clamd & freshclam signature counts now *match* after changing /etc/freshclam.conf setting to "CompressDatabase off" . Thank you! :D
> ----- Original Message ----- > From: "Noel Jones" <[EMAIL PROTECTED]> > To: "ClamAV users ML" <clamav-users@lists.clamav.net> > Subject: Re: [Clamav-users] Freshclam to ClamAV sig parity count mismatch > Date: Thu, 04 Sep 2008 14:23:49 -0500 > > > > ==> /var/log/clamav/clamd.log <== > > Thu Sep 4 11:29:48 2008 -> Socket file removed. > > Thu Sep 4 11:29:48 2008 -> Pid file removed. > > Thu Sep 4 11:29:48 2008 -> --- Stopped at Thu Sep 4 11:29:48 2008 > > Thu Sep 4 11:29:49 2008 -> +++ Started at Thu Sep 4 11:29:49 2008 > > Thu Sep 4 11:29:49 2008 -> clamd daemon 0.94 (OS: linux-gnu, > > ARCH: i386, CPU: i686) > > Thu Sep 4 11:29:49 2008 -> Running as user clamav (UID 977, GID 977) > > Thu Sep 4 11:29:49 2008 -> Log file size limit disabled. > > Thu Sep 4 11:29:49 2008 -> Reading databases from /var/lib/clamav > > Thu Sep 4 11:29:49 2008 -> Not loading PUA signatures. > > Thu Sep 4 11:29:51 2008 -> Loaded 312304 signatures. > > I get: > Sep 4 14:05:11 mgate2 clamd[34304]: clamd daemon 0.94 (OS: > freebsd5.3, ARCH: i386, CPU: i386) > Sep 4 14:05:11 mgate2 clamd[34304]: Not loading PUA signatures. > Sep 4 14:05:14 mgate2 clamd[34304]: Loaded 413475 signatures. > ... > Which looks reasonable. > > > ==> /var/log/clamav/freshclam.log <== > > Thu Sep 4 11:29:51 2008 -> -------------------------------------- > > Thu Sep 4 11:29:51 2008 -> freshclam daemon 0.94 (OS: linux-gnu, > > ARCH: i386, CPU: i686) > > Thu Sep 4 11:29:51 2008 -> ClamAV update process started at Thu > > Sep 4 11:29:51 2008 > > Thu Sep 4 11:29:51 2008 -> main.cvd is up to date (version: 47, > > sigs: 312304, f-level: 31, builder: sven) > > Thu Sep 4 11:29:51 2008 -> daily.cld is up to date (version: > > 8162, sigs: 101510, f-level: 35, builder: neo) > > Thu Sep 4 11:29:51 2008 -> -------------------------------------- > > Seems quite suspicious that your clamd is reporting the number > of signatures in main.cvd and seems to be ignoring daily.cld. > I didn't notice before that those numbers matched. > > Something (AppArmor or SELinux or similar?) interfering with > clamd accessing the daily.cld file? > > My only other (wild, unlikely) guess is that the > CompressDatabase is somehow interfering. See if it starts > working after the next daily update. > > The uncompressed file size here is currently: > -rw-r--r-- 1 vscan vscan 6168064 Sep 4 12:23 daily.cld > > Good luck, maybe someone else has more suggestions. > > -- > Noel Jones -- Be Yourself @ mail.com! Choose From 200+ Email Addresses Get a Free Account at www.mail.com _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://www.clamav.net/support/ml
