Topic: SME 9.2 freshclam update failed

[bosco555]

Janet...some systems might need:
mkdir -p /etc/e-smith/templates-custom/etc/freshclam.conf first..

[janet]

Dear All

It seems db.de.clamav.net DatabaseMirror is now playing up in Sydney, Oz. Getting hourly messages of failures to update.

Specifying multiple database hosts is probably a good idea.

[TerryF]

G'day janet..

Only way I have been able to prevent the constant errors and get a server to be consistent, is to use an actual ip that I know is working and manually edit the conf file. Don't want to muck about with the template just yet.

DatabaseMirror 198.148.78.4
DatabaseMirror 172.255.51.117
# DatabaseMirror db.local.clamav.net
# DatabaseMirror database.clamav.net

First is in US second French..

The database.clamav.net url is now useless and resolves to an error, hence why I have hashed it out.

db is set to the first ip..

Did what the clamav ML described..

Found what ips resolved from locale urls

[root@fagehome ~]# host db.fr.clamav.net
db.fr.clamav.net has address 46.29.125.16
db.fr.clamav.net has address 51.15.177.217
db.fr.clamav.net has address 178.32.100.7
db.fr.clamav.net has address 178.33.105.132
db.fr.clamav.net has address 193.52.101.131
db.fr.clamav.net has address 212.180.1.29
[root@fagehome ~]# host db.us.clamav.net
db.us.clamav.net is an alias for db.us.big.clamav.net.
db.us.big.clamav.net has address 69.12.162.28
db.us.big.clamav.net has address 69.163.100.14
db.us.big.clamav.net has address 150.214.142.197
db.us.big.clamav.net has address 155.98.64.87
db.us.big.clamav.net has address 194.8.197.22
db.us.big.clamav.net has address 198.148.78.4
db.us.big.clamav.net has address 200.236.31.1
db.us.big.clamav.net has address 204.130.133.50

Checked each one to see what actually worked..voila..

The big problem right now is the problems clam is having with the database.clamav.net url it is supposed to be the last resort fallback, its borked..

If I have to reboot a server I will manually edit the freshclam.conf as above

Added:  This definitively told me it was working   # wget http://198.148.78.4/bytecode.cvd
most of the IPs didn't

[brianr]

Seems to be failing intermittently in the UK as well (again!).

[ReetP]

Please see the latest from the Clam AV list

Mirror issues and what we are doing to fix it

http://lists.clamav.net/pipermail/clamav-users/2017-August/005038.html

[brianr]

Please see the latest from the Clam AV list

Mirror issues and what we are doing to fix it

http://lists.clamav.net/pipermail/clamav-users/2017-August/005038.html

Sounds promising.....

[ReetP]

Sounds promising.....

Never know your luck

[TerryF]

Never know your luck

All bad unfortunately, actually it never got to good

Since the dirty temp fix above, last 24hrs updates are working and no freshclam error emails.

database.clamav.net is still borked...

[TerryF]

Some more knowledge from the Clam ML:  http://lists.clamav.net/pipermail/clamav-users/2017-August/005046.html

[janet]

TerryF

Just to get things working again using good hosts, pending a resolve from Clamav, I did:

edited the DatabaseMirror custom template referred to earlier to read

{
# Uncomment the following line and replace XY with your country
# code. See http://www.iana.org/cctld/cctld-whois.htm for the full list.
# Default: There is no default, which results in an error when running freshclam

    $OUT = "DatabaseMirror db.us.clamav.net\n";

# database.clamav.net is a round-robin record which points to our most
# reliable mirrors. It's used as a fall back in case db.XY.clamav.net is
# not working. DO NOT TOUCH the following line unless you know what you
# are doing.
    $OUT .= "DatabaseMirror db.jp.clamav.net";
}

Save
Ctrl + o

signal-event email-update
refreshclam

Seems to be OK again

[TerryF]

Seems to be OK again

That'll do it mate...its looking like it will be some days until they sort out host and mirror issues etc..

Unfortunately as we know small number of routes in and out of OZ, doesn't take much to make connectivity problamatic
 

[TerryF]

Clam looks to have resolved their mirror and domain issues, have now returned all my config and db properties back to defaults, working OK.

