Re: Antivirus scanner definition file update failed

Matteo73 · ‎2021-02-03

Thx for your quickly support.

I saw by ssh that the problem was not enought memory on my Readynas HW.
Btw on older readynas 102xx with the lastest fw, netgear disabled antivirus option, so I think they are adopting on next update the same solution 😞

At the moment I'll try what you suggest.

Best regards

Matteo

Sandshark · ‎2021-02-03

@HansRL wrote:

This is my freshclam now:
    DatabaseOwner root
    LogSyslog true
    LogFacility LOG_LOCAL6
    Debug false
    MaxAttempts 5
    DatabaseDirectory /var/lib/clamav
    DNSDatabaseInfo current.cvd.clamav.net
    ConnectTimeout 120
    ReceiveTimeout 120
   TestDatabases false
   ScriptedUpdates true
   CompressLocalDatabase false
   Bytecode true
   NotifyClamd /etc/clamav/clamd.conf
   OnErrorExecute /usr/bin/clamav_event -s 1
   OnUpdateExecute /usr/bin/clamav_event -s 0
   Checks 2
   DatabaseMirror database.clamav.net
   DatabaseMirror db.cn.clamav.net
   DatabaseMirror db.tw.clamav.net

The red wasn't showing up (though it did when I imported it to reply), so I made the change bold so others would notice it, which I hope will work.

StephenB · ‎2021-02-03

@Matteo73 wrote:

Btw on older readynas 102xx with the lastest fw, netgear disabled antivirus option, so I think they are adopting on next update the same solution 😞

I don't think they will do that, as there are other desktop models that also have 2 GB of RAM. Plus they have a simple solution. They should have pushed a hot-fix for it months ago - no idea why they didn't.

The RN100 series only had 512 GB, which turned out not to be enough to run all the services as time went on.

@HansRL: thanks for posting what they changed.

HansRL · ‎2021-02-05

Unfortunately I have to say the solution advised by NETGEAR did not solve it....

the first time wrong (second time the normal update-proces ran) I got next messages in the log:
feb 04, 2021 15:17:14 Systeem: ReadyNASOS-achtergrondservice is gestart.

feb 04, 2021 15:17:07 Systeem: ReadyNASOS-service of -proces (readynasd) is opnieuw gestart.

feb 04, 2021 15:15:53 Systeem: ReadyNASOS-service of -proces (enclosure_monit) is opnieuw gestart.

the following normal update i got the well know message:

feb 05, 2021 15:16:04 Systeem: Bijwerken van definitiebestand van antivirusscanner is mislukt door een fout bij het downloaden. Controleer uw internetverbinding..

rgds Hans

Matteo73 · ‎2021-02-05

The only way is to wait an update from Netgear, but it has been for serevarl months that we are speaking about this issue without solution. There is also any beta OS relase 😞

Matteo

Sandshark · ‎2021-02-05

If that fix works for all, it could probably be fixed via a hot fix rather than a whole new OS version.

scrjs · ‎2021-02-08

Hi All,

Yesterday I raised a new post to this community in https://community.netgear.com/t5/ReadyNAS-Storage-Apps-Current/freshclam-AV-stops-updating-on-my-Rea... .

This thread discusses the same issue.

@StephenB suggested in my post above "There's a much longer thread on this here: https://community.netgear.com/t5/Using-your-ReadyNAS-in-Business/Antivirus-scanner-definition-file-u...

If you have ssh enabled, you could try manually editing /etc/freshclam.conf as described here: : https://community.netgear.com/t5/Using-your-ReadyNAS-in-Business/Antivirus-scanner-definition-file... It'd be useful to know if it solves the problem."

I have implemented the change as suugested by @HansRL in /etc/freshclam.conf and changed

TestDatabases true
to
TestDatabases false

Freshclam still runs sucessfully after the change.

I am no monitoring if this resolves the issue...

many thanks @StephenB and @HansRL

scrjs · ‎2021-02-10

The AV has updated twice since TestDatabases=false is set in my /etc/freshclam.conf.

