× NETGEAR will be terminating ReadyCLOUD service by July 1st, 2023. For more details click here.
Orbi WiFi 7 RBE973
Reply

Re: Antivirus scanner definition file update failed

HansRL
Apprentice

Antivirus scanner definition file update failed

ReadyNAS 212 OSversion 6.10.3

Since a couple of days (starting July 5th) my virus definition file update failes.. stating check internet-connection ; my internet connection is fine because the readynas succeeds in sending me a notification to my gmail-account immediately after the update fails.
restarting the readynas seems to solve this issue for a couple of days and then the update fails again...

 

what can I do to solve this

 

rgds Hans

Model: RN21200|ReadyNAS 212 Series 2- Bay (Diskless)
Message 1 of 339

Accepted Solutions
HansRL
Apprentice

Re: Antivirus scanner definition file update failed

I kept getting errors while executing command: 'systemctl status clamav-freshclam.service' ; see below

     root@Geldrop:~# systemctl status clamav-freshclam.service
     ● clamav-freshclam.service - ClamAV virus database updater
     Loaded: loaded (/lib/systemd/system/clamav-freshclam.service; static; vendor preset: disabled)
     Active: failed (Result: exit-code) since Wed 2020-12-23 14:33:45 CET; 15s ago
    Process: 6263 ExecStart=/usr/bin/freshclam --quiet (code=exited, status=1/FAILURE)
    Main PID: 6263 (code=exited, status=1/FAILURE)

    Dec 23 14:33:45 Geldrop systemd[1]: Starting ClamAV virus database updater...
    Dec 23 14:33:45 Geldrop freshclam[6263]: ClamAV update process started at Wed Dec 23 14:33:45 2020
    Dec 23 14:33:45 Geldrop freshclam[6263]: main.cvd is up to date (version: 59, sigs: 4564902, f-level: 60, builder: sigmgr)
    Dec 23 14:33:45 Geldrop freshclam[6263]: daily.cld is up to date (version: 26026, sigs: 4328586, f-level: 63, builder: raynman)
    Dec 23 14:33:45 Geldrop freshclam[6263]: bytecode.cvd is up to date (version: 331, sigs: 94, f-level: 63, builder: anvilleg)
    Dec 23 14:33:45 Geldrop systemd[1]: clamav-freshclam.service: Main process exited, code=exited, status=1/FAILURE
    Dec 23 14:33:45 Geldrop systemd[1]: Failed to start ClamAV virus database updater.
    Dec 23 14:33:45 Geldrop systemd[1]: clamav-freshclam.service: Unit entered failed state.
    Dec 23 14:33:45 Geldrop systemd[1]: clamav-freshclam.service: Failed with result 'exit-code'.

 

The following I did after reading the following web-page (https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=972974😞
stopping clamav: 'systemctl stop clamav-daemon'

stopping clamav freshclam: 'systemctl stop clamav-freshclam'

adjusting member 'usr.bin.freshclam' in dir: /etc/apparmor.d ; adding 'capability dac_override,' and 'capability chown,'

 

          capability setgid,
          capability setuid,
          capability dac_override,
          capability chown,

 

removing all file from dir: '/var/lib/clamav' (bytecode ; daily ; main ; mirrors ; antivir)

starting clamav : 'systemctl start clamav-daemon'

starting clamav freshclam: 'systemctl start clamav-freshclam'

 

starting 'clamav freshclam' takes a while (about 2 minutes, I guess) and afterwards it looks like the normal databased-updater is working again.... lets see what happens the coming days...

 

regards

 

 

View solution in original post

Message 197 of 339

All Replies
HansRL
Apprentice

Re: Antivirus scanner definition file update failed

some info found in clamscan.log:

 

----------- SCAN SUMMARY -----------
Known viruses: 7765153
Engine version: 0.100.2
Scanned directories: 1492
Scanned files: 9556
Infected files: 0
Total errors: 3
Data scanned: 704.59 MB
Data read: 7622.16 MB (ratio 0.09:1)
Time: 627.740 sec (10 m 27 s)

-------------------------------------------------------------------------------

ERROR: Malformed database

----------- SCAN SUMMARY -----------
Known viruses: 3731217
Engine version: 0.100.2
Scanned directories: 0
Scanned files: 0
Infected files: 0
Data scanned: 0.00 MB
Data read: 0.00 MB (ratio 0.00:1)
Time: 119.501 sec (1 m 59 s)

-------------------------------------------------------------------------------

 

Message 2 of 339
StephenB
Guru

Re: Antivirus scanner definition file update failed

Maybe try turning off antivirus, and then turn it on again???

Message 3 of 339
HansRL
Apprentice

Re: Antivirus scanner definition file update failed

Tried it, but turning of and on again did not solve it... only restart the readynas solves it for a couple of days...

Message 4 of 339
JohnCM_S
NETGEAR Employee Retired

Re: Antivirus scanner definition file update failed

Hi HansRL,

 

Can you try assigning a static DNS on the NAS and see if you will still get the same issue? If you will still get the same issue. can you get the full logs of the NAS after experiencing it and provide it to us so we can check?

