I call freshclam
> from a terminal.
>
> What is wrong and how can I fix this issue?

It isn't easy to see what's wrong without more information.

You could tell freshclam to log verbosely, that might shed some light
on the issue.

What version of ClamAV are you using?

How much disc space is available? How much memory is in the machine?

Please post the freshclam configuration and the exact terminal command
which you used. I wonder if you are not using the same configuration
for the freshclam daemon that you're using when you run freshclam from
the terminal. I suggest you stop the freshclam daemon, and restart it
with the path to its configuration file specified explicitly on the
command line. You could also specify the path when you run freshclam
from the command line, to be sure it's the same.

The database read timeout in the freshclam configuration supplied with
recent releases is I believe 60 seconds. This is not long enough in
many cases, I recommend increasing it to something like 600 seconds,
although this is probably not the issue you're facing here.

--

73,
Ged.

_______________________________________________

clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

Hello!

"G.W. Haywood via clamav-users" <clamav-users@lists.clamav.net> schrieb am 07.12.19 um 16:13:52 Uhr:

> Hi there,
>
> On Sat, 7 Dec 2019, ratatouille via clamav-users wrote:
>
> > Since the recent update of clamav I have the following problem when freshclam
> > automatically tries to update the db.
> >
> > Dec 7 11:20:43 bitmachine1 freshclam[783]: Unexpected error when attempting to update database: daily
> > Dec 7 11:20:43 bitmachine1 freshclam[783]: fc_update_databases: fc_update_database failed: Failed to read/write file to database directory (10)
> > Dec 7 11:20:43 bitmachine1 freshclam[783]: Database update process failed: Failed to read/write file to database directory (10)
> >
> > # ls -al
> > drwxr-xr-x 2 vscan vscan 4096 7. Dez 12:44 .
> > drwxr-xr-x 6 root root 4096 22. Jan 2019 ..
> > -rw-r--r-- 1 vscan vscan 1458176 19. Sep 19:58 bytecode.cld
> > -rw-r----- 1 vscan vscan 167019008 7. Dez 12:44 daily.cld
> > -rw-r--r-- 1 vscan vscan 307403264 25. Nov 22:31 main.cld
> > -rw------- 1 vscan vscan 896 25. Nov 21:08 mirrors.dat
> >
> > # ps aux |grep clam
> > vscan 783 0.0 0.0 91040 232 ? Ss Nov28 0:00 /usr/local/bin/freshclam -d
> > vscan 2091 0.0 39.3 1055172 808732 ? Ssl Nov28 2:18 /usr/local/sbin/clamd
> >
> > It fails to create the tmp-folder. No problem when I call freshclam
> > from a terminal.
> >
> > What is wrong and how can I fix this issue?
>
> It isn't easy to see what's wrong without more information.
>
> You could tell freshclam to log verbosely, that might shed some light
> on the issue.
>
> What version of ClamAV are you using?
>
> How much disc space is available? How much memory is in the machine?
>
> Please post the freshclam configuration and the exact terminal command
> which you used. I wonder if you are not using the same configuration
> for the freshclam daemon that you're using when you run freshclam from
> the terminal. I suggest you stop the freshclam daemon, and restart it
> with the path to its configuration file specified explicitly on the
> command line. You could also specify the path when you run freshclam
> from the command line, to be sure it's the same.
>
> The database read timeout in the freshclam configuration supplied with
> recent releases is I believe 60 seconds. This is not long enough in
> many cases, I recommend increasing it to something like 600 seconds,
> although this is probably not the issue you're facing here.

The system is up since 101 days. I don't remember if I restarted freshclam
since I upgraded (configure&make&make install) clamav a few days ago.

The process is running as user vscan. It makes no difference if I call freshclam
without parameter or as freshclam --config-file=/usr/local/etc/freshclam.conf

I enabled verbose logging.

Received signal: wake up
ClamAV update process started at Sat Dec 7 19:06:15 2019
Current working dir is /usr/local/share/clamav/
Querying current.cvd.clamav.net
TTL: 1800
fc_dns_query_update_info: Software version from DNS: 0.102.1
Current working dir is /usr/local/share/clamav/
check_for_new_database_version: Local copy of daily found: daily.cld.
query_remote_database_version: daily.cvd version from DNS: 25656
daily.cld database is up to date (version: 25656, sigs: 2034796, f-level: 63, builder: raynman)
fc_update_database: daily.cld already up-to-date.
Current working dir is /usr/local/share/clamav/
check_for_new_database_version: Local copy of main found: main.cld.
query_remote_database_version: main.cvd version from DNS: 59
main.cld database is up to date (version: 59, sigs: 4564902, f-level: 60, builder: sigmgr)
fc_update_database: main.cld already up-to-date.
Current working dir is /usr/local/share/clamav/
check_for_new_database_version: Local copy of bytecode found: bytecode.cld.
query_remote_database_version: bytecode.cvd version from DNS: 331
bytecode.cld database is up to date (version: 331, sigs: 94, f-level: 63, builder: anvilleg)
fc_update_database: bytecode.cld already up-to-date.

