[clamav-users] failed to write to

[ratatouille]

Hello!

"G.W. Haywood via clamav-users" <clamav-users at lists.clamav.net> schrieb am 07.12.19 um 16:13:52 Uhr:

> Hi there,
> 
> On Sat, 7 Dec 2019, ratatouille via clamav-users wrote:
> 
> > Since the recent update of clamav I have the following problem when freshclam
> > automatically tries to update the db.
> >
> > Dec  7 11:20:43 bitmachine1 freshclam[783]: Unexpected error when attempting to update database: daily
> > Dec  7 11:20:43 bitmachine1 freshclam[783]: fc_update_databases: fc_update_database failed: Failed to read/write file to database directory (10)
> > Dec  7 11:20:43 bitmachine1 freshclam[783]: Database update process failed: Failed to read/write file to database directory (10)
> >
> > # ls -al
> > drwxr-xr-x 2 vscan vscan      4096  7. Dez 12:44 .
> > drwxr-xr-x 6 root  root       4096 22. Jan 2019  ..
> > -rw-r--r-- 1 vscan vscan   1458176 19. Sep 19:58 bytecode.cld
> > -rw-r----- 1 vscan vscan 167019008  7. Dez 12:44 daily.cld
> > -rw-r--r-- 1 vscan vscan 307403264 25. Nov 22:31 main.cld
> > -rw------- 1 vscan vscan       896 25. Nov 21:08 mirrors.dat
> >
> > # ps aux |grep clam
> > vscan      783  0.0  0.0  91040   232 ?        Ss   Nov28   0:00 /usr/local/bin/freshclam -d
> > vscan     2091  0.0 39.3 1055172 808732 ?      Ssl  Nov28   2:18 /usr/local/sbin/clamd
> >
> > It fails to create the tmp-folder. No problem when I call freshclam
> > from a terminal.
> >
> > What is wrong and how can I fix this issue?  
> 
> It isn't easy to see what's wrong without more information.
> 
> You could tell freshclam to log verbosely, that might shed some light
> on the issue.
> 
> What version of ClamAV are you using?
> 
> How much disc space is available?  How much memory is in the machine?
> 
> Please post the freshclam configuration and the exact terminal command
> which you used.  I wonder if you are not using the same configuration
> for the freshclam daemon that you're using when you run freshclam from
> the terminal.  I suggest you stop the freshclam daemon, and restart it
> with the path to its configuration file specified explicitly on the
> command line.  You could also specify the path when you run freshclam
> from the command line, to be sure it's the same.
> 
> The database read timeout in the freshclam configuration supplied with
> recent releases is I believe 60 seconds.  This is not long enough in
> many cases, I recommend increasing it to something like 600 seconds,
> although this is probably not the issue you're facing here.

The system is up since 101 days. I don't remember if I restarted freshclam
since I upgraded (configure&make&make install) clamav a few days ago.

The process is running as user vscan. It makes no difference if I call freshclam
without parameter or as freshclam --config-file=/usr/local/etc/freshclam.conf

I enabled verbose logging.

Received signal: wake up
ClamAV update process started at Sat Dec  7 19:06:15 2019
Current working dir is /usr/local/share/clamav/
Querying current.cvd.clamav.net
TTL: 1800
fc_dns_query_update_info: Software version from DNS: 0.102.1
Current working dir is /usr/local/share/clamav/
check_for_new_database_version: Local copy of daily found: daily.cld.
query_remote_database_version: daily.cvd version from DNS: 25656
daily.cld database is up to date (version: 25656, sigs: 2034796, f-level: 63, builder: raynman)
fc_update_database: daily.cld already up-to-date.
Current working dir is /usr/local/share/clamav/
check_for_new_database_version: Local copy of main found: main.cld.
query_remote_database_version: main.cvd version from DNS: 59
main.cld database is up to date (version: 59, sigs: 4564902, f-level: 60, builder: sigmgr)
fc_update_database: main.cld already up-to-date.
Current working dir is /usr/local/share/clamav/
check_for_new_database_version: Local copy of bytecode found: bytecode.cld.
query_remote_database_version: bytecode.cvd version from DNS: 331
bytecode.cld database is up to date (version: 331, sigs: 94, f-level: 63, builder: anvilleg)
fc_update_database: bytecode.cld already up-to-date.

This is the freshclam.conf without comments. There is only one freshclam.conf on
the system.

UpdateLogFile /var/log/freshclam.log
LogVerbose yes
LogSyslog yes
LogFacility LOG_MAIL
PidFile /var/lib/clamav/freshclam.pid
DatabaseOwner vscan
DatabaseMirror database.clamav.net
Checks 48
NotifyClamd /usr/local/etc/clamd.conf
Bytecode yes

I looked at /etc/systemd/system/multi-user.target.wants/freshclam.service
and found that User=vscan Group=vscan where commented.

I commented them out and it looks like this now:

[Unit]
Description=Freshclam virus definitions downloader
After=syslog.target network.target

[Service]
Type=forking
ExecStart=/usr/local/bin/freshclam -d
User=vscan
Group=vscan
;PrivateTmp=yes

[Install]
WantedBy=multi-user.target

I don't know if this solved the problem but for now it's gone. I'll keep track
on this and report back if it occurs still.

Thank you for your time!

  Andreas