Of note for us in the land of oz and long white clouds , db.local.clamav.net is now aliased via .au to the us mirrors..

[root@fagehome ~]# host db.local.clamav.net
db.local.clamav.net is an alias for db.au.clamav.net.
db.au.clamav.net is an alias for db.us.rr.clamav.net.
db.us.rr.clamav.net has address 204.130.133.50
db.us.rr.clamav.net has address 194.8.197.22
db.us.rr.clamav.net has address 128.199.133.36

[robf355]

Still failing in the UK:
2017-09-01 13:54:21.406842500 ClamAV update process started at Fri Sep  1 13:54:21 2017
2017-09-01 13:54:21.407112500 main.cld is up to date (version: 58, sigs: 4566249, f-level: 60, builder: sigmgr)
2017-09-01 13:54:21.710865500 WARNING: getpatch: Can't download daily-23736.cdiff from database.clamav.net
2017-09-01 13:54:21.711281500 WARNING: getpatch: Can't download daily-23736.cdiff from database.clamav.net
2017-09-01 13:54:21.711595500 WARNING: getpatch: Can't download daily-23736.cdiff from database.clamav.net
2017-09-01 13:54:21.711915500 WARNING: getpatch: Can't download daily-23736.cdiff from database.clamav.net
2017-09-01 13:54:21.712240500 WARNING: getpatch: Can't download daily-23736.cdiff from database.clamav.net
2017-09-01 13:54:21.712587500 ERROR: getpatch: Can't download daily-23736.cdiff from database.clamav.net
2017-09-01 13:54:21.740925500 WARNING: Incremental update failed, trying to download daily.cvd
2017-09-01 13:54:21.741263500 Trying host database.clamav.net (193.1.193.64)...
2017-09-01 13:54:21.904787500 WARNING: getfile: daily.cvd not found on database.clamav.net (IP: 193.1.193.64)
2017-09-01 13:54:21.904942500 ERROR: Can't download daily.cvd from database.clamav.net
2017-09-01 13:54:21.905329500 Giving up on database.clamav.net...
2017-09-01 13:54:21.905330500 Update failed. Your network may be down or none of the mirrors listed in /etc/freshclam.conf is working. Check http://www.clamav.net/doc/mirrors-faq.html for possible reasons.

[brianr]

Still failing in the UK:
2017-09-01 13:54:21.406842500 ClamAV update process started at Fri Sep  1 13:54:21 2017
2017-09-01 13:54:21.407112500 main.cld is up to date (version: 58, sigs: 4566249, f-level: 60, builder: sigmgr)
2017-09-01 13:54:21.710865500 WARNING: getpatch: Can't download daily-23736.cdiff from database.clamav.net
2017-09-01 13:54:21.711281500 WARNING: getpatch: Can't download daily-23736.cdiff from database.clamav.net
2017-09-01 13:54:21.711595500 WARNING: getpatch: Can't download daily-23736.cdiff from database.clamav.net
2017-09-01 13:54:21.711915500 WARNING: getpatch: Can't download daily-23736.cdiff from database.clamav.net
2017-09-01 13:54:21.712240500 WARNING: getpatch: Can't download daily-23736.cdiff from database.clamav.net
2017-09-01 13:54:21.712587500 ERROR: getpatch: Can't download daily-23736.cdiff from database.clamav.net
2017-09-01 13:54:21.740925500 WARNING: Incremental update failed, trying to download daily.cvd
2017-09-01 13:54:21.741263500 Trying host database.clamav.net (193.1.193.64)...
2017-09-01 13:54:21.904787500 WARNING: getfile: daily.cvd not found on database.clamav.net (IP: 193.1.193.64)
2017-09-01 13:54:21.904942500 ERROR: Can't download daily.cvd from database.clamav.net
2017-09-01 13:54:21.905329500 Giving up on database.clamav.net...
2017-09-01 13:54:21.905330500 Update failed. Your network may be down or none of the mirrors listed in /etc/freshclam.conf is working. Check http://www.clamav.net/doc/mirrors-faq.html for possible reasons.

Working here (in the UK).