Chris wrote:
On Wednesday 06 December 2006 8:30 pm, Dennis Peterson wrote:
Hmm, maybe I jumped the gun, after sending the message I saw another
instance of the above so thought I'd try restarting clamd, I did a
#service clamd stop and it 'failed', service clamd start was 'ok' so
possibly it had shut itself down somehow? I've never seen that happen
before.
What do your logs for clamd and freshclam say?
AhHa, this looks suspicious:
Wed Dec 6 08:21:28 2006 -> SelfCheck: Database modification detected. Forcing
reload.
Wed Dec 6 08:21:28 2006 -> Reading databases from /var/lib/clamav
Wed Dec 6 08:21:28 2006 -> Accepted connection on port 2003, fd 12
Wed Dec 6 08:21:31 2006 -> ERROR: reload db failed: Malformed database
And the next entry is where I restarted clamd
Wed Dec 6 20:20:31 2006 -> +++ Started at Wed Dec 6 20:20:31 2006
So it was down for about 12hrs. Freshclam log shows:
ClamAV update process started at Wed Dec 6 08:50:47 2006
main.cvd is up to date (version: 41, sigs: 73809, f-level: 10, builder: tkojm)
daily.cvd updated (version: 2293, sigs: 6226, f-level: 9, builder: arnaud)
Database updated (80035 signatures) from db.us.clamav.net (IP: 64.142.100.50)
ERROR: Clamd was NOT notified: Can't connect to clamd on 127.0.0.1:3310
This appears to have been the culpert
Cron <[EMAIL PROTECTED]> /usr/local/bin/SCAM.pl
Date: Wed Dec 6 08:10:00 2006
From: Cron Daemon <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
/var/lib/clamav/scam.ndb.gz 200
gunzip: /var/lib/clamav/scam.ndb.gz: unexpected end of file
This happens all the time - it's a broken gzip file and is not a big
deal. It happens all the time and the error is harmless.
Guess I should have checked the logs first.
You should have checked the logs, for sure, but the problem seems to
have been this:
> Wed Dec 6 08:21:31 2006 -> ERROR: reload db failed: Malformed database
You're not alone. See Bill Landry's post, too. Same time frame, same error.
dp
_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://lurker.clamav.net/list/clamav-users.html
