[Clamav-users] LibClamAV Warning
Hi , i am new with this soft , i have installed postfix+mailscanner+clamav on debian "sarge" server. I've installed ClamAV 0.91 from source, run freshclam and the virus database is updated. As you can see: serverna:~# clamscan -V ClamAV 0.91/955/Thu Jun 23 18:08:42 2005 serverna:~# freshclam -V ClamAV 0.91/955/Thu Jun 23 18:08:42 2005 The freshclam procces download ok the daily diff file But when i run clamscan just to test it on some test files: serverna:~# clamscan LibClamAV Warning: ** LibClamAV Warning: *** The virus database is older than 7 days. *** LibClamAV Warning: ***Please update it IMMEDIATELY! *** LibClamAV Warning: ** ... ... Why this message? How can i be sure that is working fine on the mails server? Thank you in advance and sorry for my english. Jose Julian Buda ___ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://lurker.clamav.net/list/clamav-users.html
[Clamav-users] LibClamAV Warning
Hi , i am new with this soft , i have installed postfix+mailscanner+clamav on debian "sarge" server. I've installed ClamAV 0.91 from source, run freshclam and the virus database is updated. As you can see: serverna:~# clamscan -V ClamAV 0.91/955/Thu Jun 23 18:08:42 2005 serverna:~# freshclam -V ClamAV 0.91/955/Thu Jun 23 18:08:42 2005 The freshclam procces download ok the daily diff file But when i run clamscan just to test it on some test files: serverna:~# clamscan LibClamAV Warning: ** LibClamAV Warning: *** The virus database is older than 7 days. *** LibClamAV Warning: ***Please update it IMMEDIATELY! *** LibClamAV Warning: ** ... ... Why this message? How can i be sure that is working fine on the mails server? Thank you in advance and sorry for my english. Jose Julian Buda ___ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://lurker.clamav.net/list/clamav-users.html
Re: [Clamav-users] LibClamAV Warning
> At 10:35 AM 7/12/2007, Jose Julian Buda wrote: >>Hi , i am new with this soft , i have installed >>postfix+mailscanner+clamav on debian "sarge" server. >> >>I've installed ClamAV 0.91 from source, run freshclam and the virus >>database is updated. >> >>As you can see: >> >>serverna:~# clamscan -V >>ClamAV 0.91/955/Thu Jun 23 18:08:42 2005 >>serverna:~# freshclam -V >>ClamAV 0.91/955/Thu Jun 23 18:08:42 2005 > > The above show database version "955" dated "18:08:42 2005" - two > years old. Updates aren't working, despite what you say. > >>The freshclam procces download ok the daily diff file >>But when i run clamscan just to test it on some test files: >> >>serverna:~# clamscan >>LibClamAV Warning: ** >>LibClamAV Warning: *** The virus database is older than 7 days. *** >>LibClamAV Warning: ***Please update it IMMEDIATELY! *** >>LibClamAV Warning: ** > > Maybe you need to run "ldconfig". Maybe you need to uninstall your > old version of clam. Maybe freshclam doesn't have permission to > write to the database directory. Maybe your freshclam.conf specifies > a different DatabaseDirectory than the compiled-in default of clamscan. > # clamconf > and > # clamscan --debug > might show something interesting, or at least will show where clam is > looking for the databases. > > -- > Noel Jones > > ___ > Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net > http://lurker.clamav.net/list/clamav-users.html Thank you, when i run clamscan --debug i see ... LibClamAV debug: Loading databases from /usr/local/share/clamav ... i have two files over there 148 -rw-rw-r-- 1 clamav clamav 151524 Jun 27 2005 daily.cvd 2148 -rw-rw-r-- 1 clamav clamav 2196392 Jun 27 2005 main.cvd as i can see , they are very old but why clamscan look in there for this files? i have /usr/local/etc/clamd.conf with this configuration : ... DatabaseDirectory /var/lib/clamav/ ... and /usr/local/etc/freshclam.conf with this : ... DatabaseDirectory /var/lib/clamav/ ... How can i see where clamscan take the configuration from? Obviously, are not this files. when i run this, everything work fine : serverna:~# clamscan -d /var/lib/clamav/ so , how can i set the DatabaseDirectory ? where? Tnak you Jose Julian Buda ___ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://lurker.clamav.net/list/clamav-users.html
Re: [Clamav-users] LibClamAV Warning