Not conclusive that the problem has resolved, just positive progress

scrjs · ‎2021-02-15

Hi all

I checked again today (Feb 16) and the AV has not updated fince Feb 11 so sadly the change TestDatabases=false setting in my /etc/freshclam.conf has failed to rectify or workaround the issue as seen in the log below

I ran freshclam -v which ran successfully and my AV updated to 59.26081 from 59.26076 though there are some interesting messages highlighted below

Freshclam seems to have disabled the AV and did not re-enable it. This has not happened in the past. Any thoughts?

I manually enabled AV successfully as noted belowNow back to the successful running of Freshclam. These details are noted below. Nothing unusual execpt for the warning in red text at the end.

ClamAV update process started at Tue Feb 16 11:18:32 2021
Using IPv6 aware code
Querying current.cvd.clamav.net
TTL: 1349
Software version from DNS: 0.103.1
main.cvd version from DNS: 59
main.cld is up to date (version: 59, sigs: 4564902, f-level: 60, builder: sigmgr)
daily.cvd version from DNS: 26081
Retrieving http://database.clamav.net/daily-26077.cdiff
Trying to download http://database.clamav.net/daily-26077.cdiff (IP: 104.16.219.84)
Downloading daily-26077.cdiff [100%]
cdiff_apply: Parsed 10182 lines and executed 10182 commands
Retrieving http://database.clamav.net/daily-26078.cdiff
Trying to download http://database.clamav.net/daily-26078.cdiff (IP: 104.16.219.84)
Downloading daily-26078.cdiff [100%]
cdiff_apply: Parsed 11731 lines and executed 11731 commands
Retrieving http://database.clamav.net/daily-26079.cdiff
Trying to download http://database.clamav.net/daily-26079.cdiff (IP: 104.16.219.84)
Downloading daily-26079.cdiff [100%]
cdiff_apply: Parsed 11600 lines and executed 11600 commands
Retrieving http://database.clamav.net/daily-26080.cdiff
Trying to download http://database.clamav.net/daily-26080.cdiff (IP: 104.16.219.84)
Downloading daily-26080.cdiff [100%]
cdiff_apply: Parsed 10313 lines and executed 10313 commands
Retrieving http://database.clamav.net/daily-26081.cdiff
Trying to download http://database.clamav.net/daily-26081.cdiff (IP: 104.16.219.84)
Downloading daily-26081.cdiff [100%]
cdiff_apply: Parsed 10297 lines and executed 10297 commands
Loading signatures from daily.cld
Properly loaded 4010384 signatures from new daily.cld
daily.cld updated (version: 26081, sigs: 4051203, f-level: 63, builder: raynman)
Querying daily.26081.93.1.0.6810DB54.ping.clamav.net
Can't query daily.26081.93.1.0.6810DB54.ping.clamav.net
bytecode.cvd version from DNS: 331
bytecode.cld is up to date (version: 331, sigs: 94, f-level: 63, builder: anvilleg)
Database updated (8616199 signatures) from database.clamav.net (IP: 104.16.219.84)
WARNING: Clamd was NOT notified: Can't connect to clamd through /var/run/clamav/clamd.ctl: No such file or directory

I have searched the file system and indeed clamd.ctl does not exist anywhere on the file system.

Any thoughts on the missing clamd.ctl?

Cheers Rob

scrjs · ‎2021-02-15

Just FYI re WARNING: Clamd was NOT notified: Can't connect to clamd through /var/run/clamav/clamd.ctl: No such file or directory

Subsequent to the update (quoted below) I have discovered that "/var/run/clamav/clamd.ctl" was created after I enabled AV so I suspect this isnot a contributer to the AV not updating.

@scrjs wrote:
Hi all
I checked again today (Feb 16) and the AV has not updated fince Feb 11 so sadly the change TestDatabases=false setting in my /etc/freshclam.conf has failed to rectify or workaround the issue as seen in the log below

I ran freshclam -v which ran successfully and my AV updated to 59.26081 from 59.26076 though there are some interesting messages highlighted below
Freshclam seems to have disabled the AV and did not re-enable it. This has not happened in the past. Any thoughts?
I manually enabled AV successfully as noted belowNow back to the successful running of Freshclam. These details are noted below. Nothing unusual execpt for the warning in red text at the end.

