[clamav-users] Freshclam failing randomly

Al Varnell alvarnell at mac.com
Thu Dec 3 10:06:39 UTC 2015 

On Thu, Dec 03, 2015 at 02:03 AM, Hugo Deprez wrote:
> 
> Yes my servers are not looking for cdiff any more. That's fine for me.
> 
> I really don't understand why freshclam set my proxy to "Ignore : Yes".
> I think this is a bug.

No, it’s a feature.  I don’t know whether it happens with every failure or if it’s based on the ratio of successes to failures, but after some amount of time it resets itself to “No” again.

> Do you know where I can report this issue ?
> 
> Regards,
> 
> 
> 
> 
> 
> On 3 December 2015 at 10:36, Al Varnell <alvarnell at mac.com> wrote:
> 
>> On Thu, Dec 03, 2015 at 01:08 AM, Hugo Deprez wrote:
>>> 
>>> I changed the crontab on the server to run every hour.
>>> 
>>> 0 * * * * /root/clamdownloader.pl
>>> 
>>> Here is my freshclam configuration :
>>> 
>>> DatabaseDirectory /var/lib/clamav
>>> UpdateLogFile /var/log/clamav/freshclam.log
>>> LogFileMaxSize 0
>>> LogTime true
>>> LogSyslog no
>>> LogRotate true
>>> DatabaseOwner clamav
>>> AllowSupplementaryGroups false
>>> DatabaseMirror proxy
>>> MaxAttempts 5
>>> ScriptedUpdates no
>>> Checks 24
>>> Foreground false
>>> Debug true
>>> 
>>> I am not using DNS (DNSDatabaseInfo), as clients were looking for cdiff
>> not
>>> available on my server.
>> 
>> With "ScriptedUpdates no" it should never be looking for .cdiff files.
>> 
>>> I just want the client to download the available updates on the server.
>>> 
>>> I still get errors : ERROR: Can't download daily.cvd from proxy
>>> I don't understand as the daily.cvd is on the server, and there no access
>>> logs.
>>> 
>>> # freshclam  --list-mirrors
>>> Mirror #1
>>> IP: 192.168.1.8
>>> Successes: 1
>>> Failures: 1
>>> Last access: Thu Dec  3 09:57:24 2015
>>> Ignore: Yes
>> 
>> "Ignore: Yes" disables that mirror for a set period of time (I forget how
>> long).
>> 
>>> Any idea ?  I assume that if I delete the mirrors.dat file, freshclam
>> will
>>> work again, but there is no reason to do this  in my case.
>> 
>> Deleting mirrors.dat is what I have users do when they can’t reach any
>> server, so yes, you will need to do that.  I am not aware of any way to
>> configure freshclam to disable the Ignore routine.
>> 
>> With that, I’m out of ideas.
>> 
>> -Al-
>> 
>>> On 2 December 2015 at 11:23, Al Varnell wrote:
>>>> On Wed, Dec 02, 2015 at 02:16 AM, Hugo Deprez wrote:
>>>>> 
>>>>> Yes, this is one of issue I was thinking of.
>>>>> 
>>>>> clamdownloader.pl is running every 5 minutes. I didn't found any
>>>>> information on how many updates there is per day.
>>>> 
>>>> There have been 26 updates in the last 7 days, which is slightly higher
>>>> than usual.
>>>> 
>>>>> Freshclam is set to Checks 24
>>>>> 
>>>>> What would you recommend ?
>>>> 
>>>> From the Troubleshooting FAQ:
>>>> 
>>>>>> If you are running ClamAV 0.8x or later, you can check for database
>>>>>> update as often as 4 times per hour provided that you have the
>> following
>>>>>> options in freshclam.conf: DNSDatabaseInfo current.cvd.clamav.net
>>>>>> DatabaseMirror db.XY.clamav.net DatabaseMirror database.clamav.net
>>>>>> Replace XY with your “country code”:iana. If you don’t have that
>> option,
>>>>>> then you must stick with 1 check per hour.
>>>>>> 
>>>> -Al-
>>>> 
>>>>> On 2 December 2015 at 10:19, Al Varnell wrote:
>>>>>> Perhaps your clients are trying to update at the same time your local