> At 01:15 PM 7/12/2007, Jose Julian Buda wrote: >> > At 10:35 AM 7/12/2007, Jose Julian Buda wrote: >> >>Hi , i am new with this soft , i have installed >> >>postfix+mailscanner+clamav on debian "sarge" server. >> >> >> >>I've installed ClamAV 0.91 from source, run freshclam and the virus >> >>database is updated. >> >> >> >>As you can see: >> >> >> >>serverna:~# clamscan -V >> >>ClamAV 0.91/955/Thu Jun 23 18:08:42 2005 >> >>serverna:~# freshclam -V >> >>ClamAV 0.91/955/Thu Jun 23 18:08:42 2005 >> > >> > The above show database version "955" dated "18:08:42 2005" - two >> > years old. Updates aren't working, despite what you say. >> > >> >>The freshclam procces download ok the daily diff file >> >>But when i run clamscan just to test it on some test files: >> >> >> >>serverna:~# clamscan >> >>LibClamAV Warning: ** >> >>LibClamAV Warning: *** The virus database is older than 7 days. *** >> >>LibClamAV Warning: ***Please update it IMMEDIATELY! *** >> >>LibClamAV Warning: ** >> > >> > Maybe you need to run "ldconfig". Maybe you need to uninstall your >> > old version of clam. Maybe freshclam doesn't have permission to >> > write to the database directory. Maybe your freshclam.conf specifies >> > a different DatabaseDirectory than the compiled-in default of clamscan. >> > # clamconf >> > and >> > # clamscan --debug >> > might show something interesting, or at least will show where clam is >> > looking for the databases. >> > >> > -- >> > Noel Jones >> > >> > ___ >> > Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net >> > http://lurker.clamav.net/list/clamav-users.html >> >> >>Thank you, when i run clamscan --debug >> i see >>... >>LibClamAV debug: Loading databases from /usr/local/share/clamav >>... >>i have two files over there >> >> 148 -rw-rw-r-- 1 clamav clamav 151524 Jun 27 2005 daily.cvd >>2148 -rw-rw-r-- 1 clamav clamav 2196392 Jun 27 2005 main.cvd >> >>as i can see , they are very old >>but why clamscan look in there for this files? >>i have /usr/local/etc/clamd.conf with this configuration : >>... >>DatabaseDirectory /var/lib/clamav/ >>... >> >>and /usr/local/etc/freshclam.conf with this : >> >>... >>DatabaseDirectory /var/lib/clamav/ >>... >> >>How can i see where clamscan take the configuration from? >>Obviously, are not this files. >> >> >>when i run this, everything work fine : >> >>serverna:~# clamscan -d /var/lib/clamav/ >> >> >> >>so , how can i set the DatabaseDirectory ? where? > > > Clamscan does not use a config file - the default database directory > is set at compile-time. Either recompile clamav with the desired > --with-dbdir=/some/path or adjust freshclam.conf and clamd.conf to > agree with clamscan on the database location. > > Your previous post showed that freshclam is also using the antique > database, so something still wrong there. Maybe freshclam doesn't > have write permission in the database directory. > > -- > Noel Jones > > ___ > Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net > http://lurker.clamav.net/list/clamav-users.html if i run serverna:~# clamscan -d /var/lib/clamav/ /usr/local/copiasbackups/cables/eicar_com.zip: Eicar-Test-Signature FOUND --- SCAN SUMMARY --- Known viruses: 137301 Engine version: 0.91 Scanned directories: 1 Scanned files: 1 Infected files: 1 Data scanned: 0.00 MB Time: 4.939 sec (0 m 4 s) it works fine, just scan the files, no one error, so i set the variable ScanOptions="-d /var/lib/clamav/" in the /etc/MailScanner/wrapper/clamav-wrapper file and i think it will work fine... i hope so... Thank you Jose Julian Buda ___ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://lurker.clamav.net/list/clamav-users.html
Re: [Clamav-users] Problem with internal logger
try /etc/init.d/clamav-freshclam stop or killall freshclam to stop the hung freshclam process then try again manually - Original Message - From: "Bonzo" <[EMAIL PROTECTED]> To: "ClamAV users ML" Sent: Wednesday, December 05, 2007 2:11 PM Subject: [Clamav-users] Problem with internal logger > On Debian > > mail:/# freshclam > ERROR: Problem with internal logger (UpdateLogFile = > /var/log/clamav/freshclam.log) > > What can I do? > > > -- > http://www.ilbonzo.org > Skype: ilbonzo.org > ___ > Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net > http://lurker.clamav.net/list/clamav-users.html ___ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://lurker.clamav.net/list/clamav-users.html
[Clamav-users] Clamav 0.94
