clamav and freshclam update failures

[ridenotwalk]

The Help Manual has the best-practice guide specifically designed for Linux Lite.

Hi Jerry,
I used your tut to setup clamav on my laptop using LL4.2 UEFI and had the same timeout occur. At the time I cancelled the download and continued on to running a scan thinking I would search for a solution later. I did look at the user manual with no result and after searching for and trying several ideas I still had the timeout so put it in my sort out later basket.
Between then and now I decided to try LM on my laptop as I currently have LM on my main desktop which is packed away as I'm doing some renos to the house :-)  mostly because I wanted to compare LL to LM
I used your tut to setup clamav again, this time on LM 19.3 and encountered the same issues as I encountered using LL. I thought that the timeout might be related to the super awsome internet we get here in Oz so tried the changes and it solved the timeout problem for me so thought I'd share.

[Jan]

How did you initially install clamav?

Sent from my Mobile phone using Tapatalk

Well, truth be told, that's where I messed up initially, Jerry.  After installing the new 4.8 and downloading the updates, I went to the Synaptics Folder and started downloading the clamav from there.  I think I might have checked off some folders that I should not have checked.  When I ran into problems I checked the forum and saw where you referred another user to the clamav tutorial, which is very straight forward and easy to follow.  Afterward I thought maybe I should just do a fresh re-install of 4.8 and overwrite the existing one.  I started to do that but got nervous when I came to the re-partitioning part and wasn't sure how to proceed in overwriting it.  By then it was close to 2 am.  I thought it was best to shut things down at that point before I did something really stupid. 

[Jan]

I ran into the same problem and this is what I did and it worked for me....

...again to have it time out.
Using the file manager, logged in as root, I found and edited the freshclam.conf file changing ConnectTimeout to 300 and RecieveTimeout to 300. I also changed Checks to 6 but that's me, you don't have to do this.
The idea behind changing the timeouts was due to the awsomely great and fantastic internet we get here in Oz, I figured it was taking too long to download the DB's and freshclam times out for me.

I ran

Code:

sudo freshclam

again and the DB finished downloading and passed checks

Moments ago I ran

Code:

sudo freshclam

and got

Code:

Sun Mar  8 12:22:47 2020 -> ClamAV update process started at Sun Mar  8 12:22:47 2020
Sun Mar  8 12:22:47 2020 -> daily.cvd database is up to date (version: 25744, sigs: 2210896, f-level: 63, builder: raynman)
Sun Mar  8 12:22:47 2020 -> main.cvd database is up to date (version: 59, sigs: 4564902, f-level: 60, builder: sigmgr)
Sun Mar  8 12:22:47 2020 -> bytecode.cvd database is up to date (version: 331, sigs: 94, f-level: 63, builder: anvilleg)

Thank you for your post.  I followed your advice to purge the clamav, but was not able to open the root folder in the file manager because it has a big X on it, so I skipped that part.  I then reinstalled the clamav, but followed the instructions in the tutorial.  Even so, I still ended up with the same four ERROR messages as before.  I ran both

sudo rm /var/log/clamav/freshclam.log
sudo rm -rf /var/log/clamav/freshclam.log

... but the problem is still the same the updates fail to load because it times out.  Seems like it could be a case of slow internet speed here too.

I would like to change the time connect settings in the freshclam.conf file as you did, but how to I get past the big X on the root folder in the File Manager?

[ridenotwalk]

I'm not using LL at the moment so created a live USB using LL4.2UEFI as I know it works on this laptop I'm using right now. The steps below are using that so if you are using a different version of LL you may need to adjust accordingly.


From Menu, select My Computer then File System

Anywhere in the white space right click and select Open as administrator
You will likely be asked to enter your password. PLEASE NOTE, you are now working as root and ANYTHING you do from now will be done without LL asking you for permission as it thinks you know what you are doing so does it. You can harm your computer without careful consideration of what you are doing so please if you are not comfortable with what you are about to do, don't do it and close the pane/window

Anywhere is the white space right click and select Search here

The search pane will open, search for freshclam.conf

Once the search has finished (it might find several directories/files) open the file as normal.

