Tomasz Kojm wrote:
On Wed, 6 Dec 2006 21:27:27 -0600
Chris <[EMAIL PROTECTED]> wrote:
AhHa, this looks suspicious:
Wed Dec 6 08:21:28 2006 -> SelfCheck: Database modification detected.
Forcing reload.
Wed Dec 6 08:21:28 2006 -> Reading databases from /var/lib/clamav
Wed Dec 6 08:21:28 2006 -> Accepted connection on port 2003, fd 12
Wed Dec 6 08:21:31 2006 -> ERROR: reload db failed: Malformed database
[...]
This appears to have been the culpert
gunzip: /var/lib/clamav/scam.ndb.gz: unexpected end of file
You should be more careful with what you're downloading into the database
directory. For the official database freshclam makes a number of tests to
prevent installing broken files. For 3rd party databases I'd suggest calling
'clamscan -d file.ndb' before installing file.ndb in the database dir and/or
asking the creator to provide you with online checksum for the file.
In hindsight my comment about it being harmless is only because I've
always dl'd the files to a safe place before committing them to the
daemon and is why I wouldn't have had a problem with Steve's file. It's
clearly not a universal practice but probably should be. The problem I
had that killed clamd some weeks ago had to do with structure errors in
the MSRBL file (too many fields in one record). I still don't know what
test I can do to prevent this in the future, but I do have a process in
place to alert me if clamd cannot be restarted by the watchdog.
dp
_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://lurker.clamav.net/list/clamav-users.html
