[clamav-users] can not download updates

Tue Jul 27 16:37:23 UTC 2021

‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐

On Tuesday, July 27th, 2021 at 10:46 AM, fxkl47BF via clamav-users <clamav-users at lists.clamav.net> wrote:

> ‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
>
> On Tuesday, July 27th, 2021 at 10:28 AM, Joel Esler (jesler) jesler at cisco.com wrote:
>
> > Maybe try raising your receivetimeout?  https://blog.clamav.net/2021/07/psa-freshclam-database-download-issue.html
>
> i changed the receivetimeout to 300 as described in the article
> i'll see what happens after the cool down ends

it made no difference

Tue Jul 27 11:34:03 2021 -> Received signal: wake up
Tue Jul 27 11:34:03 2021 -> ClamAV update process started at Tue Jul 27 11:34:03 2021
Tue Jul 27 11:34:03 2021 -> WARNING: Your ClamAV installation is OUTDATED!
Tue Jul 27 11:34:03 2021 -> WARNING: Local version: 0.103.2 Recommended version: 0.103.3
Tue Jul 27 11:34:03 2021 -> DON'T PANIC! Read https://www.clamav.net/documents/upgrading-clamav
Tue Jul 27 11:34:03 2021 -> WARNING: Cool-down expired, ok to try again.
Tue Jul 27 11:34:03 2021 -> daily database available for update (local version: 26231, remote version: 26245)
Tue Jul 27 11:34:05 2021 -> ERROR: cdiff_apply: lseek(desc, -350, SEEK_END) failed
Tue Jul 27 11:34:05 2021 -> ERROR: downloadPatch: Can't apply patch
Tue Jul 27 11:34:05 2021 -> WARNING: Incremental update failed, trying to download daily.cvd
Tue Jul 27 11:34:06 2021 -> WARNING: Can't download daily.cvd from https://database.clamav.net/daily.cvd
Tue Jul 27 11:34:06 2021 -> WARNING: FreshClam received error code 429 from the ClamAV Content Delivery Network (CDN).
Tue Jul 27 11:34:06 2021 -> This means that you have been rate limited by the CDN.
Tue Jul 27 11:34:06 2021 ->  1. Run FreshClam no more than once an hour to check for updates.
Tue Jul 27 11:34:06 2021 ->     FreshClam should check DNS first to see if an update is needed.
Tue Jul 27 11:34:06 2021 ->  2. If you have more than 10 hosts on your network attempting to download,
Tue Jul 27 11:34:06 2021 ->     it is recommended that you set up a private mirror on your network using
Tue Jul 27 11:34:06 2021 ->     cvdupdate (https://pypi.org/project/cvdupdate/) to save bandwidth on the
Tue Jul 27 11:34:06 2021 ->     CDN and your own network.
Tue Jul 27 11:34:06 2021 ->  3. Please do not open a ticket asking for an exemption from the rate limit,
Tue Jul 27 11:34:06 2021 ->     it will not be granted.
Tue Jul 27 11:34:06 2021 -> WARNING: You are on cool-down until after: 2021-07-27 15:34:06
Tue Jul 27 11:34:06 2021 -> main database available for update (local version: 59, remote version: 61)
Tue Jul 27 11:34:07 2021 -> ERROR: cdiff_apply: lseek(desc, -350, SEEK_END) failed
Tue Jul 27 11:34:07 2021 -> ERROR: downloadPatch: Can't apply patch
Tue Jul 27 11:34:07 2021 -> WARNING: Incremental update failed, trying to download main.cvd
Tue Jul 27 11:34:07 2021 -> WARNING: Can't download main.cvd from https://database.clamav.net/main.cvd
Tue Jul 27 11:34:07 2021 -> WARNING: FreshClam received error code 429 from the ClamAV Content Delivery Network (CDN).
Tue Jul 27 11:34:07 2021 -> This means that you have been rate limited by the CDN.
Tue Jul 27 11:34:07 2021 ->  1. Run FreshClam no more than once an hour to check for updates.
Tue Jul 27 11:34:07 2021 ->     FreshClam should check DNS first to see if an update is needed.
Tue Jul 27 11:34:07 2021 ->  2. If you have more than 10 hosts on your network attempting to download,
Tue Jul 27 11:34:07 2021 ->     it is recommended that you set up a private mirror on your network using
Tue Jul 27 11:34:07 2021 ->     cvdupdate (https://pypi.org/project/cvdupdate/) to save bandwidth on the
Tue Jul 27 11:34:07 2021 ->     CDN and your own network.
Tue Jul 27 11:34:07 2021 ->  3. Please do not open a ticket asking for an exemption from the rate limit,
Tue Jul 27 11:34:07 2021 ->     it will not be granted.
Tue Jul 27 11:34:07 2021 -> WARNING: You are on cool-down until after: 2021-07-27 15:34:07
Tue Jul 27 11:34:07 2021 -> bytecode.cld database is up-to-date (version: 333, sigs: 92, f-level: 63, builder: awillia2)
Tue Jul 27 11:34:07 2021 -> --------------------------------------

