[clamav-users] Help, we are still seeing issues

[Robert M. Stockmann]

On Sat, 17 Apr 2021, Joel Esler (jesler) via clamav-users wrote:

> Date: Sat, 17 Apr 2021 18:58:04 +0000
> From: "Joel Esler (jesler) via clamav-users"
>     <clamav-users at lists.clamav.net>
> To: "Joel Esler (jesler) via clamav-users" <ClamAV-users at lists.clamav.net>
> Cc: "Joel Esler (jesler)" <jesler at cisco.com>
> Subject: [clamav-users] Help, we are still seeing issues
> 
> Please take a few moments to check your ClamAV freshclam installations.  Are you removing your mirrors.dat file after every run of Freshclam or cvdupdate?
> 
> We are seeing a few IPs, who have upgraded to 103.2 still downloading the entire daily.cvd and main.cvd every update.  I am thinking this is because the installation has a script that is deleting the mirrors.dat file, or has the “OnErrorExecute” command in the Freshclam.conf file set to delete this file, or freshclam can’t write the file in the first place (which shouldn’t be possible).
> 
> Please double check your installations?  You may need even go so far as to create a new freshclam.conf file.
> 
> If your downloads were working and now you are getting 403’s from Cloudflare and you’re on 103.2, the above situation may be the reason.  Please double check the situation and feel free to write me back.  We’ve seen about 34,000 downloads of the main and daily in the past 24 hours from these couple of IPs.
> 
> I can tell the difference between a properly functioning copy of freshclam and not, very easily by looking at the files being downloaded.  If an installation grabs the cvd and then grabs the cdiffs the next day, it’s properly functioning.
> 
> But downloading the entire daily and main every 5 minutes or so indicates to me that something is broken.
> 

Here's the freshclam virus data files which were first downloaded when
i upgraded to 0.103.2 :

   [hubble:stock]:(/var/lib/clamav)$ ll 
   total 429572
   -rw-r--r--  1 clamav clamav    293670 Apr  8 02:37 bytecode.cvd
   -rw-r--r--  1 clamav clamav 321713152 Apr 17 14:07 daily.cld
   -rw-r--r--  1 clamav clamav 117859675 Apr  8 02:37 main.cvd
   -rw-r--r--  1 clamav clamav        69 Apr  8 02:36 mirrors.dat
   [hubble:stock]:(/var/lib/clamav)$ clamdscan --version
   ClamAV 0.103.2/26143/Sat Apr 17 13:06:39 2021
   [hubble:stock]:(/var/lib/clamav)$ 

As you can see, the daily.cld is from today, Apr 17, and the others
were downloaded on the day of upgrade. However one would expect the
daily.cvd to be the smallest file, instead its the biggest
with 307M in size. 


-- 
Robert M. Stockmann - RHCE
Network Engineer - UNIX/Linux Specialist
crashrecovery.org  stock at stokkie.net