Freshclam problems

[Anne Wilson]

On Monday 21 November 2011 18:39:05 Anne Wilson wrote:
> Am 21.11.2011 19:32, schrieb Anne Wilson:
> > On my server, running CentOS 6, I've started getting messages like
> > 
> >  No updates detected in the log for the freshclam daemon (the
> >  ClamAV update process).  If the freshclam daemon is not running,
> >  you may need to restart it.  Other options:
> >  etc...
> > 
> > and
> > 
> > /etc/cron.daily/freshclam:
> > 
> > ERROR: Problem with internal logger (UpdateLogFile =
> > /var/log/clamav/freshclam.log).
> > ERROR: Can't open /var/log/clamav/freshclam.log in append mode (check
> > permissions!).
> > 
> > This began after an update, and I've changed nothing in the configs. 
> > Freshclam ran without problems before the update, but I'm struggling to
> > sort this out.
> > 
> > First, then, can you tell me what permissions freshclam.log should have?
> > Currently it is owned clamav:clamav with rw access for clamav.  I read
> > that freshclam is launched by root, but then drops to an unprivileged
> > user - is clamav that user?
> > 
> > What other checks should I be making?
> 
> Hallo Anne
> 
> have you checked the ACLs for the named files as well? what does the
> directory permission say? Is there another process blocking/locking the
> logfile (check with lsof)?
> 
Which files, Martin?  

Clamscan runs, but the database is not getting updated because it can't access 
the log file (seems a bad decision to me).  The only other clue that I have is

LibClamAV Warning: **************************************************
LibClamAV Warning: ***  The virus database is older than 7 days!  ***
LibClamAV Warning: ***   Please update it as soon as possible.    ***
LibClamAV Warning: **************************************************
LibClamAV Warning: Corrupt TNEF header detected - length -1382561197

Googling wasn't much help with that warning, either.  The first part is self-
explanatory  when taken in conjunction with the logger error quoted above.  
The only entry that seemed similar was 
http://www.forum.psoft.net/archive/index.php/t-21360.html but that was in 
2007.

Anne