This is the freshclam.conf without comments. There is only one freshclam.conf on
the system.

UpdateLogFile /var/log/freshclam.log
LogVerbose yes
LogSyslog yes
LogFacility LOG_MAIL
PidFile /var/lib/clamav/freshclam.pid
DatabaseOwner vscan
DatabaseMirror database.clamav.net
Checks 48
NotifyClamd /usr/local/etc/clamd.conf
Bytecode yes

I looked at /etc/systemd/system/multi-user.target.wants/freshclam.service
and found that User=vscan Group=vscan where commented.

I commented them out and it looks like this now:

[Unit]
Description=Freshclam virus definitions downloader
After=syslog.target network.target

[Service]
Type=forking
ExecStart=/usr/local/bin/freshclam -d
User=vscan
Group=vscan
;PrivateTmp=yes

[Install]
WantedBy=multi-user.target

I don't know if this solved the problem but for now it's gone. I'll keep track
on this and report back if it occurs still.

Thank you for your time!

Andreas

_______________________________________________

clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

Hi

We have seen this error on centos 6 and centos 7 servers and restarting
freshclam resolves the error.

we have a server as below which we have not touched the cvd (which again
would make it start to work) but I have set another to verbose logging.

We were informed by the devs of interworx that it was a mirror failure and
restarting freshclam finds another mirror. However it is erroring quiet
often.

I will touch the cvd to bring this server back to updated but UID:GID 244 is
clamav and folders are correct - to prove this, restarting freshclam then
updates correctly using UID:GID 244 clamav to run freshclam

I will update next time freshclam errors with same error but would be
verbose to help

Many thanks

John

Centos 6

ERROR: Update failed.
ERROR: Database update process failed: Failed to read/write file to database
directory (10)
WARNING: fc_update_databases: fc_update_database failed: Failed to
read/write file to database directory (10)
ERROR: Unexpected error when attempting to update database:daily
WARNING: getcvd: Can't download daily.cvd from
https://database.clamav.net/daily.cvd
Hint: The database directory must be writable for UID 244 or GID 244
ERROR: downloadFile: Can't create new file
/var/clamav/tmp/clamav-bbd92e62b960afbe736e0ce9b733da41.tmp in
/var/clamavdaily database available for update (local version: 25653, remote
version: 25656)
DON'T PANIC! Read https://www.clamav.net/documents/upgrading-clamav
WARNING: Local version: 0.102.0 Recommended version: 0.102.1
WARNING: Your ClamAV installation is OUTDATED!ClamAV update process started
at Sun Dec 8 09:19:01 2019

Virus Definition Information [?]

File Date # of Definitions
bytecode.cvd 19 Sep 2019 12 94
daily.cvd 04 Dec 2019 04 2027652
main.cvd 25 Nov 2019 08 4564902


-----Original Message-----
From: clamav-users [mailto:clamav-users-bounces@lists.clamav.net] On Behalf
Of ratatouille via clamav-users
Sent: 07 December 2019 18:21
To: clamav-users@lists.clamav.net
Cc: ratatouille
Subject: Re: [clamav-users] failed to write to

Hello!

"G.W. Haywood via clamav-users" <clamav-users@lists.clamav.net> schrieb am
07.12.19 um 16:13:52 Uhr:

