[clamav-users] local server takes time to update clamav db

[Andrew C Aitchison]

Date: Thu, 10 Dec 2020 14:07:08 +0000 (GMT)
From: Andrew C Aitchison <andrew at aitchison.me.uk>
To: clamav-users at lists.clamav.net
Cc: "Joel Esler (jesler)" <jesler at cisco.com>
Subject: Re: [clamav-users] local server takes time to update clamav db

On Thu, 10 Dec 2020, Joel Esler (jesler) via clamav-users wrote:

>> On Dec 10, 2020, at 6:06 AM, G.W. Haywood via clamav-users 
>> <clamav-users at lists.clamav.net> wrote:
>> 
>> Hi there,
>> 
>> On Wed, 9 Dec 2020, Micah Snyder (micasnyd) via clamav-users wrote:
>> 
>>> This message:
>>> â??*The daily.cvd database downloaded from https://database.clamav.net
>>> is one version older than advertised in the DNS TXT record.â??
>>> is a verbose-level message from freshclam but is not an error to
>>> worry about.  It indicates a known issue with CloudFlare caching
>>> that our team has been unable to resolve.  You can safely ignore the
>>> message.  Update again in an hour or two and you should get the
>>> latest database.
>> 
>> But...but...I thought Joel said that this was fixed in February! [*]
>> 
>> Shouldn't this be documented?
>> 
>> At least in the error message itself, and preferably the manual and 
>> Bugzilla.
>> 
>> [*] https://marc.info/?l=clamav-announce&m=158092409813720&w=2
>> 
> 
> By â??unable to resolveâ?? Micah means: â??Thereâ??s nothing more we can do
> to solve the problemâ??.
> 
> When we generate a new cvd/cld, etc, we push it to our local
> mirrors.  We then force Cloudflare to fetch the files through
> purging the cache for the files updated, and then requesting them
> through cloudflare (which causes the CF PoP (Point of Presence) to
> fetch the file from our mirror). Then we update the TXT record in
> DNS.

Would you be able to request them from multiple cloudflare PoPs
before updating the DNS record ?
Not necessarily waiting for the update, but making the request.

> So, there are occasions where one PoP from Cloudflare is behind and
> hasnâ??t yet fetched the file from the other PoP or from our mirror
> directly.  This might be the case that youâ??re the first one thatâ??s
> asked for it from your PoP location in the world, or its just not
> caught up yet.  Waiting a bit ensures that the PoP will fetch the
> file, and when you try again, itâ??s there (as you can see).
> 
> I think the way to fix this is, freshclam, if it receives an â??Iâ??m
> behindâ?? error from the PoP, to do a sleep for awhile and then try
> again.  If the second attempt still fails then give the error to the
> user.

Would it be sensible for freshclam to update the file when a newer
version is available, even if it is not the newest ?

-- 
Andrew C. Aitchison					Kendal, UK
 			andrew at aitchison.me.uk