NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.

Forum Discussion

HansRL's avatar
HansRL
Apprentice
Jul 10, 2020
Solved

Antivirus scanner definition file update failed

ReadyNAS 212 OSversion 6.10.3 Since a couple of days (starting July 5th) my virus definition file update failes.. stating check internet-connection ; my internet connection is fine because the rea...
  • HansRL's avatar
    HansRL
    Dec 23, 2020

    I kept getting errors while executing command: 'systemctl status clamav-freshclam.service' ; see below

         root@Geldrop:~# systemctl status clamav-freshclam.service
         ● clamav-freshclam.service - ClamAV virus database updater
         Loaded: loaded (/lib/systemd/system/clamav-freshclam.service; static; vendor preset: disabled)
         Active: failed (Result: exit-code) since Wed 2020-12-23 14:33:45 CET; 15s ago
        Process: 6263 ExecStart=/usr/bin/freshclam --quiet (code=exited, status=1/FAILURE)
        Main PID: 6263 (code=exited, status=1/FAILURE)

        Dec 23 14:33:45 Geldrop systemd[1]: Starting ClamAV virus database updater...
        Dec 23 14:33:45 Geldrop freshclam[6263]: ClamAV update process started at Wed Dec 23 14:33:45 2020
        Dec 23 14:33:45 Geldrop freshclam[6263]: main.cvd is up to date (version: 59, sigs: 4564902, f-level: 60, builder: sigmgr)
        Dec 23 14:33:45 Geldrop freshclam[6263]: daily.cld is up to date (version: 26026, sigs: 4328586, f-level: 63, builder: raynman)
        Dec 23 14:33:45 Geldrop freshclam[6263]: bytecode.cvd is up to date (version: 331, sigs: 94, f-level: 63, builder: anvilleg)
        Dec 23 14:33:45 Geldrop systemd[1]: clamav-freshclam.service: Main process exited, code=exited, status=1/FAILURE
        Dec 23 14:33:45 Geldrop systemd[1]: Failed to start ClamAV virus database updater.
        Dec 23 14:33:45 Geldrop systemd[1]: clamav-freshclam.service: Unit entered failed state.
        Dec 23 14:33:45 Geldrop systemd[1]: clamav-freshclam.service: Failed with result 'exit-code'.

     

    The following I did after reading the following web-page (https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=972974):
    stopping clamav: 'systemctl stop clamav-daemon'

    stopping clamav freshclam: 'systemctl stop clamav-freshclam'

    adjusting member 'usr.bin.freshclam' in dir: /etc/apparmor.d ; adding 'capability dac_override,' and 'capability chown,'

     

              capability setgid,
              capability setuid,
              capability dac_override,
              capability chown,

     

    removing all file from dir: '/var/lib/clamav' (bytecode ; daily ; main ; mirrors ; antivir)

    starting clamav : 'systemctl start clamav-daemon'

    starting clamav freshclam: 'systemctl start clamav-freshclam'

     

    starting 'clamav freshclam' takes a while (about 2 minutes, I guess) and afterwards it looks like the normal databased-updater is working again.... lets see what happens the coming days...

     

    regards

     

     

scrjs's avatar
scrjs
Apprentice
Feb 09, 2021

Hi All,

Yesterday I raised a  new post to this community in https://community.netgear.com/t5/ReadyNAS-Storage-Apps-Current/freshclam-AV-stops-updating-on-my-ReadyNAS/m-p/2053763/highlight/true#M15785 .

 

This thread discusses the same issue.

 

StephenB suggested in my post above "There's a much longer thread on this here: https://community.netgear.com/t5/Using-your-ReadyNAS-in-Business/Antivirus-scanner-definition-file-update-failed/td-p/1943198

 

If you have ssh enabled, you could try manually editing /etc/freshclam.conf as described here: : https://community.netgear.com/t5/Using-your-ReadyNAS-in-Business/Antivirus-scanner-definition-file-update-failed/m-p/2051207#M190436 It'd be useful to know if it solves the problem."

