[clamav-users] Freshclam failing randomly

[Al Varnell]

On Thu, Dec 03, 2015 at 01:08 AM, Hugo Deprez wrote:
> 
> I changed the crontab on the server to run every hour.
> 
> 0 * * * * /root/clamdownloader.pl
> 
> Here is my freshclam configuration :
> 
> DatabaseDirectory /var/lib/clamav
> UpdateLogFile /var/log/clamav/freshclam.log
> LogFileMaxSize 0
> LogTime true
> LogSyslog no
> LogRotate true
> DatabaseOwner clamav
> AllowSupplementaryGroups false
> DatabaseMirror proxy
> MaxAttempts 5
> ScriptedUpdates no
> Checks 24
> Foreground false
> Debug true
> 
> I am not using DNS (DNSDatabaseInfo), as clients were looking for cdiff not
> available on my server.

With "ScriptedUpdates no" it should never be looking for .cdiff files.

> I just want the client to download the available updates on the server.
> 
> I still get errors : ERROR: Can't download daily.cvd from proxy
> I don't understand as the daily.cvd is on the server, and there no access
> logs.
> 
> # freshclam  --list-mirrors
> Mirror #1
> IP: 192.168.1.8
> Successes: 1
> Failures: 1
> Last access: Thu Dec  3 09:57:24 2015
> Ignore: Yes

"Ignore: Yes" disables that mirror for a set period of time (I forget how long).

> Any idea ?  I assume that if I delete the mirrors.dat file, freshclam will
> work again, but there is no reason to do this  in my case.

Deleting mirrors.dat is what I have users do when they can’t reach any server, so yes, you will need to do that.  I am not aware of any way to configure freshclam to disable the Ignore routine.

With that, I’m out of ideas.

-Al-

> On 2 December 2015 at 11:23, Al Varnell wrote:
>> On Wed, Dec 02, 2015 at 02:16 AM, Hugo Deprez wrote:
>>> 
>>> Yes, this is one of issue I was thinking of.
>>> 
>>> clamdownloader.pl is running every 5 minutes. I didn't found any
>>> information on how many updates there is per day.
>> 
>> There have been 26 updates in the last 7 days, which is slightly higher
>> than usual.
>> 
>>> Freshclam is set to Checks 24
>>> 
>>> What would you recommend ?
>> 
>> From the Troubleshooting FAQ:
>> 
>>>> If you are running ClamAV 0.8x or later, you can check for database
>>>> update as often as 4 times per hour provided that you have the following
>>>> options in freshclam.conf: DNSDatabaseInfo current.cvd.clamav.net
>>>> DatabaseMirror db.XY.clamav.net DatabaseMirror database.clamav.net
>>>> Replace XY with your “country code”:iana. If you don’t have that option,
>>>> then you must stick with 1 check per hour.
>>>> 
>> -Al-
>> 
>>> On 2 December 2015 at 10:19, Al Varnell wrote:
>>>> Perhaps your clients are trying to update at the same time your local
>>>> mirror is updating?  How often do you update the local mirror?
>>>> 
>>>> -Al-
>>>> 
>>>> On Wed, Dec 02, 2015 at 01:01 AM, Hugo Deprez wrote:
>>>>> 
>>>>> I configured a local mirror using clamdownloader.pl provided on your
>>>>> website.
>>>>> The script seems to be working fine. But clients randmly fails with
>>>>> errors
>>>>> such as :
>>>>> 
>>>>> Tue Dec  1 17:54:28 2015 -> Received signal: wake up
>>>>> Tue Dec  1 17:54:28 2015 -> ClamAV update process started at Tue Dec  1
>>>>> 17:54:28 2015
>>>>> Tue Dec  1 17:54:28 2015 -> main.cvd is up to date (version: 55, sigs:
>>>>> 2424225, f-level: 60, builder: neo)
>>>>> Tue Dec  1 17:54:28 2015 -> Downloading daily.cvd [100%]
>>>>> Tue Dec  1 17:54:29 2015 -> WARNING: Mirror 192.168.6.8 is not
>>>>> synchronized.
>>>>> Tue Dec  1 17:54:29 2015 -> Trying again in 5 secs...
>>>>> Tue Dec  1 17:54:34 2015 -> ClamAV update process started at Tue Dec  1
>>>>> 17:54:34 2015
>>>>> Tue Dec  1 17:54:34 2015 -> main.cvd is up to date (version: 55, sigs:
>>>>> 2424225, f-level: 60, builder: neo)
>>>>> Tue Dec  1 17:54:34 2015 -> WARNING: Can't download daily.cvd from
>>>>> mirror
>>>>> Tue Dec  1 17:54:34 2015 -> Trying again in 5 secs...
>>>>> Tue Dec  1 17:54:39 2015 -> ClamAV update process started at Tue Dec  1
>>>>> 17:54:39 2015
>>>>> Tue Dec  1 17:54:39 2015 -> main.cvd is up to date (version: 55, sigs:
>>>>> 2424225, f-level: 60, builder: neo)
>>>>> Tue Dec  1 17:54:39 2015 -> WARNING: Can't download daily.cvd from
>>>>> mirror
>>>>> Tue Dec  1 17:54:39 2015 -> Trying again in 5 secs...
>>>>> Tue Dec  1 17:54:44 2015 -> ClamAV update process started at Tue Dec  1
>>>>> 17:54:44 2015
>>>>> Tue Dec  1 17:54:44 2015 -> main.cvd is up to date (version: 55, sigs:
>>>>> 2424225, f-level: 60, builder: neo)
>>>>> Tue Dec  1 17:54:44 2015 -> WARNING: Can't download daily.cvd from
>>>>> mirror
>>>>> Tue Dec  1 17:54:44 2015 -> Trying again in 5 secs...
>>>>> Tue Dec  1 17:54:49 2015 -> ClamAV update process started at Tue Dec  1
>>>>> 17:54:49 2015
>>>>> Tue Dec  1 17:54:49 2015 -> main.cvd is up to date (version: 55, sigs:
>>>>> 2424225, f-level: 60, builder: neo)
>>>>> Tue Dec  1 17:54:49 2015 -> ERROR: Can't download daily.cvd from mirror
>>>>> Tue Dec  1 17:54:49 2015 -> Giving up on mirror...
>>>>> Tue Dec  1 17:54:49 2015 -> Update failed. Your network may be down or
>>>>> none
>>>>> of the mirrors listed in /etc/clamav/freshclam.conf is working. Check
>>>>> http://www.clamav.net/doc/mirrors-faq.html for possible reasons.
>>>>> 
>>>>> 
>>>>> This happen randomly on all servers. I read the FAQ about those
>>>>> messages,
>>>>> but it didn't helped me to solve the issue.
>>>>> 
>>>>> Do you have any information about this ?
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 2366 bytes
Desc: not available
URL: <https://lists.clamav.net/pipermail/clamav-users/attachments/20151203/7d96815b/attachment.bin>