Hi , I have a mail server with : Debian etch Postfix Mailscanner Clamav Yesterday it work fine catching virus, but todat i've made an upgrade from clamav 0.93 to 0.94 and then the process stop catching mail with virus, i mean , the mails are stoped anyway by "No programs allowed" with mailscanner because of the extensions file, but there is not any message or report from "ClamAv". I have a txt file with eicar string , if i run on server: cat filewitheicar.txt | mail [EMAIL PROTECTED] the mail pass through the mailscanner and the workstation's antivirus alert me abourt the eicar strings. Why the mailscanner stop using clamav? Thank you any help about this. Sorry about my english Jose Julian Buda ___ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://www.clamav.net/support/ml
Re: [Clamav-users] Clamav 0.94
- Original Message - From: "Noel Jones" <[EMAIL PROTECTED]> To: "ClamAV users ML" Sent: Monday, September 08, 2008 1:54 PM Subject: Re: [Clamav-users] Clamav 0.94 > Jose Julian Buda wrote: >> Hi , I have a mail server with : >> Debian etch >> Postfix >> Mailscanner >> Clamav >> >> Yesterday it work fine catching virus, but todat i've made an upgrade >> from >> clamav 0.93 to 0.94 and then >> the process stop catching mail with virus, i mean , the mails are stoped >> anyway by "No programs allowed" with mailscanner because of the >> extensions >> file, but there is not any message or report from "ClamAv". >> >> I have a txt file with eicar string , if i run on server: >> >> cat filewitheicar.txt | mail [EMAIL PROTECTED] > > Try using >clamscan filewitheicar.txt > If clamscan detects the virus, then the problem is with your > mailscanner config. > > If clamscan by itself _does_not_ detect the test file, then > something is terribly wrong with your clamscan, and your > problem has nothing to do with mailscanner. > >> >> the mail pass through the mailscanner and the workstation's antivirus >> alert >> me abourt the eicar strings. >> >> Why the mailscanner stop using clamav? > > First make sure clamscan by itself works as expected. Then > you know it's a mailscanner problem. > > Maybe clamscan installed to a different path than mailscanner > expects. Maybe mailscanner is configured to use some > no-longer-valid command line switch. > > Check your mailscanner logs and/or ask on a mailscanner > support forum. > > -- > Noel Jones > ___ > Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net > http://www.clamav.net/support/ml > > __ Información de NOD32, revisión 3424 (20080907) __ > > Este mensaje ha sido analizado con NOD32 antivirus system > http://www.nod32.com > > proxymails:~# clamscan filewitheicar.txt filewitheicar.txt: Eicar-Test-Signature FOUND --- SCAN SUMMARY --- Known viruses: 416228 Engine version: 0.94 Scanned directories: 0 Scanned files: 1 Infected files: 1 Data scanned: 0.00 MB Time: 2.187 sec (0 m 2 s) proxymails:~# I do not change anything in the mailscanner config file, i just upgrade the clamav. How can i debug this error? Thank you Jose Julian Buda ___ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://www.clamav.net/support/ml
Re: [Clamav-users] Clamav 0.94
- Original Message - From: "Rick Macdougall" <[EMAIL PROTECTED]> To: "ClamAV users ML" Sent: Monday, September 08, 2008 2:14 PM Subject: Re: [Clamav-users] Clamav 0.94 > Noel Jones wrote: >> Jose Julian Buda wrote: >>> proxymails:~# clamscan filewitheicar.txt >>> filewitheicar.txt: Eicar-Test-Signature FOUND >>> >>> --- SCAN SUMMARY --- >>> Known viruses: 416228 >>> Engine version: 0.94 >>> Scanned directories: 0 >>> Scanned files: 1 >>> Infected files: 1 >>> Data scanned: 0.00 MB >>> Time: 2.187 sec (0 m 2 s) >>> proxymails:~# >>> >>> >>> I do not change anything in the mailscanner config file, i just upgrade >>> the >>> clamav. >>> How can i debug this error? >>> >> >> OK, it appears that clamscan is working correctly; mailscanner >> isn't. > > perhaps clamscan is working but clamdscan is not working ? > > Regards, > > Rick > > ___ > Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net > http://www.clamav.net/support/ml > > __ Información de NOD32, revisión 3424 (20080907) __ > > Este mensaje ha sido analizado con NOD32 antivirus system > http://www.nod32.com > > proxymails:~# clamdscan filewitheicar.txt /root/filewitheicar.txt: Eicar-Test-Signature FOUND --- SCAN SUMMARY --- Infected files: 1 Time: 0.064 sec (0 m 0 s) proxymails:~# clamdscan seems to work fine, so clamd is running properly am i right? you mean it`s a mailscanner problem? Thank you Jose Jlian Buda ___ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://www.clamav.net/support/ml