 

I have implemented the change as suugested by HansRL in /etc/freshclam.conf and changed

  • TestDatabases true
    to
  • TestDatabases false

Freshclam still runs sucessfully after the change.

 

I am no monitoring if this resolves the issue...

 

many thanks StephenB and HansRL 

scrjs's avatar
scrjs
Apprentice
Feb 11, 2021

The AV has updated twice since TestDatabases=false is set in my /etc/freshclam.conf.

 

 

 

 

 

 

Not conclusive that the problem has resolved, just positive progress

  • scrjs's avatar
    scrjs
    Apprentice
    Feb 16, 2021

    Hi all 

    I checked again today (Feb 16) and the AV has not updated fince Feb 11 so sadly the change TestDatabases=false setting in my /etc/freshclam.conf has failed to rectify or workaround the issue as seen in the log below

     

     

    I ran freshclam -v which ran successfully and my AV updated to 59.26081 from 59.26076 though there are some interesting messages highlighted below

    Freshclam seems to have disabled the AV and did not re-enable it.  This has not happened in the past.  Any thoughts?

    I manually enabled AV successfully as noted belowNow back to the successful running of Freshclam.  These details are noted below.  Nothing unusual execpt for the warning in red text at the end.

     

    ClamAV update process started at Tue Feb 16 11:18:32 2021
    Using IPv6 aware code
    Querying current.cvd.clamav.net
    TTL: 1349
    Software version from DNS: 0.103.1
    main.cvd version from DNS: 59
    main.cld is up to date (version: 59, sigs: 4564902, f-level: 60, builder: sigmgr)
    daily.cvd version from DNS: 26081
    Retrieving http://database.clamav.net/daily-26077.cdiff
    Trying to download http://database.clamav.net/daily-26077.cdiff (IP: 104.16.219.84)
    Downloading daily-26077.cdiff [100%]
    cdiff_apply: Parsed 10182 lines and executed 10182 commands
    Retrieving http://database.clamav.net/daily-26078.cdiff
    Trying to download http://database.clamav.net/daily-26078.cdiff (IP: 104.16.219.84)
    Downloading daily-26078.cdiff [100%]
    cdiff_apply: Parsed 11731 lines and executed 11731 commands
    Retrieving http://database.clamav.net/daily-26079.cdiff
    Trying to download http://database.clamav.net/daily-26079.cdiff (IP: 104.16.219.84)
    Downloading daily-26079.cdiff [100%]
    cdiff_apply: Parsed 11600 lines and executed 11600 commands
    Retrieving http://database.clamav.net/daily-26080.cdiff
    Trying to download http://database.clamav.net/daily-26080.cdiff (IP: 104.16.219.84)
    Downloading daily-26080.cdiff [100%]
    cdiff_apply: Parsed 10313 lines and executed 10313 commands
    Retrieving http://database.clamav.net/daily-26081.cdiff
    Trying to download http://database.clamav.net/daily-26081.cdiff (IP: 104.16.219.84)
    Downloading daily-26081.cdiff [100%]
    cdiff_apply: Parsed 10297 lines and executed 10297 commands
    Loading signatures from daily.cld
    Properly loaded 4010384 signatures from new daily.cld
    daily.cld updated (version: 26081, sigs: 4051203, f-level: 63, builder: raynman)
    Querying daily.26081.93.1.0.6810DB54.ping.clamav.net
    Can't query daily.26081.93.1.0.6810DB54.ping.clamav.net
    bytecode.cvd version from DNS: 331
    bytecode.cld is up to date (version: 331, sigs: 94, f-level: 63, builder: anvilleg)
    Database updated (8616199 signatures) from database.clamav.net (IP: 104.16.219.84)
    WARNING: Clamd was NOT notified: Can't connect to clamd through /var/run/clamav/clamd.ctl: No such file or directory

    I have searched the file system and indeed clamd.ctl does not exist anywhere on the file system.

    Any thoughts on the missing clamd.ctl?

     

    Cheers Rob

    • scrjs's avatar
      scrjs
      Apprentice
      Feb 16, 2021

      Just FYI re WARNING: Clamd was NOT notified: Can't connect to clamd through /var/run/clamav/clamd.ctl: No such file or directory

      Subsequent to the update (quoted below) I have discovered that "/var/run/clamav/clamd.ctl" was created after I enabled AV so I suspect this isnot a contributer to the AV not updating. 

       

      scrjs wrote:

      Hi all 

      I checked again today (Feb 16) and the AV has not updated fince Feb 11 so sadly the change TestDatabases=false setting in my /etc/freshclam.conf has failed to rectify or workaround the issue as seen in the log below

       

       

      I ran freshclam -v which ran successfully and my AV updated to 59.26081 from 59.26076 though there are some interesting messages highlighted below

      Freshclam seems to have disabled the AV and did not re-enable it.  This has not happened in the past.  Any thoughts?

      I manually enabled AV successfully as noted belowNow back to the successful running of Freshclam.  These details are noted below.  Nothing unusual execpt for the warning in red text at the end.

       

      ClamAV update process started at Tue Feb 16 11:18:32 2021
      Using IPv6 aware code
      Querying current.cvd.clamav.net
      TTL: 1349
      Software version from DNS: 0.103.1
      main.cvd version from DNS: 59
      main.cld is up to date (version: 59, sigs: 4564902, f-level: 60, builder: sigmgr)
      daily.cvd version from DNS: 26081
      Retrieving http://database.clamav.net/daily-26077.cdiff
      Trying to download http://database.clamav.net/daily-26077.cdiff (IP: 104.16.219.84)
      Downloading daily-26077.cdiff [100%]
      cdiff_apply: Parsed 10182 lines and executed 10182 commands
      Retrieving http://database.clamav.net/daily-26078.cdiff
      Trying to download http://database.clamav.net/daily-26078.cdiff (IP: 104.16.219.84)
      Downloading daily-26078.cdiff [100%]
      cdiff_apply: Parsed 11731 lines and executed 11731 commands
      Retrieving http://database.clamav.net/daily-26079.cdiff
      Trying to download http://database.clamav.net/daily-26079.cdiff (IP: 104.16.219.84)
      Downloading daily-26079.cdiff [100%]
      cdiff_apply: Parsed 11600 lines and executed 11600 commands
      Retrieving http://database.clamav.net/daily-26080.cdiff
      Trying to download http://database.clamav.net/daily-26080.cdiff (IP: 104.16.219.84)
      Downloading daily-26080.cdiff [100%]
      cdiff_apply: Parsed 10313 lines and executed 10313 commands
      Retrieving http://database.clamav.net/daily-26081.cdiff
      Trying to download http://database.clamav.net/daily-26081.cdiff (IP: 104.16.219.84)
      Downloading daily-26081.cdiff [100%]
      cdiff_apply: Parsed 10297 lines and executed 10297 commands
      Loading signatures from daily.cld
      Properly loaded 4010384 signatures from new daily.cld
      daily.cld updated (version: 26081, sigs: 4051203, f-level: 63, builder: raynman)
      Querying daily.26081.93.1.0.6810DB54.ping.clamav.net
      Can't query daily.26081.93.1.0.6810DB54.ping.clamav.net
      bytecode.cvd version from DNS: 331
      bytecode.cld is up to date (version: 331, sigs: 94, f-level: 63, builder: anvilleg)
      Database updated (8616199 signatures) from database.clamav.net (IP: 104.16.219.84)
      WARNING: Clamd was NOT notified: Can't connect to clamd through /var/run/clamav/clamd.ctl: No such file or directory

      I have searched the file system and indeed clamd.ctl does not exist anywhere on the file system.

      Any thoughts on the missing clamd.ctl?

       

      Cheers Rob

       

NETGEAR Academy

Boost your skills with the Netgear Academy - Get trained, certified and stay ahead with the latest Netgear technology! 

Join Us!

ProSupport for Business

Comprehensive support plans for maximum network uptime and business peace of mind.

 

Learn More