On Monday 21 November 2011 19:27:56 Anne Wilson wrote:
Am 21.11.2011 20:09, schrieb Anne Wilson:
> On Monday 21 November 2011 18:39:05 Anne Wilson wrote:
>> Am 21.11.2011 19:32, schrieb Anne Wilson:
>>> On my server, running CentOS 6, I've started getting messages like
>>>
>>> No updates detected in the log for the freshclam daemon (the
>>> ClamAV update process). If the freshclam daemon is not running,
>>> you may need to restart it. Other options:
>>> etc...
>>>
>>> and
>>>
>>> /etc/cron.daily/freshclam:
>>>
>>> ERROR: Problem with internal logger (UpdateLogFile =
>>> /var/log/clamav/freshclam.log).
>>> ERROR: Can't open /var/log/clamav/freshclam.log in append mode (check
>>> permissions!).
>>>
>>> This began after an update, and I've changed nothing in the configs.
>>> Freshclam ran without problems before the update, but I'm struggling to
>>> sort this out.
>>>
>>> First, then, can you tell me what permissions freshclam.log should
>>> have? Currently it is owned clamav:clamav with rw access for clamav.
>>> I read that freshclam is launched by root, but then drops to an
>>> unprivileged user - is clamav that user?
>>>
>>> What other checks should I be making?
>>
>> Hallo Anne
>>
>> have you checked the ACLs for the named files as well? what does the
>> directory permission say? Is there another process blocking/locking the
>> logfile (check with lsof)?
>
> Which files, Martin?
Sorry I was not precise: check ACL of the log files.
You mean
ls -l /var/log/clamav/freshclam.log
-rw-r--r--+ 1 clamav clamav 0 Nov 13 03:34 /var/log/clamav/freshclam.log
?
> Clamscan runs, but the database is not getting updated because
it can't
> access the log file (seems a bad decision to me). The only other clue
> that I have is
>
> LibClamAV Warning: **************************************************
> LibClamAV Warning: *** The virus database is older than 7 days! ***
> LibClamAV Warning: *** Please update it as soon as possible. ***
> LibClamAV Warning: **************************************************
> LibClamAV Warning: Corrupt TNEF header detected - length -1382561197
>
> Googling wasn't much help with that warning, either. The first part is
> self- explanatory when taken in conjunction with the logger error
> quoted above. The only entry that seemed similar was
>
http://www.forum.psoft.net/archive/index.php/t-21360.html but that was in
> 2007.
have you tried running freshclam by hand from the command line (as root
btw)? Is the error message the same? If so, which file is named (if any)?
The same file -
freshclam
ERROR: Can't open /var/log/clamav/freshclam.log in append mode (check
permissions!).
ERROR: Problem with internal logger (UpdateLogFile =
/var/log/clamav/freshclam.log).
Anne