RN214 Failing to Update Antivirus

Once again, the daily AV update has failed - and once again logging in and manually "freshclam" has temporarily resolved the issue. Can this daily "freshclam" task be automated seperately from the OS task that always fails?

---

Astra03 wrote:

 

12          ./.ssh

36          .

 

---

What you need to do is begin by entering

# mount --bind / /mnt
# cd /mnt

There are several mount points in the actual OS partition that get in the way of analyzing space - for instance /data and /apps.  The first command remounts the OS partition as /mnt.

Once there, there are several commands that will show you the space usage.  One is 

# du -d1 -h

Which will show you the space in each top-level folder.  You can then descend into the bigger ones, and repeat that command.  For instance, on my own NAS I see

root@RN202:~# cd /mnt
root@RN202:/mnt# du -d1 -h
6.0M ./bin
4.0K ./proc
4.0K ./boot
11M ./sbin
24K ./tmp
16K ./lost+found
4.0K ./run
31M ./frontview
4.0K ./sys
12K ./dev
8.8M ./etc
4.0K ./media
3.9M ./opt
4.0K ./apps
4.0K ./mnt
4.0K ./data
4.0K ./home
206M ./usr
29M ./lib
235M ./var
32K ./root
4.0K ./srv
529M .

You can see that normally almost all the space is in /var and /usr.  If we descend in /var, you'd see

root@RN202:/mnt# cd var
root@RN202:/mnt/var# du -d1 -h
49M ./log
4.0K ./tmp
8.7M ./readynasd
4.0K ./cores
76M ./cache
8.0K ./www
16K ./netatalk
4.0K ./opt
4.0K ./ftp
4.0K ./mail
17M ./backups
86M ./lib
16K ./spool
4.0K ./local
235M .
root@RN202:/mnt/var#

Similarly for usr

root@RN202:/mnt/var# cd ../usr
root@RN202:/mnt/usr# du -d1 -h
36M     ./bin
4.0K    ./games
25M     ./sbin
4.0K    ./include
37M     ./share
109M    ./lib
4.0K    ./src
44K     ./local
206M    .
root@RN202:/mnt/usr#

When done, enter

# cd //
# umount /mnt

The last command (easy to mistype as unmount) will undo the mount.  You have to navigate out of the /mnt folder before you enter it (otherwise it will fail)

---

Astra03 wrote:

 

If the available space in the md0 partition is not the real issue, and given that I can daily manually update the AV by using "freshclam", is it possible to automate that process with some sort of script? If so, how would I do that? I am vaguely aware of cron jobs (?), but do not know how to create one for a task such as this.

 

---

You could automate it, but I am thinking it would be better to look in the logs and see if you can get a better handle on the cause of the problem.   You might want to look in

• apt-history.log
• dmesg.log
• system.log

Not sure if there is a separate log for ClamAV (it's not something I have turned on).

Thanks once again for your reply. This is what I have found:

root@M***h-Server:~# cd /mnt
root@M***h-Server:/mnt# du -d1 -h
4.0K ./mnt
4.0K ./boot
4.0K ./home
36K ./root
4.0K ./apps
31M ./frontview
4.0K ./proc
6.0M ./bin
16K ./lost+found
451M ./usr
58M ./lib
12K ./dev
9.4M ./etc
4.0K ./srv
8.0K ./media
4.1M ./opt
4.0K ./run
28K ./tmp
1.2G ./var
11M ./sbin
4.0K ./sys
4.0K ./data
1.7G .

As you said, /usr and /var are by far the largest top level folders and descending down into the file system breaks these down further.

So, I think I know how to copy a folder to the /data partition to reduce space, (cp "copy" or mv "move" if I am trying to reduce space usage?), but what I do not know how to do is use ln to create symbolic links to the new folder locations. Can you help me with that please?

I have been unable to find any of the three log files that you mentioned - I tried using the Linux "find" command, but got back "No such file or directory" for each of them. There is a folder /var/log/clamav , but "ls" does not return any contents.

Paul

---

Astra03 wrote:

 

I have been unable to find any of the three log files that you mentioned - I tried using the Linux "find" command, but got back "No such file or directory" for each of them. There is a folder /var/log/clamav , but "ls" does not return any contents.

 

---

The log is accessed via ssh with journalctl.  While I do sometimes do that, it generally works out better if you have a keyword to search for.  Then you can pipe it through grep.  For instance

# journalctl -r --no-pager | grep -i error 

will give you all journal entries that have the word "error" in them.

Adding -k to the journalctl command will limit the output to kernel entries.  Journalctl does have filters built into it (an alternative to grep), but mostly I just use grep.  https://manpages.debian.org/stretch/systemd/journalctl.1.en.html

I was suggesting that you download the log zip file from the NAS web ui - the files I suggested are in the zip.  

---

Astra03 wrote:

 

So, I think I know how to copy a folder to the /data partition to reduce space, (cp "copy" or mv "move" if I am trying to reduce space usage?), but what I do not know how to do is use ln to create symbolic links to the new folder locations. Can you help me with that please?

 

---

There is a lot of help for most linux commands out there if you just google the command name with "linux" (perhaps also adding "man").

Here are two:

• https://linux.die.net/man/1/ln
• https://www.howtoforge.com/linux-ln-command/

It's really best to look through the man pages and examples, and try them on your linux desktop.  Trying them directly on the NAS does have some risk - you can easily end up with an unbootable NAS, or with data loss.