ClamAV update process started at Tue Feb 16 11:18:32 2021
Using IPv6 aware code
Querying current.cvd.clamav.net
TTL: 1349
Software version from DNS: 0.103.1
main.cvd version from DNS: 59
main.cld is up to date (version: 59, sigs: 4564902, f-level: 60, builder: sigmgr)
daily.cvd version from DNS: 26081
Retrieving http://database.clamav.net/daily-26077.cdiff
Trying to download http://database.clamav.net/daily-26077.cdiff (IP: 104.16.219.84)
Downloading daily-26077.cdiff [100%]
cdiff_apply: Parsed 10182 lines and executed 10182 commands
Retrieving http://database.clamav.net/daily-26078.cdiff
Trying to download http://database.clamav.net/daily-26078.cdiff (IP: 104.16.219.84)
Downloading daily-26078.cdiff [100%]
cdiff_apply: Parsed 11731 lines and executed 11731 commands
Retrieving http://database.clamav.net/daily-26079.cdiff
Trying to download http://database.clamav.net/daily-26079.cdiff (IP: 104.16.219.84)
Downloading daily-26079.cdiff [100%]
cdiff_apply: Parsed 11600 lines and executed 11600 commands
Retrieving http://database.clamav.net/daily-26080.cdiff
Trying to download http://database.clamav.net/daily-26080.cdiff (IP: 104.16.219.84)
Downloading daily-26080.cdiff [100%]
cdiff_apply: Parsed 10313 lines and executed 10313 commands
Retrieving http://database.clamav.net/daily-26081.cdiff
Trying to download http://database.clamav.net/daily-26081.cdiff (IP: 104.16.219.84)
Downloading daily-26081.cdiff [100%]
cdiff_apply: Parsed 10297 lines and executed 10297 commands
Loading signatures from daily.cld
Properly loaded 4010384 signatures from new daily.cld
daily.cld updated (version: 26081, sigs: 4051203, f-level: 63, builder: raynman)
Querying daily.26081.93.1.0.6810DB54.ping.clamav.net
Can't query daily.26081.93.1.0.6810DB54.ping.clamav.net
bytecode.cvd version from DNS: 331
bytecode.cld is up to date (version: 331, sigs: 94, f-level: 63, builder: anvilleg)
Database updated (8616199 signatures) from database.clamav.net (IP: 104.16.219.84)
WARNING: Clamd was NOT notified: Can't connect to clamd through /var/run/clamav/clamd.ctl: No such file or directory
I have searched the file system and indeed clamd.ctl does not exist anywhere on the file system.
Any thoughts on the missing clamd.ctl?

Cheers Rob

AdriFrijters · ‎2021-02-17

@Sandshark , @Astra03 , @HansRL and all other experts,

Please is there anyone who wants to help us with a guide for dummies to solve the problem with te workaround you, experts seem to understand and I, a dummy doesn’t understand?

As it are only a few lines it cannot be time consuming and this topic is solved for the moment.

who has the guts to help the dummies?

As a matter of fact it is strange that Netgear or ClamAV wont do this.

Dummy Adri.

B_L · ‎2021-02-17

Hi @AdriFrijters,

Our engineering team is on CNY holidays. I can help to apply the fix for you. Please follow the link below to enable the SDM, then send me a private message and let me know the port number.

https://kb.netgear.com/000053266/ReadyNAS-OS-6-Enabling-Secure-Diagnostics-Mode

When the engineering team is back to work next week, we will release a hotfix to resolve this issue.

AdriFrijters · ‎2021-02-18

dear Moderator,

then send me a private message and let me know the port number.

How do I do this, 'in private'.

Astra03 is willing to give help in a dummy way.

all can read and do the same. Perhaps this helps all dummies with this problem and

So Yes, I accept help but for the bennifit of all, it seems best to get the instruction in a simple way.