>
> > > On Jul 27, 2021, at 11:17 AM, fxkl47BF via clamav-users clamav-users at lists.clamav.net wrote:
> > >
> > > ‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
> > >
> > > On Tuesday, July 27th, 2021 at 9:43 AM, Joel Esler (jesler) jesler at cisco.com wrote:
> > >
> > > > > On Jul 27, 2021, at 10:34 AM, fxkl47BF via clamav-users clamav-users at lists.clamav.net wrote:
> > > > >
> > > > > ‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
> > > > >
> > > > > On Tuesday, July 27th, 2021 at 9:29 AM, Joel Esler (jesler) jesler at cisco.com wrote:
> > > > >
> > > > > > > On Jul 27, 2021, at 10:22 AM, fxkl47BF via clamav-users clamav-users at lists.clamav.net wrote:
> > > > > > >
> > > > > > > On Tuesday, July 27th, 2021 at 8:56 AM, Matus UHLAR - fantomas uhlar at fantomas.sk wrote:
> > > > > > >
> > > > > > > > On 27.07.21 12:47, fxkl47BF via clamav-users wrote:
> > > > > > > >
> > > > > > > > > for a couple of weeks i've not been able to download updates. i get a
> > > > > > > > >
> > > > > > > > > message about on a cool down until a certain future date and time. when
> > > > > > > > >
> > > > > > > > > that date and time expires the next update get a message with a new future
> > > > > > > > >
> > > > > > > > > date and time. should i abandon all hope of getting updates?
> > > > > > > >
> > > > > > > > it's described here:
> > > > > > > >
> > > > > > > > https://lists.clamav.net/pipermail/clamav-users/2021-March/010544.html
> > > > > > > >
> > > > > > > > do you have multiple devices behind one IP address?
> > > > > > > >
> > > > > > > > Do any of those devices download clamav database diferently then using
> > > > > > > >
> > > > > > > > freshclam?
> > > > > > >
> > > > > > > i have one device that uses freshclam once per hour
> > > > > > >
> > > > > > > i am using a vpn
> > > > > > >
> > > > > > > it looks like anyone that uses a vpn is probably screwed
> > > > > > >
> > > > > > > it was good while it lasted
> > > > > >
> > > > > > What is your public IP?
> > > > >
> > > > > 199.229.250.132
> > > >
> > > > You’re rate limited because you have one machine behind that IP that has attempted to download the daily.cvd 50x in the last 24 hours, and the main.cvd another 50x. Let alone the latest cdiff that it’s attempted to download 80x.
> > > >
> > > > It’s not more than one machine, it’s a single machine.
> > >
> > > maybe i don't fully understand how this vpn works
> > >
> > > i understood that this would be the ip address for anyone using this exit point
> > >
> > > i have two machines
> > >
> > > one is my work machine and has clamav
> > >
> > > the other runs a cnc mill that hasn't been on for several days
> > >
> > > i can send my whole freshclam log if it helps
> > >
> > > maybe something needs to be changed in my config
> > >
> > > this is /etc/clamav/freshclam.conf
> > >
> > > Automatically created by the clamav-freshclam postinst
> > > ======================================================
> > >
> > > Comments will get lost when you reconfigure the clamav-freshclam package
> > > ========================================================================
> > >
> > > DatabaseOwner clamav
> > >
> > > UpdateLogFile /var/log/clamav/freshclam.log
> > >
> > > LogVerbose false
> > >
> > > LogSyslog false
> > >
> > > LogFacility LOG_LOCAL6
> > >
> > > LogFileMaxSize 0
> > >
> > > LogRotate true
> > >
> > > LogTime true
> > >
> > > Foreground false
> > >
> > > Debug false
> > >
> > > MaxAttempts 5
> > >
> > > DatabaseDirectory /var/lib/clamav
> > >
> > > DNSDatabaseInfocurrent.cvd.clamav.net
> > >
> > > ConnectTimeout 30
> > >
> > > ReceiveTimeout 30
> > >
> > > TestDatabases yes
> > >
> > > ScriptedUpdates yes
> > >
> > > CompressLocalDatabase no
> > >
> > > Bytecode true
> > >
> > > NotifyClamd /etc/clamav/clamd.conf
> > >
> > > Check for new database 24 times a day
> > > =====================================
> > >
> > > Checks 24
> > >
> > > DatabaseMirrordb.local.clamav.net
> > >
> > > DatabaseMirrordatabase.clamav.net
> > >
> > > clamav-users mailing list
> > >
> > > clamav-users at lists.clamav.net
> > >
> > > https://lists.clamav.net/mailman/listinfo/clamav-users
> > >
> > > Help us build a comprehensive ClamAV guide:
> > >
> > > https://github.com/vrtadmin/clamav-faq
> > >
> > > http://www.clamav.net/contact.html#ml
>
> clamav-users mailing list
>
> clamav-users at lists.clamav.net
>
> https://lists.clamav.net/mailman/listinfo/clamav-users
>
> Help us build a comprehensive ClamAV guide:
>
> https://github.com/vrtadmin/clamav-faq
>
> http://www.clamav.net/contact.html#ml