> Hi there,
>
> On Sat, 7 Dec 2019, ratatouille via clamav-users wrote:
>
> > Since the recent update of clamav I have the following problem when
> > freshclam automatically tries to update the db.
> >
> > Dec 7 11:20:43 bitmachine1 freshclam[783]: Unexpected error when
> > attempting to update database: daily Dec 7 11:20:43 bitmachine1
> > freshclam[783]: fc_update_databases: fc_update_database failed:
> > Failed to read/write file to database directory (10) Dec 7 11:20:43
> > bitmachine1 freshclam[783]: Database update process failed: Failed
> > to read/write file to database directory (10)
> >
> > # ls -al
> > drwxr-xr-x 2 vscan vscan 4096 7. Dez 12:44 .
> > drwxr-xr-x 6 root root 4096 22. Jan 2019 ..
> > -rw-r--r-- 1 vscan vscan 1458176 19. Sep 19:58 bytecode.cld
> > -rw-r----- 1 vscan vscan 167019008 7. Dez 12:44 daily.cld
> > -rw-r--r-- 1 vscan vscan 307403264 25. Nov 22:31 main.cld
> > -rw------- 1 vscan vscan 896 25. Nov 21:08 mirrors.dat
> >
> > # ps aux |grep clam
> > vscan 783 0.0 0.0 91040 232 ? Ss Nov28 0:00
/usr/local/bin/freshclam -d
> > vscan 2091 0.0 39.3 1055172 808732 ? Ssl Nov28 2:18
/usr/local/sbin/clamd
> >
> > It fails to create the tmp-folder. No problem when I call freshclam
> > from a terminal.
> >
> > What is wrong and how can I fix this issue?
>
> It isn't easy to see what's wrong without more information.
>
> You could tell freshclam to log verbosely, that might shed some light
> on the issue.
>
> What version of ClamAV are you using?
>
> How much disc space is available? How much memory is in the machine?
>
> Please post the freshclam configuration and the exact terminal command
> which you used. I wonder if you are not using the same configuration
> for the freshclam daemon that you're using when you run freshclam from
> the terminal. I suggest you stop the freshclam daemon, and restart it
> with the path to its configuration file specified explicitly on the
> command line. You could also specify the path when you run freshclam
> from the command line, to be sure it's the same.
>
> The database read timeout in the freshclam configuration supplied with
> recent releases is I believe 60 seconds. This is not long enough in
> many cases, I recommend increasing it to something like 600 seconds,
> although this is probably not the issue you're facing here.

The system is up since 101 days. I don't remember if I restarted freshclam
since I upgraded (configure&make&make install) clamav a few days ago.

The process is running as user vscan. It makes no difference if I call
freshclam without parameter or as freshclam
--config-file=/usr/local/etc/freshclam.conf

I enabled verbose logging.

Received signal: wake up
ClamAV update process started at Sat Dec 7 19:06:15 2019 Current working
dir is /usr/local/share/clamav/ Querying current.cvd.clamav.net
TTL: 1800
fc_dns_query_update_info: Software version from DNS: 0.102.1 Current working
dir is /usr/local/share/clamav/
check_for_new_database_version: Local copy of daily found: daily.cld.
query_remote_database_version: daily.cvd version from DNS: 25656 daily.cld
database is up to date (version: 25656, sigs: 2034796, f-level: 63, builder:
raynman)
fc_update_database: daily.cld already up-to-date.
Current working dir is /usr/local/share/clamav/
check_for_new_database_version: Local copy of main found: main.cld.
query_remote_database_version: main.cvd version from DNS: 59 main.cld
database is up to date (version: 59, sigs: 4564902, f-level: 60, builder:
sigmgr)
fc_update_database: main.cld already up-to-date.
Current working dir is /usr/local/share/clamav/
check_for_new_database_version: Local copy of bytecode found: bytecode.cld.
query_remote_database_version: bytecode.cvd version from DNS: 331
bytecode.cld database is up to date (version: 331, sigs: 94, f-level: 63,
builder: anvilleg)
fc_update_database: bytecode.cld already up-to-date.

This is the freshclam.conf without comments. There is only one
freshclam.conf on the system.

UpdateLogFile /var/log/freshclam.log
LogVerbose yes
LogSyslog yes
LogFacility LOG_MAIL
PidFile /var/lib/clamav/freshclam.pid
DatabaseOwner vscan
DatabaseMirror database.clamav.net
Checks 48
NotifyClamd /usr/local/etc/clamd.conf
Bytecode yes

I looked at /etc/systemd/system/multi-user.target.wants/freshclam.service
and found that User=vscan Group=vscan where commented.

I commented them out and it looks like this now:

[Unit]
Description=Freshclam virus definitions downloader After=syslog.target
network.target

[Service]
Type=forking
ExecStart=/usr/local/bin/freshclam -d
User=vscan
Group=vscan
;PrivateTmp=yes

[Install]
WantedBy=multi-user.target

I don't know if this solved the problem but for now it's gone. I'll keep
track on this and report back if it occurs still.

Thank you for your time!