 

You may upload it to a file-sharing site then send me the download link via private message.

 

Regards,

Message 5 of 339
HansRL
Apprentice

Re: Antivirus scanner definition file update failed

Which LOG's do you need? and were can I find them?

Message 6 of 339
StephenB
Guru

Re: Antivirus scanner definition file update failed


@HansRL wrote:

Which LOG's do you need? and were can I find them?


You download the full log zip from the logs page in the admin web ui.  Then give them the full set.  Don't post them publicly, there is some information leakage.

Message 7 of 339
HansRL
Apprentice

Re: Antivirus scanner definition file update failed

send private message

Message 8 of 339
dweinshel
Tutor

Re: Antivirus scanner definition file update failed

I have had the same issue for the same duration

I use a satic IP

Will try NAS reboot

 

Please let me know if any solution is found.

Thanks

DW

Model: RN212|2 BAY Desktop ReadyNAS Storage
Message 9 of 339
dweinshel
Tutor

Re: Antivirus scanner definition file update failed

Cold reboot did not solve problem.

Failed update started again today.

DW

Model: RN202|ReadyNAS202 2-Bay
Message 10 of 339
StephenB
Guru

Re: Antivirus scanner definition file update failed


@dweinshel wrote:

Cold reboot did not solve problem.

 


Did this just start failing, or has it never worked?

Message 11 of 339
dweinshel
Tutor

Re: Antivirus scanner definition file update failed

It started in early July after no issues for ?12 months of ownership.

No hardware or software changes.

 

I also have a ReadyNAS 102 for which antivirus was no longer supported.

Just before the sunsetting of antivirus on that device there were "similar" antivirus issues--running out of space in the ?root directory.

Sorry if that is off topic.

DW

Message 12 of 339
StephenB
Guru

Re: Antivirus scanner definition file update failed


@dweinshel wrote:

I also have a ReadyNAS 102 for which antivirus was no longer supported.

Just before the sunsetting of antivirus on that device there were "similar" antivirus issues--running out of space in the ?root directory.

Sorry if that is off topic.


It's not off-topic.  Are you tried downloading the log zip file?  You can then check the fullness of the root folder.

 

Though it could well be an issue somewhere else (including something going on with the ClamAV servers).

Message 13 of 339
HansRL
Apprentice

Re: Antivirus scanner definition file update failed

It started for me at July 5th (before that date for more then 2 years no issue with the virus updates)

 

Strangly when I update manually by using FRESHCLAM update ended OK.
How can I see whether my "ROOT" directory is full and if so, what could I eventually remove?

Message 14 of 339
StephenB
Guru

Re: Antivirus scanner definition file update failed


@HansRL wrote:


How can I see whether my "ROOT" directory is full and if so, what could I eventually remove?


One way is to look in the current log file.  Though you might find that the NAS can't download it if the OS partition is full.

 

Look at volume.log, and scroll down to this section:

=== df -h ===
Filesystem      Size  Used Avail Use% Mounted on
udev             10M  4.0K   10M   1% /dev
/dev/md0        3.7G  518M  3.0G  15% /
tmpfs          1009M  8.0K 1009M   1% /dev/shm
...
=== df -i ===
Filesystem      Inodes IUsed   IFree IUse% Mounted on
udev            187951   234  187717    1% /dev
/dev/md0       1048576 12416 1036160    2% /
tmpfs           188842     3  188839    1% /dev/shm
...

You can also look at this with ssh.  Since there are a lot of mount points, it's best to mount the OS partition somewhere else

# mount --bind / /mnt
# df -h /mnt
# df -i /mnt

When done, enter

# umount /mnt

Note that in ARM ReadyNAS, the OS partition is ext. 

 

In x86 ReadyNAS, the OS partition is btrfs - so you'd use btrfs commands to examine the fullness, and not df. One exception: if you migrated  your disks to an x86 NAS from an ARM NAS, then the OS partition remains ext.

 


@HansRL wrote:

 

Strangely when I update manually by using FRESHCLAM update ended OK.


I have see this a couple times before.  Sometimes the clamav repositories have some failed servers - not sure if they are re-arranging them, or if something else is going on.  That can trigger failures in updating the definitions or the software.  There could be other causes of course.

 

I don't run the AV package on my own NAS, so I haven't played with this for quite a while.

Message 15 of 339
CJDEN
Tutor

Re: Antivirus scanner definition file update failed

I have a RN212 and a RN214 connected to the same network, and Im experiencing the same update issue on both devices. According to the log on the RN212 the problem/first error message started july 10. It did update update both on the 11'th and 12'th, but then got stuck at the 12'th of july. No updates since then, and I get the error message daily when it start-up in the morning.

 

According to the log on the RN214 the problem/first error message started july 12. However dispite a daily error message after start-up it continues to update the antivirus. From the 17'th the RN214 has updated without error messages.

