On Monday 21 November 2011 18:39:05 Anne Wilson wrote:
Am 21.11.2011 19:32, schrieb Anne Wilson:
> On my server, running CentOS 6, I've started getting messages like
>
> No updates detected in the log for the freshclam daemon (the
> ClamAV update process). If the freshclam daemon is not running,
> you may need to restart it. Other options:
> etc...
>
> and
>
> /etc/cron.daily/freshclam:
>
> ERROR: Problem with internal logger (UpdateLogFile =
> /var/log/clamav/freshclam.log).
> ERROR: Can't open /var/log/clamav/freshclam.log in append mode (check
> permissions!).
>
> This began after an update, and I've changed nothing in the configs.
> Freshclam ran without problems before the update, but I'm struggling to
> sort this out.
>
> First, then, can you tell me what permissions freshclam.log should have?
> Currently it is owned clamav:clamav with rw access for clamav. I read
> that freshclam is launched by root, but then drops to an unprivileged
> user - is clamav that user?
>
> What other checks should I be making?
Hallo Anne
have you checked the ACLs for the named files as well? what does the
directory permission say? Is there another process blocking/locking the
logfile (check with lsof)?
Which files, Martin?
Clamscan runs, but the database is not getting updated because it can't access
the log file (seems a bad decision to me). The only other clue that I have is
LibClamAV Warning: **************************************************
LibClamAV Warning: *** The virus database is older than 7 days! ***
LibClamAV Warning: *** Please update it as soon as possible. ***
LibClamAV Warning: **************************************************
LibClamAV Warning: Corrupt TNEF header detected - length -1382561197
Googling wasn't much help with that warning, either. The first part is self-
explanatory when taken in conjunction with the logger error quoted above.
The only entry that seemed similar was
http://www.forum.psoft.net/archive/index.php/t-21360.html but that was in
2007.
Anne