Find the ConnectTimeout and RecieveTimeout entries and change them to 300 (300 seconds). Default is 30 IIRC

Click save

Close each pane/window as you normally would until you are back to the desktop.

Open Terminal and

Code:

sudo freshclam

If you get the errors

Code:

sudo rm /var/log/clamav/freshclam.log

You can do

Code:

sudo rm -rf /var/log/clamav/freshclam.log

if you like, I just prefer not to as the -rf scares me a bit right now till I learn more

Code:

sudo freashclam

again and it should update as normal.

[Jan]

Thank you for your reply!  Ok, as I type this, I'm at the part where you have written as follows:
"Once the search has finished (it might find several directories/files) open the file as normal."

I have the freshclam.conf open and it shows 24 files - but none of them have the word "normal" in them.  Am I correctly understanding what you mean?
Also, there is a message at the top of the window that says: "The search database is more than 7 days old.  Update now?"  Should I do this? 

I await your reply.  Thank you so much, Ridenotwalk! 

[ridenotwalk]

Thank you for your reply!  Ok, as I type this, I'm at the part where you have written as follows:
"Once the search has finished (it might find several directories/files) open the file as normal."

I'll rephrase to try and avoid confusion.

Once the search has finished, open the file "freshclam.conf" as you would normally open a file by double clicking on it. Check carefully before opening anything as the search may return several results which may be either directories or files.
You need to open the file named freshclam.conf
It should be: a text file of aprox 702 bytes located in /ect/clamav

I have the freshclam.conf open and it shows 24 files  - but none of them have the word "normal" in them.  Am I correctly understanding what you mean?

No you've misunderstood. You need to close what ever you opened and check what I wrote above

[Jan]

Thank you for the clarification.  Alright, I have now successfully changed both timeout times from 30 to 300 and saved the changes.  I'm back in the Terminal now and entered

sudo freshclam
the same four EEROR messages repeated themselves as below:
ERROR: /var/log/clamav/freshclam.log is locked by another process
ERROR: Problem with internal logger (UpdateFileLog =  /var/log/clamav/freshclam.log)
ERROR: initialize: libfreshclam unit failed
ERROR: Initialization error
I typed both

sudo rm /var/log/clamav/freshclam.logsudo rm -rf /var/log/clamav/freshclam.log
but nothing at all happens now.  Do you think this may have something to do with that message I got when I opened freshclam.conf that said, "The search data base is more than 7 days old.  Update now?"
Or, do you think I should just start over again from the beginning with a purge of clamav as you first outlined?

[ridenotwalk]

1. Open terminal

2. sudo rm /var/log/clamav/freshclam.log      or      sudo rm -rf /var/log/clamav/freshclam.log     
Note: You do not need to do both, either will achieve the same outcome

3. enter password if asked
Note: it will look like nothing has changed but it has

4. sudo freshclam

5. enter password if asked     
Note: update should start once you press enter


From all my readings of clamav, once freshclam has been run once manually and the db is updated fully, freshclam will run automatically as per the amount of checks noted in the freshclam.conf file so there is no need to manually run it again. I've looked at the log file and it appears this is what happens.

[Jan]

Thank you for your reply.
I proceeded with sudo freshclam and it looked like things were starting to work -  but then more problems.
I got the message that the daily database was available for download. 

After that the first two databases downloaded and passed the database test.
The problem is now with the download of the 3rd database.  I get the message: 

^Clamd was NOT notified; Can't connect to clamd through /var/run/clamav/clamd.ctl:  No such file or directory. 

???

[ridenotwalk]

Sorry Jan but I can't help with that one. I didn't get that error when I did it and I'm now at the extent of my knowledge.
My only suggestion is to remove clamav, delete all clamav related files and start with a fresh install of clamav as per Jerry's how to tutorial.
If you still get the above error after that then someone else will need to help out because I don't know the answer.