Adri.

StephenB · ‎2021-02-18

@AdriFrijters wrote:

How do I do this, 'in private'.

You send a private message using the envelope icon at the top right of the forum page - right next to your user picture.

tewatson60 · ‎2021-02-22

I looked through this thread and cannot find a logical explanation as to why this has gone on for several months. Anyone from Netgear care to offer an answer? Simple sentences, two-syllable words - why has this not been addressed?

Tom

TerryJColes · ‎2021-02-23

After I applied the fix suggested by various posters here last Descember, my system has worked fine until today. At 1453 GMT today I got the dreaded 'Antivirus scanner definition file update failed due to download failure. Check your Internet connection.' message.

Come on Netgear what gives? I can't remember what Firmware Version was installed the last time I looked, but it's now at 6.10.4. I have 'Automatic hotfix updates' enabled so I'nm assuming that Netgear have rolled out a new version which still contains this bug.

B_L · ‎2021-02-23

Hi @TerryJColes,

We are still working on the hotfix and it will be released soon. Before that, I can help to apply the fix for you. Please follow the link below to enable the SDM, then send me a private message and let me know the port number.

https://kb.netgear.com/000053266/ReadyNAS-OS-6-Enabling-Secure-Diagnostics-Mode

TerryJColes · ‎2021-02-23

@B_L wrote:
Hi @TerryJColes,

We are still working on the hotfix and it will be released soon. Before that, I can help to apply the fix for you. Please follow the link below to enable the SDM, then send me a private message and let me know the port number.
https://kb.netgear.com/000053266/ReadyNAS-OS-6-Enabling-Secure-Diagnostics-Mode

Thanks for the offer, but I would prefer to apply the fix myself. I know how to do it, having done it originally a couplee of months ago and will do so once I have a little spare time.

Marc_V · ‎2021-03-04

@dweinshel

You may want to try and get the latest update. Kindly connect your NAS to the Internet and reboot if possible then wait for a few minutes. A hotfix should be downloaded automatically.

TerryJColes · ‎2021-03-04

@Marc_V wrote:

You may want to try and get the latest update. Kindly connect your NAS to the Internet and reboot if possible then wait for a few minutes. A hotfix should be downloaded automatically.

Well that happened just as predicted.

If I get the dreaded definition file update failed message, I'll report back.

scrjs · ‎2021-03-04

The hotfix was automatically applied to my ReadyNAS per the Logs view within the Unser Interface which will have as noted below
Lets hope this is now fixed
Log entry to look for:

Mar 04, 2021 05:08:47 PM

System: A hotfix was applied to your system (6.10.4 Hotfix 1).

at4roku1 · ‎2021-03-06

Thank you, Netgear, since a happy event never comes late: 3 succesful anti virus updates since the hotfix.

TerryJColes · ‎2021-03-06

@TerryJColes wrote:
If I get the dreaded definition file update failed message, I'll report back.

I didn't. Fingers crossed that this is the last time I will need to post here.

HansRL · ‎2021-03-07

Hi all,

First of all it looks promising this hotfix, already 2 updates went well and without any issue.

On March 5th, I did saw in the system main-view it mentioned "Firmware : 6.10.4 hotfix 1 " , but checking the logs I had my doubts...

no entry in the log regarding the update to hotfix 1 and found also next message:
rn-update.sh[14483]: E: Sub-process /usr/bin/dpkg returned an error code (1)

first tried a reboot but still finding entries in logs which gives me indications the hotfix was NOT installed correctly

so I did a reinstall of the firmware with version 6.10.4 and immediately after finishing this reinstall I got an entry in the log stating
"A hotfix was applied to your system (6.10.4 Hotfix 1)."
And of course checking again the logs:
readynasd[2373]: A hotfix was applied to your system (6.10.4 Hotfix 1).

rgds

tewatson60 · ‎2021-03-10

AV updates failing again - two days straight now. Firmware v6.10.4 Hotfix 1 was applied last month and seemed to work for a while. This is becoming tedious.

Tom