Koozali.org: home of the SME Server

Obsolete Releases => SME Server 7.x => Topic started by: Stuart on April 12, 2012, 01:07:44 AM

Title: Manual Clam db update
Post by: Stuart on April 12, 2012, 01:07:44 AM: Topic changed to reflect the real issue.

I have a server which is being sent a large amount of data every 75 minutes. The server has it's own dedicated pppoe connection (ie. a bridged modem). It has a local eth port, but it is NOT a gateway. How do I find out where this traffic is coming from and what it is?

Thanks
Title: Re: Tracing excessive traffic
Post by: Stuart on April 12, 2012, 01:23:52 AM: It appears to be an update for Clam. Where do I start fixing this?
Title: Re: Tracing excessive traffic
Post by: Stuart on April 12, 2012, 01:30:08 AM: Further info. It appears that yum is not working correctly. It gives the following
Code: [Select]
not using ftp, http[s], or file for repos, sI'll do some more looking and create a new more approriate thread.
Title: Re: Tracing excessive traffic
Post by: janet on April 12, 2012, 02:05:18 AM: Stuart

Quote
It appears that yum is not working correctly.

Try this
http://forums.contribs.org/index.php/topic,48424.0.html
Title: Re: Tracing excessive traffic
Post by: Stuart on April 12, 2012, 03:03:09 AM: Thanks Mary.

I had found that info and fixed yum. Just trying to complete the Clam update now.
Title: Manual Clam db update.
Post by: Stuart on April 12, 2012, 03:17:11 AM: Is there a way to manually trigger a Clam db update?
Title: Re: Manual Clam db update.
Post by: janet on April 12, 2012, 05:42:00 AM: Stuart

You can look in the messages log file to see what commands are run automatically, and then run them manually.
Look in /etc/e-smith/events, and look at cron jobs, also look at the code.
Title: Re: Manual Clam db update
Post by: Stefano on April 12, 2012, 07:13:46 AM: from root's shell

Code: [Select]
freshclam
Title: Re: Manual Clam db update
Post by: Stuart on April 12, 2012, 07:45:41 AM: It tries a few times, failing each time, as below.
Code: [Select]
[root@mail /]# freshclam ClamAV update process started at Thu Apr 12 15:42:03 2012 main.cld is up to date (version: 54, sigs: 1044387, f-level: 60, builder: sven) WARNING: getfile: daily-12639.cdiff not found on remote server (IP: 193.1.193.64) WARNING: getpatch: Can't download daily-12639.cdiff from db.local.clamav.net WARNING: getfile: daily-12639.cdiff not found on remote server (IP: 116.240.207.20) WARNING: getpatch: Can't download daily-12639.cdiff from db.local.clamav.net WARNING: getfile: daily-12639.cdiff not found on remote server (IP: 117.104.160.194) WARNING: getpatch: Can't download daily-12639.cdiff from db.local.clamav.net WARNING: getpatch: Can't download daily-12639.cdiff from db.local.clamav.net WARNING: getfile: daily-12639.cdiff not found on remote server (IP: 193.1.193.64) WARNING: getpatch: Can't download daily-12639.cdiff from db.local.clamav.net WARNING: getfile: daily-12639.cdiff not found on remote server (IP: 116.240.207.20) WARNING: getpatch: Can't download daily-12639.cdiff from db.local.clamav.net WARNING: Incremental update failed, trying to download daily.cvd Downloading daily.cvd [100%] [LibClamAV] *********************************************************** [LibClamAV] *** This version of the ClamAV engine is outdated. *** [LibClamAV] *** DON'T PANIC! Read http://www.clamav.net/support/faq *** [LibClamAV] *********************************************************** WARNING: Mirror 193.1.193.64 is not synchronized. Trying again in 5 secs... ClamAV update process started at Thu Apr 12 15:43:18 2012 main.cld is up to date (version: 54, sigs: 1044387, f-level: 60, builder: sven) WARNING: getfile: daily-12639.cdiff not found on remote server (IP: 116.240.207.20) WARNING: getpatch: Can't download daily-12639.cdiff from db.local.clamav.net WARNING: getfile: daily-12639.cdiff not found on remote server (IP: 117.104.160.194) WARNING: getpatch: Can't download daily-12639.cdiff from db.local.clamav.net WARNING: getpatch: Can't download daily-12639.cdiff from db.local.clamav.net WARNING: getfile: daily-12639.cdiff not found on remote server (IP: 193.1.193.64) WARNING: getpatch: Can't download daily-12639.cdiff from db.local.clamav.net WARNING: getfile: daily-12639.cdiff not found on remote server (IP: 116.240.207.20) WARNING: getpatch: Can't download daily-12639.cdiff from db.local.clamav.net WARNING: getfile: daily-12639.cdiff not found on remote server (IP: 117.104.160.194) WARNING: getpatch: Can't download daily-12639.cdiff from db.local.clamav.net WARNING: Incremental update failed, trying to download daily.cvd Downloading daily.cvd [100%] [LibClamAV] *********************************************************** [LibClamAV] *** This version of the ClamAV engine is outdated. *** [LibClamAV] *** DON'T PANIC! Read http://www.clamav.net/support/faq *** [LibClamAV] *********************************************************** WARNING: Mirror 193.1.193.64 is not synchronized. Trying again in 5 secs... ClamAV update process started at Thu Apr 12 15:44:32 2012
Title: Re: Manual Clam db update
Post by: Stefano on April 12, 2012, 08:16:47 AM: delete the /var/clamav/mirrors.dat file and retry
Title: Re: Manual Clam db update
Post by: Stuart on April 12, 2012, 08:29:04 AM: Stefano,

You, my friend, are the man! (if you're not a man, please pm me so I can apologize, if you know what I mean)

All updated successfully. 3 days to work out all that I just had to delete 1 file.

Thank you to you and Mary.

Stuart
Title: Re: Manual Clam db update
Post by: Stefano on April 12, 2012, 09:19:08 AM: you are welcome.. and yes, unfortunately, I am a man.. :-)