 

So - the 214 had some 'hick-ups' but seems to be back on track, however the 212 did not, and is stuck at june 12'th update.

 

In the log of the 212 and the 214 the file "clamscan.log" do display the following error: 

ERROR: Malformed database

on some of the entries....

 

Restarting the 212 do not fix the issue, and I'm clueless as what to do 😞 

Model: RN212|2 BAY Desktop ReadyNAS Storage
Message 16 of 339
HansRL
Apprentice

Re: Antivirus scanner definition file update failed

I don't think my ROOT-directory is an issue....,

=== df -h ===
Filesystem Size Used Avail Use% Mounted on
udev 10M 4.0K 10M 1% /dev
/dev/md0 3.7G 1.2G 2.3G 35% /
tmpfs 1009M 4.0K 1009M 1% /dev/shm
tmpfs 1009M 1.2M 1008M 1% /run
tmpfs 505M 12M 493M 3% /run/lock
tmpfs 1009M 0 1009M 0% /sys/fs/cgroup
/dev/md127 5.5T 1.2T 4.4T 21% /data
/dev/md127 5.5T 1.2T 4.4T 21% /home
/dev/md127 5.5T 1.2T 4.4T 21% /apps
=== df -i ===
Filesystem Inodes IUsed IFree IUse% Mounted on
udev 187927 228 187699 1% /dev
/dev/md0 1048576 13428 1035148 2% /
tmpfs 188818 2 188816 1% /dev/shm
tmpfs 188818 450 188368 1% /run
tmpfs 188818 30 188788 1% /run/lock
tmpfs 188818 9 188809 1% /sys/fs/cgroup
/dev/md127 0 0 0 - /data
/dev/md127 0 0 0 - /home
/dev/md127 0 0 0 - /apps

Message 17 of 339
dweinshel
Tutor

Re: Antivirus scanner definition file update failed

Sorry if this is a duplicate

I checked the volume.zip and there is plenty of space.

The problem continues, however.

Thanks

DW

Message 18 of 339
StephenB
Guru

Re: Antivirus scanner definition file update failed


@dweinshel wrote:

I checked the volume.zip and there is plenty of space.

The problem continues, however.


Did you try turning off AV and then turning it on again?

 

Also, you could also try changing your DNS to 8.8.8.8 in the NAS.

Message 19 of 339
dweinshel
Tutor

Re: Antivirus scanner definition file update failed

I have truned AV on and off.

Any downside to DNS 8.8.8.8 ?

Message 20 of 339
StephenB
Guru

Re: Antivirus scanner definition file update failed


@dweinshel wrote:

Any downside to DNS 8.8.8.8 ?


Latency of resolving domain names might be a bit higher - generally not a concern for a NAS.

 

It's google's public DNS server, so they'd be getting a bit more information on you.  Per their privacy statement: 

 

https://developers.google.com/speed/public-dns/privacy

 

Moreover, Google does not use any personal information collected through the Public DNS service to target ads.

We do not correlate or associate personal information in Google Public DNS logs with your information from use of any other Google service except for addressing security and abuse.


 

8.8.4.4 is another public google DNS. Another popular public DNS is CloudFlare's - 1.1.1.1

 

Message 21 of 339
HansRL
Apprentice

Re: Antivirus scanner definition file update failed

As already stated earlier.. Turning off AV and starting it again does not solve it... I also defined a static DSN (8.8.8.8 first). The only things which works for now is:
1) reboot of the NAS
2) run (manual) a FRESHCLAM

both of the above by-passes results in working normal update of AV for mostly 2 days...

 

as third option I now added FRESHCLAM to the crontab, see if this bypasses the issue permanently....

 

rgds

Message 22 of 339
dweinshel
Tutor

Re: Antivirus scanner definition file update failed

8.8.8.8 did not work for me either.

 

What is FRESHCLAM?

 

Is this site monitored by Netgear?

 

It is helpful in my assessment that others are having this problem, but it doesn't seem like many are.

With previous system problems it seemed this community was very active.

 

Thanks for any help.
DW

Message 23 of 339
StephenB
Guru

Re: Antivirus scanner definition file update failed


@dweinshel wrote:

What is FRESHCLAM?

 


The AV package that is installed is called ClamAV ( https://www.clamav.net/ )

 

freshclam is a command used by that package: https://linux.die.net/man/1/freshclam

 


@dweinshel wrote:

 

Is this site monitored by Netgear?

 


Yes, the two mods are @JohnCM_S and @Marc_V Hopefully they will chime in, and tell us if this is a known issue Netgear is working on.

Message 24 of 339
bsailer
Aspirant

Re: Antivirus scanner definition file update failed

Any news on this topic?

I'm having the same issue here:  ReadyNAS 212 with newest firmware 6.10.3, since 2020-07-22 getting mails about virus definition update fails (probably due to bad network connectivity, which is also outruled by the successful mail), getting the "ERROR: Malformed database", able to run freshclam successfully.
Best regards,
Benjamin

 

Message 25 of 339
Top Contributors
Discussion stats
Announcements