[clamav-users] problems with freshclam: Incremental update failed

Thu Jul 15 15:30:12 UTC 2021

Christian,

The below is correct.  We published a new main.cvd and daily.cvd yesterday, and in order to make your FreshClam instance force download the new files, we have to publish a “blank” file, so that FreshClam sees it as an error, and then fails over to pick up the full file.  From that point on, it downloads the diffs again regularly.

-- 
Joel Esler
Manager, Communities Division
Cisco Talos Intelligence Group
https://www.talosintelligence.com | https://www.snort.org | https://www.clamav.net 

> On Jul 15, 2021, at 10:28 AM, Christian <abelschreck3 at freenet.de> wrote:
> 
> Hi altogether,
> 
> I´m on Linux/Lubuntu 20.04.2 LTS (kernel 5.4.0-77-generic)
> 
> Clamav and clamav-freshclam are installed and everything was working perfectly - until today.
> 
> All of a sudden a huge download began. It turned out freshclam was downloading something.
> It almost seemed never-ending. I terminated the download process as a UMTS-stick is my sole means of internet connection and I only have 5 GB per 28 days available.
> 
> After "killall freshclam" I invoked "sudo freshclam" manually to see what was going on:
> Here´s the output:
> 
> sudo freshclam
> WARNING: Ignoring deprecated option SafeBrowsing at /etc/clamav/freshclam.conf:22
> Thu Jul 15 14:42:25 2021 -> ClamAV update process started at Thu Jul 15 14:42:25 2021
> Thu Jul 15 14:42:25 2021 -> ^Your ClamAV installation is OUTDATED!
> Thu Jul 15 14:42:25 2021 -> ^Local version: 0.103.2 Recommended version: 0.103.3
> Thu Jul 15 14:42:25 2021 -> DON'T PANIC! Read https://www.clamav.net/documents/upgrading-clamav <https://www.clamav.net/documents/upgrading-clamav>
> Thu Jul 15 14:42:25 2021 -> daily database available for update (local version: 26231, remote version: 26233)
> Current database is 2 versions behind.
> Downloading database patch # 26232...
> Thu Jul 15 14:42:47 2021 -> !cdiff_apply: lseek(desc, -350, SEEK_END) failed
> Thu Jul 15 14:42:47 2021 -> !downloadPatch: Can't apply patch
> Thu Jul 15 14:42:47 2021 -> ^Incremental update failed, trying to download daily.cvd
> Time:  3m 44s, ETA:    0.0s [========================>]   54.73MiB/54.73MiB
> Thu Jul 15 14:46:33 2021 -> Testing database: '/var/lib/clamav/tmp.1e4892cb22/clamav-a8cd157a79b0b4419069cca1a5279096.tmp-daily.cvd' ...
> Thu Jul 15 14:46:40 2021 -> Database test passed.
> Thu Jul 15 14:46:40 2021 -> daily.cvd updated (version: 26233, sigs: 1961297, f-level: 90, builder: raynman)
> Thu Jul 15 14:46:40 2021 -> main database available for update (local version: 59, remote version: 61)
> Current database is 2 versions behind.
> Downloading database patch # 60...
> Thu Jul 15 14:46:50 2021 -> !cdiff_apply: lseek(desc, -350, SEEK_END) failed
> Thu Jul 15 14:46:50 2021 -> !downloadPatch: Can't apply patch
> Thu Jul 15 14:46:50 2021 -> ^Incremental update failed, trying to download main.cvd
> Time: 11m 42s, ETA:    0.0s [========================>]  160.41MiB/160.41MiB
> Thu Jul 15 14:58:36 2021 -> Testing database: '/var/lib/clamav/tmp.1e4892cb22/clamav-6ec7f609a7ab14c45568796eeb326bda.tmp-main.cvd' ...
> Thu Jul 15 14:58:45 2021 -> Database test passed.
> Thu Jul 15 14:58:45 2021 -> main.cvd updated (version: 61, sigs: 6607162, f-level: 90, builder: sigmgr)
> Thu Jul 15 14:58:45 2021 -> bytecode.cld database is up-to-date (version: 333, sigs: 92, f-level: 63, builder: awillia2)
> Thu Jul 15 14:58:45 2021 -> !NotifyClamd: Can't find or parse configuration file /etc/clamav/clamd.conf
> 
> So basically I received new files: "daily.cvd" and "main.cvd",  which cost me around 55 MB and 160 MB respectively.
> 
> But what I don´t understand is why I get the messages
> 
>  "!cdiff_apply: lseek(desc, -350, SEEK_END) failed" 
>  
> and the resulting
> 
> "!downloadPatch: Can't apply patch"
> 
> in the first place.
> 
> I never had difficulties with freshclam in the past.
> I surely cannot afford to have the whole of "daily.cvd" and "main.cvd" downloaded every time.
> 
> Can anybody tell me why all that is and what can be done about it?
> 
> Many thanks in advance.
> 
> Greetings from Rosika
> 
> 
> _______________________________________________
> 
> clamav-users mailing list
> clamav-users at lists.clamav.net
> https://lists.clamav.net/mailman/listinfo/clamav-users
> 
> 
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
> 
> http://www.clamav.net/contact.html#ml

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.clamav.net/pipermail/clamav-users/attachments/20210715/6502bea0/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3010 bytes
Desc: not available
URL: <https://lists.clamav.net/pipermail/clamav-users/attachments/20210715/6502bea0/attachment.bin>