Freshclam problems

[Anne Wilson]

On Monday 21 November 2011 19:27:56 Anne Wilson wrote:
> Am 21.11.2011 20:09, schrieb Anne Wilson:
> > On Monday 21 November 2011 18:39:05 Anne Wilson wrote:
> >> Am 21.11.2011 19:32, schrieb Anne Wilson:
> >>> On my server, running CentOS 6, I've started getting messages like
> >>> 
> >>>  No updates detected in the log for the freshclam daemon (the
> >>>  ClamAV update process).  If the freshclam daemon is not running,
> >>>  you may need to restart it.  Other options:
> >>>  etc...
> >>> 
> >>> and
> >>> 
> >>> /etc/cron.daily/freshclam:
> >>> 
> >>> ERROR: Problem with internal logger (UpdateLogFile =
> >>> /var/log/clamav/freshclam.log).
> >>> ERROR: Can't open /var/log/clamav/freshclam.log in append mode (check
> >>> permissions!).
> >>> 
> >>> This began after an update, and I've changed nothing in the configs.
> >>> Freshclam ran without problems before the update, but I'm struggling to
> >>> sort this out.
> >>> 
> >>> First, then, can you tell me what permissions freshclam.log should
> >>> have? Currently it is owned clamav:clamav with rw access for clamav. 
> >>> I read that freshclam is launched by root, but then drops to an
> >>> unprivileged user - is clamav that user?
> >>> 
> >>> What other checks should I be making?
> >> 
> >> Hallo Anne
> >> 
> >> have you checked the ACLs for the named files as well? what does the
> >> directory permission say? Is there another process blocking/locking the
> >> logfile (check with lsof)?
> > 
> > Which files, Martin?
> 
> Sorry I was not precise: check ACL of the log files.
> 
You mean

ls -l  /var/log/clamav/freshclam.log
-rw-r--r--+ 1 clamav clamav 0 Nov 13 03:34 /var/log/clamav/freshclam.log
?

> > Clamscan runs, but the database is not getting updated because it can't
> > access the log file (seems a bad decision to me).  The only other clue
> > that I have is
> > 
> > LibClamAV Warning: **************************************************
> > LibClamAV Warning: ***  The virus database is older than 7 days!  ***
> > LibClamAV Warning: ***   Please update it as soon as possible.    ***
> > LibClamAV Warning: **************************************************
> > LibClamAV Warning: Corrupt TNEF header detected - length -1382561197
> > 
> > Googling wasn't much help with that warning, either.  The first part is
> > self- explanatory  when taken in conjunction with the logger error
> > quoted above. The only entry that seemed similar was
> > http://www.forum.psoft.net/archive/index.php/t-21360.html but that was in
> > 2007.
> 
> have you tried running freshclam by hand from the command line (as root
> btw)? Is the error message the same? If so, which file is named (if any)?
> 
The same file -

freshclam
ERROR: Can't open /var/log/clamav/freshclam.log in append mode (check 
permissions!).
ERROR: Problem with internal logger (UpdateLogFile = 
/var/log/clamav/freshclam.log).

Anne