>>>>>> mirror is updating?  How often do you update the local mirror?
>>>>>> 
>>>>>> -Al-
>>>>>> 
>>>>>> On Wed, Dec 02, 2015 at 01:01 AM, Hugo Deprez wrote:
>>>>>>> 
>>>>>>> I configured a local mirror using clamdownloader.pl provided on your
>>>>>>> website.
>>>>>>> The script seems to be working fine. But clients randmly fails with
>>>>>>> errors
>>>>>>> such as :
>>>>>>> 
>>>>>>> Tue Dec  1 17:54:28 2015 -> Received signal: wake up
>>>>>>> Tue Dec  1 17:54:28 2015 -> ClamAV update process started at Tue
>> Dec  1
>>>>>>> 17:54:28 2015
>>>>>>> Tue Dec  1 17:54:28 2015 -> main.cvd is up to date (version: 55,
>> sigs:
>>>>>>> 2424225, f-level: 60, builder: neo)
>>>>>>> Tue Dec  1 17:54:28 2015 -> Downloading daily.cvd [100%]
>>>>>>> Tue Dec  1 17:54:29 2015 -> WARNING: Mirror 192.168.6.8 is not
>>>>>>> synchronized.
>>>>>>> Tue Dec  1 17:54:29 2015 -> Trying again in 5 secs...
>>>>>>> Tue Dec  1 17:54:34 2015 -> ClamAV update process started at Tue
>> Dec  1
>>>>>>> 17:54:34 2015
>>>>>>> Tue Dec  1 17:54:34 2015 -> main.cvd is up to date (version: 55,
>> sigs:
>>>>>>> 2424225, f-level: 60, builder: neo)
>>>>>>> Tue Dec  1 17:54:34 2015 -> WARNING: Can't download daily.cvd from
>>>>>>> mirror
>>>>>>> Tue Dec  1 17:54:34 2015 -> Trying again in 5 secs...
>>>>>>> Tue Dec  1 17:54:39 2015 -> ClamAV update process started at Tue
>> Dec  1
>>>>>>> 17:54:39 2015
>>>>>>> Tue Dec  1 17:54:39 2015 -> main.cvd is up to date (version: 55,
>> sigs:
>>>>>>> 2424225, f-level: 60, builder: neo)
>>>>>>> Tue Dec  1 17:54:39 2015 -> WARNING: Can't download daily.cvd from
>>>>>>> mirror
>>>>>>> Tue Dec  1 17:54:39 2015 -> Trying again in 5 secs...
>>>>>>> Tue Dec  1 17:54:44 2015 -> ClamAV update process started at Tue
>> Dec  1
>>>>>>> 17:54:44 2015
>>>>>>> Tue Dec  1 17:54:44 2015 -> main.cvd is up to date (version: 55,
>> sigs:
>>>>>>> 2424225, f-level: 60, builder: neo)
>>>>>>> Tue Dec  1 17:54:44 2015 -> WARNING: Can't download daily.cvd from
>>>>>>> mirror
>>>>>>> Tue Dec  1 17:54:44 2015 -> Trying again in 5 secs...
>>>>>>> Tue Dec  1 17:54:49 2015 -> ClamAV update process started at Tue
>> Dec  1
>>>>>>> 17:54:49 2015
>>>>>>> Tue Dec  1 17:54:49 2015 -> main.cvd is up to date (version: 55,
>> sigs:
>>>>>>> 2424225, f-level: 60, builder: neo)
>>>>>>> Tue Dec  1 17:54:49 2015 -> ERROR: Can't download daily.cvd from
>> mirror
>>>>>>> Tue Dec  1 17:54:49 2015 -> Giving up on mirror...
>>>>>>> Tue Dec  1 17:54:49 2015 -> Update failed. Your network may be down
>> or
>>>>>>> none
>>>>>>> of the mirrors listed in /etc/clamav/freshclam.conf is working. Check
>>>>>>> http://www.clamav.net/doc/mirrors-faq.html for possible reasons.
>>>>>>> 
>>>>>>> 
>>>>>>> This happen randomly on all servers. I read the FAQ about those
>>>>>>> messages,
>>>>>>> but it didn't helped me to solve the issue.
>>>>>>> 
>>>>>>> Do you have any information about this ?
>> 
>> _______________________________________________
>> Help us build a comprehensive ClamAV guide:
>> https://github.com/vrtadmin/clamav-faq
>> 
>> http://www.clamav.net/contact.html#ml
>> 
> _______________________________________________
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
> 
> http://www.clamav.net/contact.html#ml

-Al-
-- 
Al Varnell
Mountain View, CA




-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 2366 bytes
Desc: not available
URL: <https://lists.clamav.net/pipermail/clamav-users/attachments/20151203/8c98f042/attachment.bin>

More information about the clamav-users mailing list