On Wed, Jan 17, 2007 at 08:49:14AM -0500, Edward Dam said:
> On 1/2/07, Ian Abbott <[EMAIL PROTECTED]> wrote:
> >On 20/12/06 16:49, Edward Dam wrote:
> >> On 12/13/06, Ian Abbott <[EMAIL PROTECTED]> wrote:
> >>>
> >>> #if 0 /* original */
> >>> logg("SelfCheck: Database status OK.\n");
> >>> return NULL;
> >>> #else /* temporary test */
> >>> logg("SelfCheck: Database status OK. Reloading anyway.\n");
> >>> return root;
> >>> #endif
> >>>
> >>> This will force the self-check to reload the database files even if
> >>> nothing has changed. Then if you get MD5 errors randomly after this
> >>> message in the logs, you'll know it has nothing to do with freshclam,
> >>> and more to do with random disk read/write errors.
> >>
> >> I've done this code change, and the mail system just died.
> >> Here's the relevant clip from the clamd log:
> >>
> >> Wed Dec 20 09:53:33 2006 -> SelfCheck: Database status OK. Reloading
> >> anyway.
> >> Wed Dec 20 09:53:33 2006 -> Reading databases from /var/clamav
> >> Wed Dec 20 09:53:33 2006 -> ERROR: reload db failed: MD5 verification error
> >
> >Sorry for the tardiness of this reply! Those logs appear to be
> >generated as a result of clamd's scheduled self-check, as no changes to
> >the timestamps of the database files were detected (that would result in
> >"SelfCheck: Database modification detected. Forcing reload.").
> >
> >However, there is a small possibility that freshclam could be updating
> >the database files during clamd's scheduled self-check in such a way
> >that clamd does not notice that the timestamps have changed, but due to
> >the code change is reloading the (possibly modified) database files
> >anyway. To rule out this possibility, it would be necessary to look at
> >the freshclam logs to see when it last notified clamd about the updated
> >files.Unlikely - freshclam writes to a temp file, and verifies that before doing anything to the main file. The OP can verify by correlating timestamps of freshclam download attempts with the last crash on Dec 20th, however. So, OP - can you supply logfiles for both clamd and freshclam around the times of the crash? It really looks to me like freshclam is verifying the md5 signature, and immediately after, clamd is failing to do so. Very, very odd. -- -------------------------------------------------------------------------- | Stephen Gran | Nothing is so often irretrievably | | [EMAIL PROTECTED] | missed as a daily opportunity. -- | | http://www.lobefin.net/~steve | Ebner-Eschenbach | --------------------------------------------------------------------------
signature.asc
Description: Digital signature
_______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://lurker.clamav.net/list/clamav-users.html