Andreas

_______________________________________________

clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml



The content of this email are intended for the named addressee only. It contains information that may be confidential and which may also be privileged. Unless you are the named addressee (or authorised to received for the addressee) you may not copy or use it, or disclose it to anyone else. If you received it in error please notify us immediately and then destroy it. Further, we make every effort to keep our network free from viruses, and all email passes through full antivirus, content and spam filters. However, you do need to scan this email and any attachments to it for viruses as we can take no responsibility for any computer virus, which might be transferred by way of this email.

This email has been sent using DEMS, if you would like to start using DEMS, please email Doc2disk Ltd for prices (sales@doc2disk.com).



_______________________________________________

clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

ratatouille via clamav-users <clamav-users@lists.clamav.net> schrieb am 07.12.19 um 19:21:16 Uhr:

> I don't know if this solved the problem but for now it's gone. I'll keep track
> on this and report back if it occurs still.

The problem remains.

Dec 8 12:06:36 bitmachine1 freshclam[5059]: mkdir_and_chdir_for_cdiff_tmp: Can't create directory /usr/local/share/clamav/tmp/clamav-31af67dd9f97642f2d9534175fe304fc.tmp
Dec 8 12:06:36 bitmachine1 freshclam[5059]: Incremental update failed, trying to download daily.cvd
Dec 8 12:06:36 bitmachine1 freshclam[5059]: downloadFile: Can't create new file /usr/local/share/clamav/tmp/clamav-050e079f76697162073f8287eadb5b84.tmp in /usr/local/share/clamav
Dec 8 12:06:36 bitmachine1 freshclam[5059]: getcvd: Can't download daily.cvd from https://database.clamav.net/daily.cvd
Dec 8 12:06:36 bitmachine1 freshclam[5059]: Unexpected error when attempting to update database: daily
Dec 8 12:06:36 bitmachine1 freshclam[5059]: fc_update_databases: fc_update_database failed: Failed to read/write file to database directory (10)
Dec 8 12:06:36 bitmachine1 freshclam[5059]: Database update process failed: Failed to read/write file to database directory (10)
Dec 8 12:06:36 bitmachine1 freshclam[5059]: Update failed.

I killed freshclam so that clamd was still running and executed
freshclam -v --config-file=/usr/local/etc/freshclam.conf

ClamAV update process started at Sun Dec 8 12:57:06 2019
Current working dir is /usr/local/share/clamav/
Querying current.cvd.clamav.net
TTL: 570
fc_dns_query_update_info: Software version from DNS: 0.102.1
Current working dir is /usr/local/share/clamav/
check_for_new_database_version: Local copy of daily found: daily.cld.
query_remote_database_version: daily.cvd version from DNS: 25657
daily.cld database is up to date (version: 25657, sigs: 2036324, f-level: 63, builder: raynman)
fc_update_database: daily.cld already up-to-date.
Current working dir is /usr/local/share/clamav/
check_for_new_database_version: Local copy of main found: main.cld.
query_remote_database_version: main.cvd version from DNS: 59
main.cld database is up to date (version: 59, sigs: 4564902, f-level: 60, builder: sigmgr)
fc_update_database: main.cld already up-to-date.
Current working dir is /usr/local/share/clamav/
check_for_new_database_version: Local copy of bytecode found: bytecode.cld.
query_remote_database_version: bytecode.cvd version from DNS: 331
bytecode.cld database is up to date (version: 331, sigs: 94, f-level: 63, builder: anvilleg)
fc_update_database: bytecode.cld already up-to-date.

If I create the tmp folder manually it is removed next time freshclam runs and cannot
be created by freshclam/vscan again. That's the reason the run fails.
I don't understand why. The permissions seem to be correct.

I set the immunteable bit to the tmp folder but that gave more warnings.

Andreas

_______________________________________________

clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

Hi there,

On Sun, 8 Dec 2019, ratatouille via clamav-users wrote:

> The problem remains.
>
> Dec 8 12:06:36 bitmachine1 freshclam[5059]: mkdir_and_chdir_for_cdiff_tmp: Can't create directory /usr/local/share/clamav/tmp/clamav-31af67dd9f97642f2d9534175fe304fc.tmp
> ...

AppArmor/SELinux etc...?

> I set the immunteable bit...

No, I don't think making things immutable is going to help.

--

73,
Ged.

_______________________________________________

clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

"G.W. Haywood via clamav-users" <clamav-users@lists.clamav.net> schrieb am 08.12.19 um 12:56:45 Uhr:

> Hi there,
>
> On Sun, 8 Dec 2019, ratatouille via clamav-users wrote:
>
> > The problem remains.
> >
> > Dec 8 12:06:36 bitmachine1 freshclam[5059]: mkdir_and_chdir_for_cdiff_tmp: Can't create directory /usr/local/share/clamav/tmp/clamav-31af67dd9f97642f2d9534175fe304fc.tmp
> > ...
>
> AppArmor/SELinux etc...?

