Freshclam problems

[Anne Wilson]

On Monday 21 November 2011 19:52:37 Anne Wilson wrote:
> Am 21.11.2011 20:45, schrieb Anne Wilson:
> > On Monday 21 November 2011 19:27:56 Anne Wilson wrote:
> >> Am 21.11.2011 20:09, schrieb Anne Wilson:
> >>> On Monday 21 November 2011 18:39:05 Anne Wilson wrote:
> >>>> Am 21.11.2011 19:32, schrieb Anne Wilson:
> >>>>> On my server, running CentOS 6, I've started getting messages like
> >>>>> 
> >>>>>  No updates detected in the log for the freshclam daemon (the
> >>>>>  ClamAV update process).  If the freshclam daemon is not running,
> >>>>>  you may need to restart it.  Other options:
> >>>>>  etc...
> >>>>> 
> >>>>> and
> >>>>> 
> >>>>> /etc/cron.daily/freshclam:
> >>>>> 
> >>>>> ERROR: Problem with internal logger (UpdateLogFile =
> >>>>> /var/log/clamav/freshclam.log).
> >>>>> ERROR: Can't open /var/log/clamav/freshclam.log in append mode (check
> >>>>> permissions!).
> >>>>> 
> >>>>> This began after an update, and I've changed nothing in the configs.
> >>>>> Freshclam ran without problems before the update, but I'm struggling
> >>>>> to sort this out.
> >>>>> 
> >>>>> First, then, can you tell me what permissions freshclam.log should
> >>>>> have? Currently it is owned clamav:clamav with rw access for clamav.
> >>>>> I read that freshclam is launched by root, but then drops to an
> >>>>> unprivileged user - is clamav that user?
> >>>>> 
> >>>>> What other checks should I be making?
> >>>> 
> >>>> Hallo Anne
> >>>> 
> >>>> have you checked the ACLs for the named files as well? what does the
> >>>> directory permission say? Is there another process blocking/locking
> >>>> the logfile (check with lsof)?
> >>> 
> >>> Which files, Martin?
> >> 
> >> Sorry I was not precise: check ACL of the log files.
> > 
> > You mean
> > 
> > ls -l  /var/log/clamav/freshclam.log
> > -rw-r--r--+ 1 clamav clamav 0 Nov 13 03:34 /var/log/clamav/freshclam.log
> > ?
> 
> Not entirely. Check ACL (getfacl or similar program). The + sign
> indicates that there is an aditional ACL set for this file. At least my
> log files does not have extra ACLs set.
> 
If this means what I think it means, it explains the problem - 

getfacl /var/log/clamav/freshclam.log
getfacl: Removing leading '/' from absolute path names
# file: var/log/clamav/freshclam.log
# owner: clamav
# group: clamav
user::rw-
user:anne:rwx                   #effective:r--
group::rw-                      #effective:r--
mask::r--
other::r--

> Try to remove the file as well (or move it to another place).
> 
If it's running as anne, is there any reason why the logfile can't be in anne's 
tree?

> and run 'lsof | grep freshclam' to see if any other program is locking
> the file.
> 
Nothing there.

Anne