NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
Astra03
Jul 24, 2020Star
RN214 Failing to Update Antivirus
Hi, For the past week I have been getting a daily alert "System: Antivirus scanner definition file update failed due to download failure. Check your Internet connection." I have found a number of o...
StephenB
Jul 26, 2020Guru - Experienced User
Astra03 wrote:
I have been unable to find any of the three log files that you mentioned - I tried using the Linux "find" command, but got back "No such file or directory" for each of them. There is a folder /var/log/clamav , but "ls" does not return any contents.
The log is accessed via ssh with journalctl. While I do sometimes do that, it generally works out better if you have a keyword to search for. Then you can pipe it through grep. For instance
# journalctl -r --no-pager | grep -i error
will give you all journal entries that have the word "error" in them.
Adding -k to the journalctl command will limit the output to kernel entries. Journalctl does have filters built into it (an alternative to grep), but mostly I just use grep. https://manpages.debian.org/stretch/systemd/journalctl.1.en.html
I was suggesting that you download the log zip file from the NAS web ui - the files I suggested are in the zip.
Astra03 wrote:
So, I think I know how to copy a folder to the /data partition to reduce space, (cp "copy" or mv "move" if I am trying to reduce space usage?), but what I do not know how to do is use ln to create symbolic links to the new folder locations. Can you help me with that please?
There is a lot of help for most linux commands out there if you just google the command name with "linux" (perhaps also adding "man").
Here are two:
It's really best to look through the man pages and examples, and try them on your linux desktop. Trying them directly on the NAS does have some risk - you can easily end up with an unbootable NAS, or with data loss.
Also, you want to ssh into the NAS as root (using the NAS admin password).
That said: what you want in this case is a "soft link".
ReadyNAS apps are supposed to put their data on the data volume. If you use the default data volume name ("data"), then the app data is in a subfolder of /data/.apps
Note that .apps is a hidden folder - so you won't see it with ls /data but you will see it with ls -a /data.
I suggest creating a relocation folder in .apps (perhaps /data/.apps/relocate) and then copy the folders into relocate. Alternatively you can create a relocation folder for each app (e.g., /data/.apps/LMS, etc).
But let's say the folder you want to relocate is /var/myfolder and that you've already moved it to /data/.apps/relocate/myfolder.
Then you create the soft link with
ln -s /data/.apps/relocate/myfolder /var/myfolder
Remember that you put the target first (which I find non-intuitive). And it's important to create a soft link (-s) and not the default hard link.
You might want to try this sequence to get the hang of it:
# mkdir /data/.apps/relocate # mkdir /data/.apps/relocate/myfolder # mkdir /data/.apps/relocate/myfolder/temp # ln -s /data/.apps/relocate/myfolder
Now if you look at /var you'll see the soft link
root@RN202:/var# ls -al /var/myfolder lrwxrwxrwx 1 root root 29 Jul 26 06:26 /var/myfolder -> /data/.apps/relocate/myfolder
And if you navigate into /var/myfolder, you'll see that you appear to be in /var/myfolder but you are seeing the files and folders in the target /data/.apps/relocate/myfolder. In this example, the temp folder you created above.
# root@RN202:/var# cd myfolder
# root@RN202:/var/myfolder# ls -al total 0 drwxr-xr-x 1 root root 8 Jul 26 06:26 . drwxr-xr-x 1 root root 16 Jul 26 06:24 .. drwxr-xr-x 1 root root 0 Jul 26 06:26 temp root@RN202:/var/myfolder#
Note that /var/myfolder is deleted as if it is an ordinary file - not a folder. That's because a soft link is a file.
# root@RN202:/var# rm myfolder
To delete the relocated target you'd need to use -r (or rmdir if it is empty).
# rm -r /data/.apps/relocate/myfolder
Astra03
Jul 26, 2020Star
Hi,
I'm going to try look in to this in more detail later, but tried journalctl -r --no-pager | grep -i error as you suggested. The first 3 lines from the output look to be relevant to my problem:
Jul 25 18:47:59 Marsh-Server freshclam[30956]: During database load : ERROR: Failed to load new database: Malformed database
Jul 25 18:47:59 Marsh-Server freshclam[30956]: ERROR: Failed to load new database
Jul 25 18:47:59 Marsh-Server freshclam[30956]: ERROR: During database load : ERROR: Failed to load new database: Malformed database
There are similar entries daily for the past week - when this issue first started. 18:47 is the same time that I receive the system generated email advising of the failure. Each day I then SSH i, and a manual "freshclam" appears to resolve the problem - for 24 hours.
Does "Malformed database" sugest that there is a corrupted file somewhere? Is it the file that the automated procedure is trying to download and install? If that is the case, what is the difference between the automated process which always fails, and my manual "freshclam" which always works?
Given that a daily manual freshclam always seems to work, is there really any need to start moving system files and creating links - with all the work, (and risks), involved if I do get it wrong?
- StephenBJul 26, 2020Guru - Experienced User
Astra03 wrote:
is there really any need to start moving system files and creating links - with all the work, (and risks), involved if I do get it wrong?
I've already answered that (at least twice). 50% OS partition fullness is higher than it should be but shouldn't cause any immediate problems. You do want to make sure it isn't continuing to grow. It would be useful to know what app is using the space.
But there's no immediate need to relocate anything. As I've also said, relocating folders won't solve your antivirus issue.
Astra03 wrote:
Does "Malformed database" sugest that there is a corrupted file somewhere? Is it the file that the automated procedure is trying to download and install? If that is the case, what is the difference between the automated process which always fails, and my manual "freshclam" which always works?
Can you post the output you see when you run freshclam manually? Perhaps use freshclam -v --debug
You might also want to try a small antivirus scan. clamscan -r -v --debug /data/sharename should do it. Choose a small share.
Also, look in the log zip (in the files I mentioned earlier) to get more details on what happened around Jul 25 18:47:59. Likely there are more entries that don't include the word error.
BTW, are you logging in as root when you run freshclam? You should be.
- Astra03Jul 27, 2020Star
Well now, this is interesting.
Yesterday evening, (Sunday 26th), I decided to reboot the NAS and also then stop and restart the AntiVirus in the ReadyNAS' GUI - I had previously tried just rebooting the NAS a few times as this had been found to work for some users, although temporarily. The AV did not immediately try to update itself, so I forced it manually with "freshclam". This evening, (Monday 27th), I noticed that I had not received the now daily "AV download failed" email, so I logged on to the ReadyNAS and found that it had updated itself - for the first time in over a week!
Obviously, what I don't know is whether my actions caused this to happen, or something external has changed in the past 24 hours or so? I'm now going to monitor it daily to see what happens.
I did not get a chance to try out your final suggestions, but if nothing else I have learnt a few new Linux commands, (New to me anyway), so thanks for that!
Paul
Related Content
NETGEAR Academy

Boost your skills with the Netgear Academy - Get trained, certified and stay ahead with the latest Netgear technology!
Join Us!