No, no AppArmor or SELinux involved.

> > I set the immunteable bit...
>
> No, I don't think making things immutable is going to help.
>

Andreas

_______________________________________________

clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

Hi there,

On Sat, 7 Dec 2019, ratatouille via clamav-users wrote:

> It fails to create the tmp-folder. No problem when I call freshclam
> from a terminal.

When you run freshclam from the terminal, what user is running freshclam?

If it is root, have you tried starting freshclam as root to see if the
problem goes away?

--

73,
Ged.

_______________________________________________

clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

"G.W. Haywood via clamav-users" <clamav-users@lists.clamav.net> schrieb am 08.12.19 um 14:02:46 Uhr:

> On Sat, 7 Dec 2019, ratatouille via clamav-users wrote:
>
> > It fails to create the tmp-folder. No problem when I call freshclam
> > from a terminal.
>
> When you run freshclam from the terminal, what user is running freshclam?
>
> If it is root, have you tried starting freshclam as root to see if the
> problem goes away?

I stop freshclam systemctl stop freshclam.
clamd is also stoped then. So I start it with systemctl start clamd
and then fresclam is also startet.

I kill freshclam and clamd is still running.
Then I start freshclam -d as root and it is running as vscan, as always.

What else could I do?

Andreas

_______________________________________________

clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

On 2019-12-08 17:02, ratatouille via clamav-users wrote:
> "G.W. Haywood via clamav-users" <clamav-users@lists.clamav.net>
> schrieb am 08.12.19 um 14:02:46 Uhr:
>
>> On Sat, 7 Dec 2019, ratatouille via clamav-users wrote:
>>
>> > It fails to create the tmp-folder. No problem when I call freshclam
>> > from a terminal.
>>
>> When you run freshclam from the terminal, what user is running
>> freshclam?
>>
>> If it is root, have you tried starting freshclam as root to see if the
>> problem goes away?
>
> I stop freshclam systemctl stop freshclam.
> clamd is also stoped then. So I start it with systemctl start clamd
> and then fresclam is also startet.
>
> I kill freshclam and clamd is still running.
> Then I start freshclam -d as root and it is running as vscan, as
> always.
>
> What else could I do?
>
> Andreas
>
> _______________________________________________
>
> clamav-users mailing list
> clamav-users@lists.clamav.net
> https://lists.clamav.net/mailman/listinfo/clamav-users
>
>
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
>
> http://www.clamav.net/contact.html#ml

Clamav compiled from sources on Slackware (without systemd) -> creating
the tmp folder with the appropriate permissions -> the folder remains
after the automatic update but is deleted after the update from the
command line with freshclam.

It may be a bug!

_______________________________________________

clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

Hi there,

On Sun, 8 Dec 2019, ratatouille via clamav-users wrote:

> I stop freshclam systemctl stop freshclam. clamd is also stoped
> then. So I start it with systemctl start clamd and then fresclam is
> also startet.

That seems a little odd to me but I don't think it necessarily
indicates a problem.

> I kill freshclam and clamd is still running.
> Then I start freshclam -d as root and it is running as vscan, as always.
>
> What else could I do?

How about trying something like

freshclam --datadir=/tmp

to see if it still fails?

I wonder if you should try the latest version of ClamAV, compiled from source.

--

73,
Ged.

_______________________________________________

clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

I haven't tried to replicate this issue, but I have an idea of what might be going on.

freshclam creates the /usr/local/share/clamav/tmp directory on startup, and then deletes it again when it is complete. This behavior holds for freshclam run in daemon mode as well. Of course, in daemon mode, it expects the /tmp directory to exist the entire time that freshclam is up.

I'm guessing that you're running freshclam --daemon in the background, which creates the /usr/local/share/clamav/tmp directory.
Then you're running freshclam without daemon mode, which creates and deletes the directory.
Finally, the daemon freshclam performs an update but fails to write to the /usr/local/share/clamav/tmp directory because the previous invocation deleted it upon completion.

Is this guess accurate?