Also, you want to ssh into the NAS as root (using the NAS admin password).

That said: what you want in this case is a "soft link".

ReadyNAS apps are supposed to put their data on the data volume.  If you use the default data volume name ("data"), then the app data is in a subfolder of /data/.apps 

Note that .apps is a hidden folder - so you won't see it with ls /data but you will see it with ls -a /data.

I suggest creating a relocation folder in .apps (perhaps /data/.apps/relocate) and then copy the folders into relocate.  Alternatively you can create a relocation folder for each app (e.g., /data/.apps/LMS, etc). 

But let's say the folder you want to relocate is /var/myfolder and that you've already moved it to /data/.apps/relocate/myfolder.  

Then you create the soft link with

ln -s /data/.apps/relocate/myfolder /var/myfolder  

Remember that you put the target first (which I find non-intuitive).  And it's important to create a soft link (-s) and not the default hard link.

You might want to try this sequence to get the hang of it:

# mkdir /data/.apps/relocate
# mkdir /data/.apps/relocate/myfolder
# mkdir /data/.apps/relocate/myfolder/temp
# ln -s /data/.apps/relocate/myfolder

Now if you look at /var you'll see the soft link

root@RN202:/var# ls -al /var/myfolder
lrwxrwxrwx 1 root root 29 Jul 26 06:26 /var/myfolder -> /data/.apps/relocate/myfolder

And if you navigate into /var/myfolder, you'll see that you appear to be in /var/myfolder but you are seeing the files and folders in the target /data/.apps/relocate/myfolder.  In this example, the temp folder you created above.

# root@RN202:/var# cd myfolder
# root@RN202:/var/myfolder# ls -al
total 0
drwxr-xr-x 1 root root  8 Jul 26 06:26 .
drwxr-xr-x 1 root root 16 Jul 26 06:24 ..
drwxr-xr-x 1 root root  0 Jul 26 06:26 temp
root@RN202:/var/myfolder#

Note that /var/myfolder is deleted as if it is an ordinary file - not a folder.  That's because a soft link is a file.

# root@RN202:/var# rm myfolder

To delete the relocated target you'd need to use -r (or rmdir if it is empty).

# rm -r /data/.apps/relocate/myfolder

Hi,

I'm going to try look in to this in more detail later, but tried journalctl -r --no-pager | grep -i error as you suggested. The first 3 lines from the output look to be relevant to my problem:

Jul 25 18:47:59 Marsh-Server freshclam[30956]: During database load : ERROR: Failed to load new database: Malformed database
Jul 25 18:47:59 Marsh-Server freshclam[30956]: ERROR: Failed to load new database
Jul 25 18:47:59 Marsh-Server freshclam[30956]: ERROR: During database load : ERROR: Failed to load new database: Malformed database

There are similar entries daily for the past week - when this issue first started. 18:47 is the same time that I receive the system generated email advising of the failure. Each day I then SSH i, and a manual "freshclam" appears to resolve the problem - for 24 hours.

Does "Malformed database" sugest that there is a corrupted file somewhere? Is it the file that the automated procedure is trying to download and install? If that is the case, what is the difference between the automated process which always fails, and my manual "freshclam" which always works?

Given that a daily manual freshclam always seems to work, is there really any need to start moving system files and creating links - with all the work, (and risks), involved if I do get it wrong?

---

Astra03 wrote:

 

 is there really any need to start moving system files and creating links - with all the work, (and risks), involved if I do get it wrong?

 

---

I've already answered that (at least twice).  50% OS partition fullness is higher than it should be but shouldn't cause any immediate problems.  You do want to make sure it isn't continuing to grow.  It would be useful to know what app is using the space.  

But there's no immediate need to relocate anything.  As I've also said, relocating folders won't solve your antivirus issue.

---

Astra03 wrote:

 

Does "Malformed database" sugest that there is a corrupted file somewhere? Is it the file that the automated procedure is trying to download and install? If that is the case, what is the difference between the automated process which always fails, and my manual "freshclam" which always works?

 

---

Can you post the output you see when you run freshclam manually?  Perhaps use freshclam -v --debug

You might also want to try a small antivirus scan. clamscan -r -v --debug /data/sharename should do it.  Choose a small share.

Also, look in the log zip (in the files I mentioned earlier) to get more details on what happened around Jul 25 18:47:59.  Likely there are more entries that don't include the word error.

BTW, are you logging in as root when you run freshclam?  You should be.

---

StephenB wrote:

---

You might also want to try a small antivirus scan. clamscan -r -v --debug /data/sharename should do it.  Choose a small share.

 

---

Actually leave out the --debug on this one.  It will generate a lot of output.

Well now, this is interesting.

Yesterday evening, (Sunday 26th), I decided to reboot the NAS and also then stop and restart the AntiVirus in the ReadyNAS' GUI - I had previously tried just rebooting the NAS a few times as this had been found to work for some users, although temporarily. The AV did not immediately try to update itself, so I forced it manually with "freshclam". This evening, (Monday 27th), I noticed that I had not received the now daily "AV download failed" email, so I logged on to the ReadyNAS and found that it had updated itself - for the first time in over a week!

Obviously, what I don't know is whether my actions caused this to happen, or something external has changed in the past 24 hours or so? I'm now going to monitor it daily to see what happens.

I did not get a chance to try out your final suggestions, but if nothing else I have learnt a few new Linux commands, (New to me anyway), so thanks for that!

Paul