Freshclam problems

[Martin (KDE)]

Am 21.11.2011 20:09, schrieb Anne Wilson:
> On Monday 21 November 2011 18:39:05 Anne Wilson wrote:
>> Am 21.11.2011 19:32, schrieb Anne Wilson:
>>> On my server, running CentOS 6, I've started getting messages like
>>>
>>>  No updates detected in the log for the freshclam daemon (the
>>>  ClamAV update process).  If the freshclam daemon is not running,
>>>  you may need to restart it.  Other options:
>>>  etc...
>>>
>>> and
>>>
>>> /etc/cron.daily/freshclam:
>>>
>>> ERROR: Problem with internal logger (UpdateLogFile =
>>> /var/log/clamav/freshclam.log).
>>> ERROR: Can't open /var/log/clamav/freshclam.log in append mode (check
>>> permissions!).
>>>
>>> This began after an update, and I've changed nothing in the configs. 
>>> Freshclam ran without problems before the update, but I'm struggling to
>>> sort this out.
>>>
>>> First, then, can you tell me what permissions freshclam.log should have?
>>> Currently it is owned clamav:clamav with rw access for clamav.  I read
>>> that freshclam is launched by root, but then drops to an unprivileged
>>> user - is clamav that user?
>>>
>>> What other checks should I be making?
>>
>> Hallo Anne
>>
>> have you checked the ACLs for the named files as well? what does the
>> directory permission say? Is there another process blocking/locking the
>> logfile (check with lsof)?
>>
> Which files, Martin?  

Sorry I was not precise: check ACL of the log files.

> 
> Clamscan runs, but the database is not getting updated because it can't access 
> the log file (seems a bad decision to me).  The only other clue that I have is
> 
> LibClamAV Warning: **************************************************
> LibClamAV Warning: ***  The virus database is older than 7 days!  ***
> LibClamAV Warning: ***   Please update it as soon as possible.    ***
> LibClamAV Warning: **************************************************
> LibClamAV Warning: Corrupt TNEF header detected - length -1382561197
> 
> Googling wasn't much help with that warning, either.  The first part is self-
> explanatory  when taken in conjunction with the logger error quoted above.  
> The only entry that seemed similar was 
> http://www.forum.psoft.net/archive/index.php/t-21360.html but that was in 
> 2007.

have you tried running freshclam by hand from the command line (as root
btw)? Is the error message the same? If so, which file is named (if any)?

Martin

> 
> Anne
> _______________________________________________
> kde mailing list
> kde at lists.fedoraproject.org
> https://admin.fedoraproject.org/mailman/listinfo/kde
> New to KDE4? - get help from http://userbase.kde.org