-Micah

?On 12/8/19, 10:03 AM, "clamav-users on behalf of ratatouille via clamav-users" <clamav-users-bounces@lists.clamav.net on behalf of clamav-users@lists.clamav.net> wrote:

"G.W. Haywood via clamav-users" <clamav-users@lists.clamav.net> schrieb am 08.12.19 um 14:02:46 Uhr:

> On Sat, 7 Dec 2019, ratatouille via clamav-users wrote:
>
> > It fails to create the tmp-folder. No problem when I call freshclam
> > from a terminal.
>
> When you run freshclam from the terminal, what user is running freshclam?
>
> If it is root, have you tried starting freshclam as root to see if the
> problem goes away?

I stop freshclam systemctl stop freshclam.
clamd is also stoped then. So I start it with systemctl start clamd
and then fresclam is also startet.

I kill freshclam and clamd is still running.
Then I start freshclam -d as root and it is running as vscan, as always.

What else could I do?

Andreas

_______________________________________________

clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml



_______________________________________________

clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

Hi Micah,

On Mon, 9 Dec 2019, Micah Snyder (micasnyd) via clamav-users wrote:

> I haven't tried to replicate this issue, but I have an idea of what
> might be going on.
>
> freshclam creates the /usr/local/share/clamav/tmp directory on
> startup, and then deletes it again when it is complete. ...

That's one reason I asked the OP to try '--datadir=/tmp'. ;)

--

73,
Ged.

_______________________________________________

clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

"G.W. Haywood via clamav-users" <clamav-users@lists.clamav.net> schrieb am 09.12.19 um 23:29:29 Uhr:

> Hi Micah,
>
> On Mon, 9 Dec 2019, Micah Snyder (micasnyd) via clamav-users wrote:
>
> > I haven't tried to replicate this issue, but I have an idea of what
> > might be going on.
> >
> > freshclam creates the /usr/local/share/clamav/tmp directory on
> > startup, and then deletes it again when it is complete. ...
>
> That's one reason I asked the OP to try '--datadir=/tmp'. ;)

These are the last lines of the output when I run freshclam --datadir=/tmp
as root:

updatedb: Running g_cb_download_complete callback...
download_complete_callback: Download complete for database : /tmp/tmp/clamav-9eb9ad820e0b274895ac13063093c156.tmp-bytecode.cvd
download_complete_callback: fc_context->bTestDatabases : 1
download_complete_callback: fc_context->bBytecodeEnabled : 1
Testing database: '/tmp/tmp/clamav-9eb9ad820e0b274895ac13063093c156.tmp-bytecode.cvd' ...
Loading signatures from /tmp/tmp/clamav-9eb9ad820e0b274895ac13063093c156.tmp-bytecode.cvd
Properly loaded 95 signatures from /tmp/tmp/clamav-9eb9ad820e0b274895ac13063093c156.tmp-bytecode.cvd
Database test passed.
bytecode.cvd updated (version: 331, sigs: 94, f-level: 63, builder: anvilleg)
fc_update_database: bytecode.cvd updated.
Clamd successfully notified about the update.

A tmp--folder seems to be created in /tmp and is deleted after the run.
I thougt version 0.102.1 is the latest version already.

Andreas

_______________________________________________

clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

Hi there,

On Tue, 10 Dec 2019, ratatouille via clamav-users wrote:

> A tmp--folder seems to be created in /tmp and is deleted after the run.

If you restart the daemon, then use /tmp for manual runs, does the problem go away?

> I thougt version 0.102.1 is the latest version already.

Yes, you're right, I take it you compiled from source?

--

73,
Ged.

_______________________________________________

clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

"G.W. Haywood via clamav-users" <clamav-users@lists.clamav.net> schrieb am 11.12.19 um 11:49:50 Uhr:

> > A tmp--folder seems to be created in /tmp and is deleted after the run.
>
> If you restart the daemon, then use /tmp for manual runs, does the problem go away?

The problem seems to be solved since I chown 755 /usr/local/share/clamav

I do a systemctl start freshclam and the tmp-folder is created in /usr/local/share/clamav
and deleted when I stop the daemon and created again when I start freshclam via
systemctl.

When I stop the daemon clamd is stopped also. Then when I start freshclam via
systemctl clamd is not started. I then start it via systemctl.

Did not notice that before and the errormessage is gone away. All a bit strange.
I'll keep an eye on the logs.

> > I thougt version 0.102.1 is the latest version already.
>
> Yes, you're right, I take it you compiled from source?

Yes.

Everytime I do upgrade clamd on the server by compiling it from source
I have different problems getting the beast running again. Sometimes I
even have to do a ldconfig after.

I'll track that on the next upgrade.

Andreas

_______________________________________________

clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml