Antivirus scanner definition file update failed

Changing the DNS didn't work for me either.

That's not good at all, sorry to hear that.

kohdeemaybe netgear can comment on this issue? I found a solution by turning many services on / off for my device but i don't hope the next update will return this issue again. But many people still have this issue and i don't see any comment of netgear itself. Bad customer services?

This gets worse. over the last few months I have run freshclam once a week and all has been well. I tried it several times yesterday and again today and it fails. See the error below. I am getting to the stage where with christmas just around the corner and watching people on Youtube setting up and using other NAS boxes I maight just be looking to replace this box. 

Regards

Derek

WARNING: [LibClamAV] Can't load /var/lib/clamav/clamav-8385bc559c3f5bb41cb84eb40ae58511.tmp/clamav-acd20b130ab2e85d0581f0a855a76677.cld: Malformed database
ERROR: Failed to load new database: Malformed database
ERROR: During database load : WARNING: [LibClamAV] mpool_malloc(): Can't allocate memory (262144 bytes). [...] ERROR: Failed to load new database: Malformed database
WARNING: Database load exited with status 55
ERROR: Failed to load new database

Derek, thanks for sharing the errors\logs, I feel extremely fortunate that my woes were probably down to the lack of name resolution from my DNS provider.

Firstly, I'm no Unix\Linux expert by any means so perhaps others well versed can shed some light\ideas to help you with this.

Re the malformed database....is the *.cld file the daily update that gets pulled down from ClamAV?  Is this corrupt, could you potentially rename this file and restart the service\daemon to pull down another copy?  Memory error...is this a disk space problem in that area of disk\partition or an actual memory shortage, or a big fat red herring?

Secondly, and forgive me if I stepping out of line here but as end users should we really be digging around trying to force an integrated component of a product, and quite an important one at that, to run as designed on a daily basis and pull down and install a daily DAT file.

Whilst I appreciate services stop\fail from time to time I really do think Netgear should own this.

---

JTR1971 wrote:

 

Secondly, and forgive me if I stepping out of line here but as end users should we really be digging around trying to force an integrated component of a product, and quite an important one at that, to run as designed on a daily basis and pull down and install a daily DAT file.

 

Whilst I appreciate services stop\fail from time to time I really do think Netgear should own this.

---

I couldn't agree more.  I have bought Netgear products for many years now because I believed that they were second to none when it comes to rolling out updates and Customer Support.  Now I'm not so sure.

There has been some mention in earlier responses to this Topic that Netgear 'are working with ClamAV to resolve this'.  I can't see how two obviously skilled organisations can find this so difficult so I can only assume that nothing is actually happening.

I may be wrong, but it seems to me that if the vius signatures can be reliably updated by logging in over SSH but not by the auto-updater, there can only be two things wrong.  Either the address being used by the auto-updater is wrong (Hint: it's http://database.clamav.net/or the command sent by the auto-updater is malformed.

Have I missed anything?

---

TerryJColes wrote:

...Either the address being used by the auto-updater is wrong (Hint: it's http://database.clamav.net/or the command sent by the auto-updater is malformed.

 

Have I missed anything?

---

The addresses haven't changed recently, and it's likely that the ReadyNAS application is simply calling the stock ClamAV updater.

Another possibility is that it is a resource issue - that for some reason the updater is running out of memory in some systems when it is called by the ReadyNAS app. 

It's also worth pointing out that this isn't happening on all systems, and it's almost impossible to tell from forum posts how prevalent the issue is.  As I've said earlier on the thread, though I don't normally have ClamAV enabled, I did try to duplicate this problem on my RN202 without sucess.

FWIW, I agree that Netgear should own this, and since it is apparently working with normal cron jobs it would be easy for them to issue a hotfix that simply shifts to that method (at least for now).  

JohnCM_S / Marc_V : is there any update from Netgear on the status of this problem.

Ok tried again with freshclam this morning Still failed with failed to allocate memory. Free shows swap has no space. rebooted the NAS and this sorted that issue. Tried freshclam again and it worked. Free shows some memory used but i will be interested to see if the auto update works over the next few days. 

I don't normally reboot the NAS as 30 plus years in computer hardware engineering tells me don't switch off unless you need to. lets see what happens now. 

Derek

---

DerekHoughton wrote:

Free shows swap has no space. rebooted the NAS and this sorted that issue.

---

Memory isn't the problem with my device:

root@ReadyNAS:~# free
             total       used       free     shared    buffers     cached
Mem:       2065992    1829760     236232       4360       5816     700772
-/+ buffers/cache:    1123172     942820
Swap:       523708      41052     482656

It still doesn't work with the sudo-updater.

However, freshclam -v works fine.

Terry,

that answers one of my questions then. apart from the swap space the output of your free command is pretty much the same as mine was. The other question I was going to ask is how often do people reboot the box? 

I don't routinely reboot the box unless as part of an upgrade - which I did as part of the lift to 6.10.4. The update AV failed immediately after the upgrade and has done so every day since.

That's interesting as I thought the problem was only related to the 200 series boxes. That is the ARM based systems.

I have about 10 of the RN202 units in our enterprise and the only 2 units are doing this. I've rebooted to no avail. 

Yesterday when I was checking the swap available using the 'free' command it went to 0 free with 523260 total and used. I decided to see what would happen overnight if i left it alone. Today when i checked it I have 523260 total, 499688 used and 23572 free. Checking the logs on the admin page shows the entries below. this isn't the first time i have seen these and i have wondered what was happening. My feeling is that this restart is caused by memory/swap usage for some reason and this resets things. I don't know why this is happening but it does look like there is a resource issue with the box at times. I know from reading through the posts here that at least one other user is seeing these messages. I am not doing anything else until i see what happens with the antivirus update later on but I feel it is going to fail once again. 

As i said in an earlier post I am out of support on this box and as it is for family use only i am not prepared to pay for Netgear to ignore our problems as they have shown they are prepared to do to folk who are paying. I will save my money and replace the unit at a later date.

Derek

Yesterday I tried this from the Clamav website:

Ignoring mirror <IP> (has connected too many times with an outdated version)

If you are experiencing this problem, please do the following: Stop the freshclam daemon if it’s running, delete both mirrors.dat and daily.cvd, then restart the freshclam daemon. Freshclam will then download a new daily.cvd and will be up-to-date.

After this, manual freshclam ran successfully for the first time in 6 months. Fingers crossed it keeps going. Manual freshclam ran ok today too. True test will be to see if auto-update runs over the next few days and stays running. 

(Note: I used the mv command to copy and rename the 2 files by adding a .old extension - this way I had a roll back point of needed) 

---

NormanP wrote:

If you are experiencing this problem, please do the following: Stop the freshclam daemon if it’s running, delete both mirrors.dat and daily.cvd, then restart the freshclam daemon. Freshclam will then download a new daily.cvd and will be up-to-date.needed) 

---

You wouldn't care to elucidate this would you?  I've studied the documentation on the ClamAV website and am struggling to find the name of the freshclam daemon so that I can stop it.  I've found the two files that you mention; mirrors.dat and daily.cvd in /var/lib/clamav, but have been unable to stop the freshclam daemon because I can't find it.

Did you mean clamd?

---

TerryJColes wrote:

---

Did you mean clamd?

---

clamd is the freshclam daemon

Got to admit I could not find the daemon either. So I took the chance of renaming the 2 files to add .old extensions and then manually ran freshclam. This created new versions of both files.

Better to follow the full instructions from ClamAV website and stop the daemon now we know the daemon name 😃 (thanks StephenB !!)

FWIW, I used

# ps aux | grep -i clam

to track down the name.  clamd showed up (and the "d" follows the normal linux convention for a daemon).

---

StephenB wrote:

FWIW, I used

# ps aux | grep -i clam

to track down the name.  clamd showed up (and the "d" follows the normal linux convention for a daemon).

---

Yes.  I used that too.  My problem wasn't that I couldn't find the clamd daemon; I was aware of that one from the ClamAV documentation.  My problem was that I thought there was a separate clam daemon to look after the updates (eg freshclam).

BTW.  I've had no success in shutting down the clamd daemon.  I'm assuming that the command to use is start-stop-daemon, but every incantation I've tried throws up an error.  Would anyone care to post the correct switches to use?

How about:

service clamd stop

Or when you ran the grep did you get the clamd process ID? If yes then 

kill (then put the process ID here without brackets)

should do it.

Just an update - after running the fix from the ClamAV website, (see above), my Readynas has just successfully completed the second consecutive day automatic update. So that's 2 manual and 2 automatic updates that have completed without issue. More than has happened in the last 5 months!I

Fingers crossed...

---

NormanP wrote:

service clamd stop

---

Always good to try the commands before you post them :smileywink:

That doesn't work.  But this does:

# systemctl stop clamav-daemon

And of course it can be started again with

# systemctl start clamav-daemon

You can also start and stop the updater - which is called clamav-freshclam.

You can get the full list of services with

# systemctl --type=service --no-pager

---

StephenB wrote:

---

You can get the full list of services with

# systemctl --type=service --no-pager

---

It looks like it's the updater that's failing on my box:

root@ReadyNAS:~# systemctl --type=service --no-pager
  UNIT                               LOAD   ACTIVE     SUB     JOB   DESCRIPTION
  antivirus-sched-scan.service       loaded activating start   start AntiVirus schedule scanner
  apache2.service                    loaded active     running       The Apache HTTP Server
  avahi-daemon.service               loaded active     running       Avahi mDNS/DNS-SD Stack
  clamav-daemon.service              loaded active     running       Clam AntiVirus userspace daemon
● clamav-freshclam.service           loaded failed     failed        ClamAV virus database updater

So going back to the original advice from a few days ago, should it be the clamav-daemon or the clamav-freshclam daemon that we should be stopping and restarting?

Do you see any errors when you restart the service with systemctl?